e5a5fcaf7db1c2c2d23c8ae2f17a45482215e5ce612ff045de1fda3da77b66b0

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/06/2026, 19:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sh.html
Size 42B
Sample260624-yhyjvafs21
SHA256 e5a5fcaf7db1c2c2d23c8ae2f17a45482215e5ce612ff045de1fda3da77b66b0
MD5 fd6866f1634d734f9daa7d1900967fa3
SHA1 983b472312cb71278da6849490e9590d080c3bc3
SHA512 69461bf87de3dbbb1ef07d2f33dc4d0c309a31a85fc91ebdc09d30af7ada57de56744d6df8d2eb3e6062afcf44396cb333394844af5a9b8ea12a9fcef88aa730
MD5 SHA1 SHA512

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4492	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268040767132729"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4118910392-3846778420-3545080915-1000\{41CE4C7D-E6C2-44DE-A003-6EB363B60AC1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5716	msedge.exe
5716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4360	2964	msedge.exe	88
PID 2964 wrote to memory of 1444	2964	msedge.exe	89
PID 2964 wrote to memory of 4492	2964	msedge.exe	90
PID 2964 wrote to memory of 1444	2964	msedge.exe	89
PID 2964 wrote to memory of 1444	2964	msedge.exe	89
PID 2964 wrote to memory of 5388	2964	msedge.exe	91
PID 2964 wrote to memory of 5388	2964	msedge.exe	91
PID 2964 wrote to memory of 2780	2964	msedge.exe	93
PID 2964 wrote to memory of 2808	2964	msedge.exe	94
PID 2964 wrote to memory of 2780	2964	msedge.exe	93
PID 2964 wrote to memory of 2780	2964	msedge.exe	93
PID 2964 wrote to memory of 2808	2964	msedge.exe	94
PID 2964 wrote to memory of 2808	2964	msedge.exe	94
PID 2964 wrote to memory of 1616	2964	msedge.exe	95
PID 2964 wrote to memory of 1780	2964	msedge.exe	96
PID 2964 wrote to memory of 1616	2964	msedge.exe	95
PID 2964 wrote to memory of 1616	2964	msedge.exe	95
PID 2964 wrote to memory of 1780	2964	msedge.exe	96
PID 2964 wrote to memory of 1780	2964	msedge.exe	96
PID 2964 wrote to memory of 4216	2964	msedge.exe	98
PID 2964 wrote to memory of 4216	2964	msedge.exe	98
PID 2964 wrote to memory of 3440	2964	msedge.exe	99
PID 2964 wrote to memory of 3440	2964	msedge.exe	99
PID 2964 wrote to memory of 3324	2964	msedge.exe	101
PID 2964 wrote to memory of 4344	2964	msedge.exe	105
PID 2964 wrote to memory of 1476	2964	msedge.exe	106
PID 2964 wrote to memory of 1240	2964	msedge.exe	107
PID 2964 wrote to memory of 1612	2964	msedge.exe	108
PID 2964 wrote to memory of 1612	2964	msedge.exe	108
PID 2964 wrote to memory of 5716	2964	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sh.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ff8366fc188,0x7ff8366fc194,0x7ff8366fc1a0
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,10809790954794322041,7152198474628682535,262144 --field-trial-handle=2284,i,12697058525277977038,8475320422895147130,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,6857148142729522165,12409882704196647418,524288 --field-trial-handle=2284,i,12697058525277977038,8475320422895147130,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,3747327337375258776,5194242668675397633,524288 --field-trial-handle=2284,i,12697058525277977038,8475320422895147130,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:13
