e5a5fcaf7db1c2c2d23c8ae2f17a45482215e5ce612ff045de1fda3da77b66b0

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/06/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sh.html
Size 42B
Sample260624-wtyb4set5j
SHA256 e5a5fcaf7db1c2c2d23c8ae2f17a45482215e5ce612ff045de1fda3da77b66b0
MD5 fd6866f1634d734f9daa7d1900967fa3
SHA1 983b472312cb71278da6849490e9590d080c3bc3
SHA512 69461bf87de3dbbb1ef07d2f33dc4d0c309a31a85fc91ebdc09d30af7ada57de56744d6df8d2eb3e6062afcf44396cb333394844af5a9b8ea12a9fcef88aa730
MD5 SHA1 SHA512

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4172	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267984123191360"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2894455325-857903158-4263030270-1000\{E717EB86-FE9F-4AF2-BDAF-FCC72BA1B85B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 4964	2972	msedge.exe	89
PID 2972 wrote to memory of 2116	2972	msedge.exe	91
PID 2972 wrote to memory of 4172	2972	msedge.exe	92
PID 2972 wrote to memory of 2116	2972	msedge.exe	91
PID 2972 wrote to memory of 2116	2972	msedge.exe	91
PID 2972 wrote to memory of 5988	2972	msedge.exe	93
PID 2972 wrote to memory of 6052	2972	msedge.exe	95
PID 2972 wrote to memory of 5988	2972	msedge.exe	93
PID 2972 wrote to memory of 6052	2972	msedge.exe	95
PID 2972 wrote to memory of 6052	2972	msedge.exe	95
PID 2972 wrote to memory of 2052	2972	msedge.exe	94
PID 2972 wrote to memory of 2052	2972	msedge.exe	94
PID 2972 wrote to memory of 2052	2972	msedge.exe	94
PID 2972 wrote to memory of 3008	2972	msedge.exe	97
PID 2972 wrote to memory of 3860	2972	msedge.exe	96
PID 2972 wrote to memory of 3008	2972	msedge.exe	97
PID 2972 wrote to memory of 3008	2972	msedge.exe	97
PID 2972 wrote to memory of 3860	2972	msedge.exe	96
PID 2972 wrote to memory of 3860	2972	msedge.exe	96
PID 2972 wrote to memory of 2864	2972	msedge.exe	99
PID 2972 wrote to memory of 5568	2972	msedge.exe	100
PID 2972 wrote to memory of 2864	2972	msedge.exe	99
PID 2972 wrote to memory of 5568	2972	msedge.exe	100
PID 2972 wrote to memory of 2044	2972	msedge.exe	102
PID 2972 wrote to memory of 5712	2972	msedge.exe	106
PID 2972 wrote to memory of 4272	2972	msedge.exe	107
PID 2972 wrote to memory of 3184	2972	msedge.exe	108
PID 2972 wrote to memory of 2708	2972	msedge.exe	109
PID 2972 wrote to memory of 2708	2972	msedge.exe	109
PID 2972 wrote to memory of 3472	2972	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sh.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffc97ddc188,0x7ffc97ddc194,0x7ffc97ddc1a0
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,2323459721153383691,12843713487219147641,262144 --field-trial-handle=2400,i,11363975070255018960,5059025727387235378,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,16124872551746577775,15450943106347151490,524288 --field-trial-handle=2400,i,11363975070255018960,5059025727387235378,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,11059724039027384970,3663182639387327037,524288 --field-trial-handle=2400,i,11363975070255018960,5059025727387235378,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:13
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3340,i,38461701626208009,1488496229953270991,2097152 --field-trial-handle=2400,i,11363975070255018960,5059025727387235378,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3344,i,11825542352321364044,5703979609559692535,2097152 --field-trial-handle=2400,i,11363975070255018960,5059025727387235378,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,10468626718230866001,151618077013097018,2097152 --field-trial-handle=2400,i,11363975070255018960,5059025727387235378,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:9
