e5a5fcaf7db1c2c2d23c8ae2f17a45482215e5ce612ff045de1fda3da77b66b0

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sh.html
Size 42B
Sample260628-1efkzaew9x
SHA256 e5a5fcaf7db1c2c2d23c8ae2f17a45482215e5ce612ff045de1fda3da77b66b0
MD5 fd6866f1634d734f9daa7d1900967fa3
SHA1 983b472312cb71278da6849490e9590d080c3bc3
SHA512 69461bf87de3dbbb1ef07d2f33dc4d0c309a31a85fc91ebdc09d30af7ada57de56744d6df8d2eb3e6062afcf44396cb333394844af5a9b8ea12a9fcef88aa730
MD5 SHA1 SHA512

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6680	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271560218055449"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2882181966-868590553-1461876573-1000\{29D15F0D-8BD5-44C2-897B-C31E644F3CA3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 6084 wrote to memory of 6168	6084	msedge.exe	89
PID 6084 wrote to memory of 6372	6084	msedge.exe	91
PID 6084 wrote to memory of 6680	6084	msedge.exe	92
PID 6084 wrote to memory of 6372	6084	msedge.exe	91
PID 6084 wrote to memory of 6372	6084	msedge.exe	91
PID 6084 wrote to memory of 1560	6084	msedge.exe	93
PID 6084 wrote to memory of 1560	6084	msedge.exe	93
PID 6084 wrote to memory of 1664	6084	msedge.exe	94
PID 6084 wrote to memory of 4140	6084	msedge.exe	95
PID 6084 wrote to memory of 1664	6084	msedge.exe	94
PID 6084 wrote to memory of 1664	6084	msedge.exe	94
PID 6084 wrote to memory of 4140	6084	msedge.exe	95
PID 6084 wrote to memory of 4140	6084	msedge.exe	95
PID 6084 wrote to memory of 1184	6084	msedge.exe	96
PID 6084 wrote to memory of 1892	6084	msedge.exe	97
PID 6084 wrote to memory of 1184	6084	msedge.exe	96
PID 6084 wrote to memory of 1892	6084	msedge.exe	97
PID 6084 wrote to memory of 5080	6084	msedge.exe	99
PID 6084 wrote to memory of 2956	6084	msedge.exe	103
PID 6084 wrote to memory of 6544	6084	msedge.exe	104
PID 6084 wrote to memory of 1676	6084	msedge.exe	105
PID 6084 wrote to memory of 4432	6084	msedge.exe	106
PID 6084 wrote to memory of 4432	6084	msedge.exe	106
PID 6084 wrote to memory of 4064	6084	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sh.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffe3db8c188,0x7ffe3db8c194,0x7ffe3db8c1a0
  2⤵
  PID:6168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,5201119117620496138,3617908578231474803,262144 --field-trial-handle=2912,i,1776165728689658096,8018184252082763906,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:2
  2⤵
  PID:6372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,12098244941529282605,9096547989318698390,524288 --field-trial-handle=2912,i,1776165728689658096,8018184252082763906,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,12649680047853936256,8605716725968458644,524288 --field-trial-handle=2912,i,1776165728689658096,8018184252082763906,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:13
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,8287869160026224174,7001849214237106952,2097152 --field-trial-handle=2912,i,1776165728689658096,8018184252082763906,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,8019175221413987818,481495099501865885,2097152 --field-trial-handle=2912,i,1776165728689658096,8018184252082763906,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,1745482892457296315,7523516599781822044,524288 --field-trial-handle=2912,i,1776165728689658096,8018184252082763906,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,1572579837109299861,12828321954446308271,524288 --field-trial-handle=2912,i,1776165728689658096,8018184252082763906,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,9609434223787935983,3886149478817754038,524288 --field-trial-handle=2912,i,1776165728689658096,8018184252082763906,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,9609434223787935983,3886149478817754038,524288 --field-trial-handle=2912,i,1776165728689658096,8018184252082763906,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,4129963500054276413,8881303969579924463,524288 --field-trial-handle=2912,i,1776165728689658096,8018184252082763906,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,14996368352273512035,11390419658337079377,524288 --field-trial-handle=2912,i,1776165728689658096,8018184252082763906,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:6544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,14163492537852111573,10711454946623003254,524288 --field-trial-handle=2912,i,1776165728689658096,8018184252082763906,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,4868665634048142764,5214381478877815367,524288 --field-trial-handle=2912,i,1776165728689658096,8018184252082763906,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:14
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5248,i,1197586984367822779,8887465538863416612,262144 --field-trial-handle=2912,i,1776165728689658096,8018184252082763906,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff07219f3594693f0fac57895f6888104d17957d039d3530d82987134771108b
MD5 26fba9d3c09d715a1b951844cadd62c5
SHA1 9e4dc8d0a08f2feba8c030b217c14a6a5c1e4827
SHA512 fc2fc417004bf59d775f5e0fafa0e6d4883632e585e21934aba3d8697554f979efd3a818d1e74c7713d51b1993f1678a707621ebef66bdf01536cd7793ff1e31
TLSH
T184D080357B46EC53C0163071583743A4625682166567D5177850D01EC846595B7D2147
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f60cd2d9231e56b0a0784a59fb17664fa333e06aac5ee1d5692effc5152b5c30
MD5 cce4d9b2c5f5fb7c3bfaaab4af8f0448
SHA1 17b40c534fd35eb849f575565dee407cf6215d92
SHA512 5e1cbca923a813696df373e5b185a1b3fc4f73a39029b41c0ce02bf3dea25ad383c02c9763a6d8965f882055fcabaceefe0852b44c19af280ddaf74994edc4e6
TLSH
T119D080357B46EC53C41630715C3743B46256825A6967D5177450801EC88659577D214B
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 158fc73584a14ecff0b1bbe55bfcc32b3d9739f88d2e1976f2536873d3c08153
MD5 7a83cde6333f0ee60ebe0df57a5349cd
SHA1 5d5f32f7a963626eed591759633dc8c03f10e545
SHA512 06e26c34aa810abae8cb89498b871eb05e0a0f345010a23f2ca2f824873b659d3d875a90e3334893b57d21aa134485898ad441d59cbdb683c0217dd3f1749ef3
TLSH
T11AF0F4AAC831AC3719FD1B1970944B4BF754236B6782998F3A3D920C8FB167B4A8591C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 01e7111d072ad94060acf6ab459413875396f1bc6cb71f0886cafdb8283b4e67
MD5 d8de0285661740755ceb4d01629b00ad
SHA1 95de8617696d7ac24ce165bbcae35c0603418872
SHA512 bf0b4d1deea279d677bb73b4656cbb518bed78c6ebfad7246fab532f3d87b02e2decb8748d5a599642659221f6f7ac20d0d3a4b626503ec1d26c8f973c57c0ea
TLSH
T14741BDF7C7E4866E890196F0BB186E2BCE2D0514832C3D5AC9E4EF1B93E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d485137b288a3595e79675b6c84104a2b8d9cae4701421d17000fd89136b3038
MD5 78c8696e704f67ce4d6e5e010d40f44e
SHA1 4fa6bab9ba0d26b24ebdfdb449bf627c63cf9b73
SHA512 e66639fe1b1e591e553fec4d4064b570b8d577cb5020ac8068dd03278d99ce56fbd3400411905253a572d616c49b475c4d5657c506a01eb491370bed277eb8f6
SSDEEP 192:sxRuRiyMqZjK1Ml8wFt/fVs+Dj6aMpPZ5NtWzoA8pec/g6+WNIY0l94K6UWGyIga:sxRuLbt/fVs+qzRRT/5IL4K6Ugj2
TLSH
T19862D815AA24497BCCDBD219FA557F53D6F81533E2545E44AAFC8A0C04E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2bebf4a5825aeb28a78aa5816fd78f1d863269fed1e8a3ffd31393a33eecfe78