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3652,i,6535623495319771362,9815299236168254303,2097152 --field-trial-handle=2284,i,12697058525277977038,8475320422895147130,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,15933867939535816069,12281049717124808086,2097152 --field-trial-handle=2284,i,12697058525277977038,8475320422895147130,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,2771402347630296981,8819815586175155350,2097152 --field-trial-handle=2284,i,12697058525277977038,8475320422895147130,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,2570148450688723952,3236958328043925747,2097152 --field-trial-handle=2284,i,12697058525277977038,8475320422895147130,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:9
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,8434416619648882431,10736206106055103217,524288 --field-trial-handle=2284,i,12697058525277977038,8475320422895147130,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,14046018491650867906,7259872170486169334,524288 --field-trial-handle=2284,i,12697058525277977038,8475320422895147130,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,7360333352385967000,12311599615304211542,524288 --field-trial-handle=2284,i,12697058525277977038,8475320422895147130,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,7360333352385967000,12311599615304211542,524288 --field-trial-handle=2284,i,12697058525277977038,8475320422895147130,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,8933764622926161670,9105992163838587754,524288 --field-trial-handle=2284,i,12697058525277977038,8475320422895147130,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,16251729131512157760,12374862635214828822,524288 --field-trial-handle=2284,i,12697058525277977038,8475320422895147130,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,5488753684482365321,18232412475540434564,524288 --field-trial-handle=2284,i,12697058525277977038,8475320422895147130,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,5448531237517753441,17220344515728218643,524288 --field-trial-handle=2284,i,12697058525277977038,8475320422895147130,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5524,i,8117911614036625423,15662913956994268194,262144 --field-trial-handle=2284,i,12697058525277977038,8475320422895147130,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cffda89706c34029bbadb3a079f8166927ce29a27926faf81be0941753fa411c
MD5 7cdea7179a599d50436be1171f9511c2
SHA1 6d8054f3ef2c68bd8edc0e0a0c209a8d0ec96169
SHA512 9254b7cacbb6da2f3991af0c9a702b61e8ea1514e5a421096b8814aba7d20757eb9270096433d7132ac27e348f1f0dafca2c9bdfe53b1301eac088ad262db76a
TLSH
T14BD080F53F45BA05D4471472C5105620513FC44138C6D609B171C50DDDA4DC0FBD6597
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fbb63799d26e9a7e30ff53840386023c5150d62b9ea487041ad388db361544
MD5 447de69b347844c29cf7a3b3f5e89252
SHA1 67ad860b72f4cf3188b263680869e8d3e2f79164
SHA512 b8977c20ec2389237c40a065ee9041a0ba55bc2336c4da14ff107c76ebafa289f5512cf0cafa740524f3299ee4cacddcee021abb68d7450550e6d21aa04cbdae
