3dfa6e70f3b6744d3caf8a92dca76b7326c5bc31cb3507ee35cc625b2512e68a

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shadimall2/forget-password.html
Size 819B
Sample260629-pff3cacz2x
SHA256 3dfa6e70f3b6744d3caf8a92dca76b7326c5bc31cb3507ee35cc625b2512e68a
MD5 576aba2c50ca5264d27af94d2f846e33
SHA1 5ed07f833dbe5e1f52e8a241fb13c643c6e95dc6
SHA512 8c472b18af8b673d0c833416fff4b5c3810278a680f2df765c2a74cb526d8a0fc30c50a889458816ead3237406dc5e103a7974e8061b1464258a243f957d7546
TLSH
T1C001F66121F1293305C389C4AA682A0B3EC8DE13D80B094676FC9FD55FD7E83CC5B65A
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2984	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272090576372252"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4118910392-3846778420-3545080915-1000\{E01B9203-8523-4AB1-9F09-A42A33ABADC2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 5460	5060	msedge.exe	89
PID 5060 wrote to memory of 2984	5060	msedge.exe	91
PID 5060 wrote to memory of 3056	5060	msedge.exe	92
PID 5060 wrote to memory of 3056	5060	msedge.exe	92
PID 5060 wrote to memory of 3056	5060	msedge.exe	92
PID 5060 wrote to memory of 5708	5060	msedge.exe	93
PID 5060 wrote to memory of 5708	5060	msedge.exe	93
PID 5060 wrote to memory of 764	5060	msedge.exe	94
PID 5060 wrote to memory of 764	5060	msedge.exe	94
PID 5060 wrote to memory of 5736	5060	msedge.exe	95
PID 5060 wrote to memory of 764	5060	msedge.exe	94
PID 5060 wrote to memory of 5736	5060	msedge.exe	95
PID 5060 wrote to memory of 5736	5060	msedge.exe	95
PID 5060 wrote to memory of 3948	5060	msedge.exe	96
PID 5060 wrote to memory of 1556	5060	msedge.exe	97
PID 5060 wrote to memory of 3948	5060	msedge.exe	96
PID 5060 wrote to memory of 3948	5060	msedge.exe	96
PID 5060 wrote to memory of 1556	5060	msedge.exe	97
PID 5060 wrote to memory of 1556	5060	msedge.exe	97
PID 5060 wrote to memory of 5396	5060	msedge.exe	99
PID 5060 wrote to memory of 3784	5060	msedge.exe	100
PID 5060 wrote to memory of 5396	5060	msedge.exe	99
PID 5060 wrote to memory of 3784	5060	msedge.exe	100
PID 5060 wrote to memory of 3224	5060	msedge.exe	102
PID 5060 wrote to memory of 3260	5060	msedge.exe	106
PID 5060 wrote to memory of 5540	5060	msedge.exe	107
PID 5060 wrote to memory of 6096	5060	msedge.exe	108
PID 5060 wrote to memory of 2200	5060	msedge.exe	109
PID 5060 wrote to memory of 2200	5060	msedge.exe	109
PID 5060 wrote to memory of 3224	5060	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\shadimall2\forget-password.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x27c,0x7ffbe474c188,0x7ffbe474c194,0x7ffbe474c1a0
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,7052383781080668627,6234825695225814627,524288 --field-trial-handle=3052,i,358904323818573791,14291360931355988680,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,4382291560698473691,16234916200557592941,262144 --field-trial-handle=3052,i,358904323818573791,14291360931355988680,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:2
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,10342872419912356835,10327084821518458503,524288 --field-trial-handle=3052,i,358904323818573791,14291360931355988680,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:13
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,6517123284929122029,8296410225978345627,2097152 --field-trial-handle=3052,i,358904323818573791,14291360931355988680,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,557572860052029888,7467268605748273651,2097152 --field-trial-handle=3052,i,358904323818573791,14291360931355988680,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,8625183180646369694,3233605710513899295,2097152 --field-trial-handle=3052,i,358904323818573791,14291360931355988680,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,2779053948859541995,3322655323240222420,2097152 --field-trial-handle=3052,i,358904323818573791,14291360931355988680,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:9