MD5 d4e8941d48b2cc7898b33dfbf6320608
SHA1 c70daf458580cb225bc56ae30901f15310ff2725
SHA512 9cb8525bb96874a42c8079ac6d78070ab04de5a829af0ba634ab3f97f4c8fb0a43f3e65b7114e7502da9fe40c5f0e41197e72c94e62ca1a87891ad9d9150bd9a
SSDEEP 192:sxRuRiyMqZjK1Ml8UQ3Ft/fVs2Dj6/MpPZ5NtWzoA8pec/g6+WNIY0N94K6UWGyQ:sxRuLqVt/fVs2qcRRT/5Iz4K6UgV2
TLSH
T1C662D816AA284977CCDBD219FA55BF53D6F85533E2545E44AAFC8B0C00E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 1fe0b7974154a70f350c36509905d84433c05fce3c5656e2b80bcbbc67ecaf32
MD5 06e2c23aca53ab42036e739e23b99a5f
SHA1 dced2a65afb2e2930d6589be7bad14f39c555542
SHA512 8aa13a5580aa25326d4a129f7a1b9dbcc8485f161ab8f7c052225cd39b98d7a3cde4d48a453b6fe8fe927d2a5623a1d5b7a9cfe6bdb9666aa174d4ee4730eeed
SSDEEP 768:PXoDVGWgoqfjs8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3RiW5oroV0A4:PXoDVGWgoqfjsu1jaKQW5TV0A4
TLSH
T1C1C21B2F644CC77E4F841AACEC2AAED76DD801CB97584E5447EA880C03C77EB521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 2c3dbcd730395865e30088d75d4004880d73494205605e782806a987312c5071
MD5 6f2bf8e299e3aa1059289e015c086457
SHA1 486d7aa3fe457fdd7bec842f4b20d3b457a9d59f
SHA512 c544d3ffebd882c53e93e9207724d5138a06fb873a4ee672a3b0d30f1edf3e0c5b81a452156745ad458950f17e6ae3f0a3fc76c1a112210fec1802fa042ddb21
SSDEEP 192:6H76D7ElhDfFJfpdBJ9XvC79vsDIsSyid6Z8cUne2J80xesrnu:6b6XEHDdJBd79/ChBpu
TLSH
T186B24911797E220538BE2918D1A5C56F674230B3301AA63B7BBC60E51EA7E005FFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ba8e70979d628c96e9336da61e18e03110c4468a083e18035d7c24a639d028df
MD5 81685002233f2c7b83b35a6c057479b6
SHA1 28b38d0be78ccf048e6d630ec20acafd30a2c6da
SHA512 ee5ec99058abfc8f3a53e2c69bb7cd46ed8b787fbd18f8b63c219f88e8b20d922a7c4683f0c3b6e9b5a51bae318b1079674f6b22ca6f1d9d5c5593610bb7a2b9
SSDEEP 384:ndiF1tNn/s3n9Sx8Nq8TUNTUlIRFUGh8H8kmfoFGiDrg5SonH5mn15wbAjEO8hyk:UF1j+9ojwgU5rGiXh85mn12bfZIk
TLSH
T156D25B36D850CEB7ACE78FCAB74A3606DEE442A3C6886AD4D9C81E4D01D72DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e7c0b661ffad0216874cd96491ae0a217620294f8defe19b8a84612568893805
MD5 b8480c57cacc821d2dde06bb1ac95d39
SHA1 f004c5cd392b645d78c18d2301e8598e4ed6dcdf
SHA512 5351600783e8c283129480f92577d066213116f05dcb4c102155d128781f0d7feff439cbfdcb9c5f6bb3a877fafe8eed3e05179b09eafb804f1582c4e9b3b6d6
SSDEEP 384:nViF1tNn/s3n9Sx8Nq8TUNTUlIRbUGhHH8kmfoFGiDrg5SonH5/Pb9oRtpU8Lk18:cF1j+9ojwgeerGiXh85/AtprvN
TLSH
T1C2C24B32D850CE77ADE74FC9A70A3A479EE04167C5C9AAD8DAD92E4C00CB2DD430BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7b8ad18cbbe8c3cd0f72880ff11949b228b49b2b6277a3f7ab4bdb8e06fbfa44
MD5 d05f223a64efa1e6ee4c0f92067c544a
SHA1 f05684acbece5866ce3995548934408475643e01
SHA512 424c8fef8860f079791448b33b3cace25fe0dd2f71bcb277e75e23be83eb6ef7398a5bbd0dde3fe7a38d8a4901f9fc4ee44d3d03f2a12230677ab57da8abf6d4
SSDEEP 384:nWiF1tNn/s3n9S98Nq8TUNTUlIRFUGh8H8kmfoFGiDrg5Sont5mn15wbAjEO8hyk:9F1j+94jwgU5rGiXhE5mn12bfZIk
TLSH
T1A4D25B36D854CEB7ACE78FCAB70A3606DEE442A3C6886AD4D9C81E4D01D72DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 72c30f9c3bcfe223bba83912d224638fe1f32ee5734d5b0d0b8e93ade509c793
MD5 786ccaf7840a00c2b9fca71276eff3fa
SHA1 996ad11404b63daa81da18161b24aeda56ba71b9
SHA512 41ce495f300ef001a552a1d9b079252389505070c971c4048084307dc9a1d3a4fe4de28507ac68c53d35302a1c19184e16026cf6f3b04637362aecc71e73330f
SSDEEP 384:nGiF1tNn/s3n9S/8Na8TUNTUlIRfUGhnl7kmfoFGiDrg5Sox8J/Pb9oRtpU8Lk1x:tF1j+96vwguWKGiXhYK/AtpovN
TLSH
T1DAC25B36D850DE77ADEB4FC9A7093A47AEE001A7C4D96AD8DAD91E4C00C72DD1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download