TLSH
T17ED080F13F45B905D4471476C5105620513FC44124C6D609B271C50DDDA4DC0FBD5593
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f9d5041018f07dda739d0d47bc79f808692a1de76c5786a6e854c4a3accc8f03
MD5 0d50c1ea0c663d1b1df8b4143a4335af
SHA1 6cae9a2f76caf8941690a56bc7828bcf2eb4291b
SHA512 ee1df38ab32d07f37a6f7ff91a2d05f09feaced1de0d0e1b9f2d0ee8012570a807c52884bb1f5c0048d43941d7b99eec717df929b7f53c99c1fabd92fc543808
TLSH
T1505167BEB72B8A73DB05127654F6E0CB33B0644ECB0B9E260C55D474FB493728207856
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4b2dc38ba8d3ff1b479877d08a60de86fca131b963f6abba81ca7f8490c8dc09
MD5 76e3c20c23689f61eb156fe2ed36a319
SHA1 71694984e92cac1dc2d853b24029759ece2defc5
SHA512 1d47335e649580791ea81890e5ee8d3f960fd5ef10f2d2101406ac88cea717576a3d066c53009968817b17728877a595865ef6879c6bb9e56dafd0171f7a895d
TLSH
T188419BF7C2E4867D890146F4BB146E2BCE2D0915932C3D5AC9E4EF1B93E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ccce2178154ab670c977a3ee7aa72bba8ae3ccb9345e96cc7c8d00ddbb9ff902
MD5 c8af1fab6238111d725813e6eec74635
SHA1 54506c6a13d58ac875d9ec76c3f9e9dfaed477fb
SHA512 abfcaab7d6ecc32ec584a30b6e1473d2d66465444c975d83abf3113d0c0f496cfdd7b19f16b6ff1bff8df85515c113b20abf0558e0992361f0f2c51f53e92dca
SSDEEP 192:sxR8RfyM/jK1Ml8wFg/fYsZqcTdgzoA8p4P/g6+WNIYbzjbG3IgIJ:sxR8rbg/fYsZqWZe/5Ikes
TLSH
T13E52DA15AA34597B8CDBE209FA557F53D6F81573A2901E44AAFCCB0C04E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 60c493a8d545542af5a8b8ffd69ff06908863ad9352d3beb36c0f8d008775d65
MD5 e804461584a33e48729a46091016407e
SHA1 d7c949090331daf7687a645f2d64c20753954172
SHA512 44f34ec5866d48387055ffcf90cbdc0ab227a688f60213b941b24372a2d079fc78e0acd81414665d6080076c80140445ec58554806e1fe8c6ad19e854d78b040
SSDEEP 192:sxRnRfyM/jK1Ml8wFg/fYsKqcTdgzoA8p4P/g6+WNIYbzjbG3IgDb2J:sxRnrbg/fYsKqWZe/5Ike6
TLSH
T14A52D915AA34597B8CDBE209FA557F53D6F81573A2901E44AAFCCB0C04E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 318ebea4e2a1127fa51303bb82cdd1b63fca73f19d3e97eae67d3d43b5292f55
MD5 e3aa4dbb53bc6618dea644b3725da61b
SHA1 597bbb7084082d2ce56785a73646294a43d83a77
SHA512 68b2ab6c4289b1a309373b789ac4582ab17532b6f2544649f5fba7905e9e4e17e4ea4dd55c7c5e7fe2ee57400485bc3ecd9d2098e4766a1ff85ba97335db6b20
SSDEEP 192:sxRnRfyM/jK1Ml8UQIFg/fYsK6cTdgzoA8peP/g6+WNIYbOjbG3IgDbMJ:sxRnrq+g/fYsK6WZg/5IRe4
TLSH
T11262D915AA3499778CDBE20DFA517F53D6F85573A2901E44AAFCCB0C04E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e9cb32c3584927da1af4b0a9a757b611b964381f3cbc14ae409ca0c25b490db7
MD5 e626cdbb42afeb215a04fe0f860b95d7
SHA1 5b3ecd93ec73c3c28c969ed510b3c962dc749c94
SHA512 f415b120d845b21a3654cf549427c8d1c0a4291fa88e0d7b6f37f0b00838a06c856b626b76247952225e1ce6e9b2bf55486f817873d551c6c8625521a6007224
SSDEEP 768:BcfLYDWg5tflq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZLO/fro4uyQnV:BcfLYDWg5tflqu1ja8K/M4jQV
TLSH
T13FC20A2B640CC77E4F844E6DEC25BED76DE802CB97988D5447EA890C03C67EB911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 eb8855d95552f650ec1977511fbe58f21d065d775c52a92c86390b2496810f0e