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,2138311663613871331,1245640492004690876,2097152 --field-trial-handle=2400,i,11363975070255018960,5059025727387235378,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,5368727702023576769,13343365126861700743,524288 --field-trial-handle=2400,i,11363975070255018960,5059025727387235378,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,14705685104038989472,11390297044977190656,524288 --field-trial-handle=2400,i,11363975070255018960,5059025727387235378,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,8587353332873075923,15184655455789792838,524288 --field-trial-handle=2400,i,11363975070255018960,5059025727387235378,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,8587353332873075923,15184655455789792838,524288 --field-trial-handle=2400,i,11363975070255018960,5059025727387235378,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,17985479766367189029,16605721817104767212,524288 --field-trial-handle=2400,i,11363975070255018960,5059025727387235378,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:14
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,13996724151796950841,1414125446534035521,524288 --field-trial-handle=2400,i,11363975070255018960,5059025727387235378,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,12121371386846567487,17459064750609412178,524288 --field-trial-handle=2400,i,11363975070255018960,5059025727387235378,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,16318509184344112407,8274702833077884162,524288 --field-trial-handle=2400,i,11363975070255018960,5059025727387235378,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:14
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=800,i,18332068068256927873,17274072347314362108,262144 --field-trial-handle=2400,i,11363975070255018960,5059025727387235378,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4921dac989a582c68ea2ce6e44eb3bfcd7f8bf3d87dd155763734d09e46d6684
MD5 6fe58dba083868c4939df3729856b544
SHA1 2946fc6a531247a5afe5d20c0abec1329e76da1f
SHA512 435b892e3c3ced9c341bcad7627e98220f381783f6c0d232345dd92e9cb28357bd93211262aa046fe541f6bd0686d5084ac7e92c687fc72829288aa7d9c823de
TLSH
T1B7D08034FB45B745C78605F2D514A720637A864534C2C60DB1A2D50D98681D0B7E79F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0f06119439d622a1a5078cf90d2c84d55bc25c179cc319a31bc271a3e62dc8b5
MD5 39897ff436f6a2795449c696417893df
SHA1 b1e15f7b2c6f5ca94bea9d8a160cc9e6864c1d06
SHA512 75fae24fb44003376ccf64d6c3715357ca6f73fb6cca4422a2574a4960dc75c830ef617f5476e7fc21942b321e9fe764ebf9ae64abfc2b05a73fdd7fb96ad95e
TLSH
T1F2D08030FB45B745C78605F2D514A720637A864534C2C60DB2A2D50D98681D0B7E79E7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d8dc76092f7a21eb45cd346439733169fe641dd97fc7e76a502fe9adef4de00e
MD5 2e47cb81f468fff6a4c9ec2a79bee301
SHA1 0254ab788e1002d288c24124730ef4170810922d
SHA512 343276feb00136f0ddeb8c2b158b328718e70ff9b8e762bec850f256f37e38bafd6c716f03a1f71ee8f2cb2ee4283b9044e5e2974786c11dfde73adfd4218b35
TLSH
T19A413FAC776AC0E6C7F4857710DF61BA3B7E98361503EE84749490B4FA01B4C47B2C14
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e83ac16-db2d-4f7d-b723-cb743a379ae2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8e83ac16-db2d-4f7d-b723-cb743a379ae2.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a2b885cf4f331d98f6c6c4375f7ced11bf33a77eab7204992578fb00df01fc80
MD5 d523b4eef5539e995d4b61c4fe0f7aab
SHA1 1589502b54d7501495f9ff68c8d9c2388b045ad5
SHA512 a40564bb040daf19b6879d1ceb80ad4626be49edb57c714d6d950eb7b9528a9dfe76aefbb072cf8c159ff08cfad0dab2ed31317614409ae9e094df07c3bd6c92
TLSH
T19041ACF7C3E8856D8A0146F4BB182E2BCE1D091443283C5A89E49F5B93E2471E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ace03ffc746f670ea54afde705c652d62a6cc887a70780ba4e2c21489e96ab32
MD5 ec096934ab5a95d750dac4d095302d51
SHA1 c446d2f054d479f743f45ed22375d2cd198a0f70
SHA512 8a399318c4e51c57ea283019acaeacd11ded1d9be12fa6e2fbd20b5ca43ca2aa4facf75fde7aabb4898b66bffdcc9e497df8ed921daab27a28014810c400b50a
SSDEEP 192:sxRVRDyM/jK1Ml8wFk/fUs3SjZIy4zoA8p4N/g6+WNIYPPUz+GUVIgDuVJ:sxRVjbk/fUs3iZXM/5ILz65e
TLSH
T17352D8166A3859378CDBD609FA557F53D6F85462F2940E44AAFC8B0C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 53bfdf8163beed726f6a2a61070f325ea7428b722e9e67c818371952c10057ee
MD5 05816682ed09572c4702ab293aedfd2f
SHA1 e570ab788c6f4c3191d428b5646ac500b7acf476
SHA512 96234bcfbdfa3a18617bf17f511cd0027b64b53af95daccbbb017c7a2867e04dd1433a817ca99e267400bc8967b9b0571e293cd3c6744558519e7b180d735346