MD5 a0e9e3e0073294df6eb5df7d2a4b4c17
SHA1 311870f9c05c53d32b53bb7dd6d76850dee38256
SHA512 a5a30a9569206a75dd3302e64620b7d6f8c46ea49ef52ddf7f9c7021b16171c782cbfbf136e8dbcd496e6f87448720b2ec7d3d6388411cc7de91277006ce8d1f
SSDEEP 96:KAtOKuQa+NOKmg/rM/Lxp52Dpq95L2KhT512lzrSFrnArM/LxR:0ZVKrM/Lxp5mpqLL7T516zrSFrnArM/3
TLSH
T1EC91888574763744397F685480918A6EAB4130B3745BA42B3FBA94E2CD67E018FFCDCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ca8ba898a63f8515babb74d35f055f4adc473ef268a1a34f2dc99fe7f99e8630
MD5 e3da6875af9470e3ac8127bdb947b1ef
SHA1 3c027e016129e9ee2d9c976fc9f2e384be88c34e
SHA512 52d42016eeea99fe82afefe9b88f723fda3d7a89cb783ad88073060b0c49bfa64d5881b4e38d9e5b970b0f63a5873f9ae1c106bc2c839d1e90fb75e52fae2528
SSDEEP 768:ejaeqD4MlshiLdMmZ3IofFUf2Vf2q62tbnuGfDG+ApXpYTV:eqcjhIdM+37fefOfL62tbnxq+KXk
TLSH
T14913BF35EC684C779DB29585B14B7B536FB44663C3C43A98D8DD5B0D02976CD120B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9fa0f5cee6ffae38c7de922331d91dbfad50e0cb68dfb6ca8d1ba72c305c3aad
MD5 c6b537d015e12833a5752c5c746ba3b2
SHA1 50115e565b83bc1bb0cc6570f6cbe2df56f38192
SHA512 cfc5b1f69a81c3c13ac47fc257a8602ce1fc5724dfd01e1a184784dc8d726250420f13f032fcf16467edf81de0f8462d92a6430461c1b92683873d1bbacd1890
SSDEEP 768:YjaeqD4MlshiLdMmZ3NofFUf2Vf2q62tbnuGfDGYyvEbTT:YqcjhIdM+3CfefOfL62tbnxqFa
TLSH
T1EC03AF36EC684C778CB2A585B2477793AEF44153D7C92A88ACDD5B0D05972CE220B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 3343c19730b363610b218b5bd4c54f79356f3af4f2aa4e363eb71c1edd16cf4e
MD5 6d43cdaf90c9fdb5bb2c56c38cb07ad6
SHA1 a34e67ad3c78d211d7d4a152881e2b4fb968f036
SHA512 154f9516e89c4cdd88fcb09e639ef86de1b2a8d4f6f75475cd54f604d172192ec646fd620d0ad2dc9df34026d2e36f2c1fb769f29a0b44e4a822b06e014bea06
SSDEEP 768:iF1j+9j3Mwg8ofFUf2Vf22i2tbnuGfDGYyvEuvx:X9j3wfefOfli2tbnxqF9vx
TLSH
T1A6F29E32AC64897B9DF29AD4F20A3753AEF44263D6C86A84A9CD5F0D01D72DD134BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0a1980ebc1e1faaf6913dde3d0a8e6fb7d4b67eeb28cc94c3e31387bb671f2ae
MD5 f97a3a8c758abe59f7b67ec1ec8d3535
SHA1 7c66b51c172e9085acd562186387af7a6f0c59a5
SHA512 28ed1fee826e40395242185b24846a5bd02b61adc8d4eec234eaa1f3beeda5c46e8f88983cc06c735be6db24c255561143387b6093f9e109f2f8c840e3f8aaa1
SSDEEP 768:ajaeqD4MlshiLdMms3wAkfFUf2862tbnuGfTU+ApXpfTS:aqcjhIdMD3wTfefr62tbnxQ+KXs
TLSH
T15A03BF39E86848779CB3A585B2467B536FF442A3C7C53B98E8DD1B0D02A72CD624742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 7c0df4712f9ec1359f56e928a8f2b287add2ff93ffd87d6f8628b172d4c573df
MD5 65837144c9ac10d8baa931898348cb7f
SHA1 1114cde3f990ea6e333254825b8905271edadffd
SHA512 7362ec376cc34b6498603b59b8a1dbbed072c88d2921a93a8d43783de3f50294fad764887857870479ccbe1bd19ce306026b29d843399bf8b562257845dcfe25
SSDEEP 768:vj+9H3lofFUf2Vf2q62tbnuGfDGYyvEuvx:C9H3qfefOfL62tbnxqF9vx
TLSH
T1BEE2AD31EC658D679CE296C4B20B3B53AEF44263D6C82B889CDD5B0D06D779D134B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37b3cafd-0695-49c8-be13-609799428d53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\37b3cafd-0695-49c8-be13-609799428d53.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download