SSDEEP 192:sxRVRDyM/jK1Ml8UQVFk/fUs3Sj1Iy4zoA8peN/g6+WNIYPLUz+GUVIgDubJ:sxRVjqzk/fUs3i1X+/5IDz65c
TLSH
T1AE62C816A63859778CDBD60DFA55BF53D6F85472B2940E44AAFCCB0C00E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0eca933828ba32ee005a03e276c8811d143d0b841852ebc4d3b4f2b3c91593f9
MD5 1a82fd6758be0d02834c825a2120a537
SHA1 ce8d5fcc2a7154afda9e1c79348d285f570b7bbe
SHA512 4f5387e9ca3c6ec8909e4d9007a9deb63d42c7159b2fde3edd82ca2857f76ebd53780daa1a1f5b5471a39b47b00a7ceba26c3c89feb85ad94f736dc813643416
SSDEEP 192:sxRuRDyM/jK1Ml8wFk/fUs5SjZIy4zoA8p4N/g6+WNIYPPUz+GUVIgIJ:sxRujbk/fUs5iZXM/5ILz65s
TLSH
T19852C8166A3859378CDBD60DFA557F53D6F85563F2940E44AAFC8B0C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c6658655a33e9088b812eec64e92132046cd152aaec8308441641d06f48eeb82
MD5 7a35c847d0dd338c863694c90a9cce64
SHA1 afce98c0a1596ac399d11089cc89789f5957f008
SHA512 820ff7d67f78438bd28099c2776abe4f83a29d5b835b8aa5b371d1301b5d0eaf6a5f0cf8e70f4d4a9214a99218553be05be362a79735765bc545863bea1470c6
SSDEEP 768:LKKg6xWgdVf7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJ3nYRrouevdWFmT:LKKg6xWgdVf7ku1jaY3YquevdWFmT
TLSH
T167C2FC2F240CCB7E4F844E9DAD26BE976DD801CB97584D9447EA880C03D77EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6a5d9c028191bcd97689291f6ad319fc4d65f93e33261e6bd7cedc7bc405b532
MD5 87051f06d0f4dfa79631b4ff6ab4d6a2
SHA1 68352c92f8b8b9d869a6a8e7e0ce082bbb79cef9
SHA512 b88c3d58a739d38fb1398efdb78fccc1aade6a629fb341801573502e462b1f8f14c204cd96adb04e859e942eb8071c67d5e8b7d4c875a13cb5273747b4005ec9
SSDEEP 24:Ku4PgE+IlKshI1uSRWlyX1AGeJFzqYbbuVLe/1IyluKr9hzHu15t+SX0RdBkTEnC:K4pIlK6IIfyRmIvK3qEbAInK9ecbyVK
TLSH
T1F99127D6747B63402DBE6809C1A0D62E668271E23156642B7F78A0F31EA7E510FFCDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1f70.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1f70.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9a91fe6e94853ccfa5d81f09a7c8b4fbb7beb8081558a580eeeeab62994d2df8
MD5 4523e59f8e00418615fcd9c9e9d456cc
SHA1 b08626df0c3a4bf58c47814589151651b9e0745b
SHA512 81149a287ca835ee61339a2147ad4bbf59df50048fa656caebae7ab18cfe794caf2d1666be356efdb2013487eae45bd78e01ea426d752b78935aaac12db0faa2
SSDEEP 768:qlj+9c3MyDcOL1tbTtE75riXYUsZUgb9eHc0zn12bf6vvU:qQ9c3siIUsZUgb9sBBy6vvU
TLSH
T1EEF2C071DD78DC574CE2DBC4B226224B7FE5446346C92AC499CCAB0D06E769E030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 07b8a8f98082ab21130f7f432f6c512c14583dbab1891b61d9ec811425baf1d1
MD5 228ff04777772407f695464a60b9a21a
SHA1 37b8a3c40f80c61acdbf5673d5a251d77aa01f16
SHA512 c34dfb2c51f1678fdeb1c025ecee2f6f89fc1820b96ce1411dbd63e6859678ff5112c1a95ac17096d1b2ca3f6a4cca237f165cb274c15959f7a76efa517b0cc5
SSDEEP 768:Glj+9c33VDcOL1tbTtE75riXYUsZUgb9eHc0zn12bf6vvU:GQ9c3wiIUsZUgb9sBBy6vvU
TLSH
T14BF2C071DE78DC674CE2DBC4B226224B7FE5546346C92AC499CCAB0D06E769E030FD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 55a45d36ea7cd1602532e05601ba3360f69002bb3a4db89c25365e654fb84a11
MD5 290411adf6d0c5abd3623caa614e0960
SHA1 96ee86223b0d4d2d3b16055ca34a5a3108413c6c
SHA512 f493e4dad575ddf28e2e3a7b295768587047d700a212eff961d479b6cb2d2af5e09120e0ec02b2b13329a4bbd16a758d1973aece4f4ffeb9f16a08955d1a9880
SSDEEP 768:ZkjaeqD4MlshiLdMmJ3gUIcOL1t475riXYUsZUgb9eHUQ+ApXTcHT+:ZkqcjhIdMG3gwiIUsZUgb9s5+KXP
TLSH
T17803C07999A89C678CF2D6C5B36766472FB9019386C52ACC9CCC6B0D02A35DE530782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 d7cc117c6c151c1506134df1ff5cc9cf36f51af9d6b8e23ac5212b1a0f05c3ab
MD5 da8398e0ffbfe203de51f73057fd6036
SHA1 106355af88c9c0682c7a007359072ef1f2edaa5a
SHA512 49fb9a4a15f01e93c18da48a082774ddf662d2be17ca24869d33f25275df3d865c538a25e4ed9c71c6aaf6de958c74c382b2f40a86090f5c4f21c948258b5d23
SSDEEP 768:ueF1j+9+37wgTVDcOL1tbTtf75riXYUsZUgb9eHc0zn12bf6vvU:ub9+3LiIUsZUgb9sBBy6vvU
TLSH
T14B03B072DDA8CD6B9DE29FC4F22A220B6FF540B385C565D49ACC9A0D02E75DD030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a085d9a-f1a3-4fed-a585-2c56a857a8da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5a085d9a-f1a3-4fed-a585-2c56a857a8da.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download