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,18368109955107185043,12742126293957239597,524288 --field-trial-handle=3052,i,358904323818573791,14291360931355988680,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,2560683593384550048,7545809237791948717,524288 --field-trial-handle=3052,i,358904323818573791,14291360931355988680,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,6483994348281549670,3379378271093217110,524288 --field-trial-handle=3052,i,358904323818573791,14291360931355988680,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,6483994348281549670,3379378271093217110,524288 --field-trial-handle=3052,i,358904323818573791,14291360931355988680,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,602707051872676122,6677042913771528177,524288 --field-trial-handle=3052,i,358904323818573791,14291360931355988680,262144 --variations-seed-version --mojo-platform-channel-handle=1132 /prefetch:14
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1392,i,16118602580650082471,7900878587756646515,524288 --field-trial-handle=3052,i,358904323818573791,14291360931355988680,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,18139587713721345469,15400249792502150929,524288 --field-trial-handle=3052,i,358904323818573791,14291360931355988680,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,5502671679560432115,5824828082498483439,524288 --field-trial-handle=3052,i,358904323818573791,14291360931355988680,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=816,i,17272379543654227960,4725943928688900533,262144 --field-trial-handle=3052,i,358904323818573791,14291360931355988680,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

73a93cec-74b4-46b4-af8f-6e29d7d2e596.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\73a93cec-74b4-46b4-af8f-6e29d7d2e596.tmp
Size 41KB
SHA256 5c0046187d6a049dfe724b34ae9a2159f00fb41d2808d2365a97da5a8031e360
MD5 6812b24c85a2fdc91293ad11dc7b3466
SHA1 94173284b1cd6372afd7415a617505be01f90a13
SHA512 74eacc28aba8395939c82348d73be89a24347059722a05fe2d5c8dd971b385608739217ecbeb9acd3b031179c02b908b8182d7e489be26834867431d2cb9d923
SSDEEP 768:fjaeqD4MlshiLdMmq3Z20fFcf/fJ62tbnuGfDqzn12bfJDUTv:fqcjhIdMh3ZxfOf/fJ62tbnxOByJDY
TLSH
T1FF13BF35DC6848775DB3A585B2067757AEF846A3C3C93A989CDD170D06E73CD220B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cffda89706c34029bbadb3a079f8166927ce29a27926faf81be0941753fa411c
MD5 7cdea7179a599d50436be1171f9511c2
SHA1 6d8054f3ef2c68bd8edc0e0a0c209a8d0ec96169
SHA512 9254b7cacbb6da2f3991af0c9a702b61e8ea1514e5a421096b8814aba7d20757eb9270096433d7132ac27e348f1f0dafca2c9bdfe53b1301eac088ad262db76a
TLSH
T14BD080F53F45BA05D4471472C5105620513FC44138C6D609B171C50DDDA4DC0FBD6597
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fbb63799d26e9a7e30ff53840386023c5150d62b9ea487041ad388db361544
MD5 447de69b347844c29cf7a3b3f5e89252
SHA1 67ad860b72f4cf3188b263680869e8d3e2f79164
SHA512 b8977c20ec2389237c40a065ee9041a0ba55bc2336c4da14ff107c76ebafa289f5512cf0cafa740524f3299ee4cacddcee021abb68d7450550e6d21aa04cbdae
TLSH
T17ED080F13F45B905D4471476C5105620513FC44124C6D609B271C50DDDA4DC0FBD5593
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 68495a45bbf15f13fc83acb98d010b6889af16d775512786c72112de1985870d
MD5 7e249a0ea1936c1448be9618d6b8dd2a
SHA1 10079bafb14cf4376af3b471440596db3c75a82a
SHA512 eeb431d21e920de6afd34c07e89b386fa62e7052aad7429560542ec9bc40857192f22ca6f9760a3d354124d222db5cdb68803ab719d78a1137c513b4e1eb99b0
TLSH
T1AF615E1FA4500920DBACBE7990E0D89FF7B89705865F1EB5468490B4FD02F3852838BD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593cd0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593cd0.TMP
Size 3KB
SHA256 2341f43b3f09c2224c7200d5a6b7188574f313f39e247b80d27538a3e3f502e9
MD5 4949621c3262f81bb8484d0f725af992
SHA1 e7bee735426a5071e7782d63c34e7ad4af500323
SHA512 2b16387e9d880fc219f1a527bb290ec15276a8d628497cdfab275da377b67e96c831be0e96f33de28ec7406e767a8c595b78cb88780a9b7524c849afa0b436eb
TLSH
T167614F1F94500920DBACBE7A90E0D89FFBBC9755855F1EB5468450B4FD42F3852838BD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9685e2413618636433c60210e8dc261acd0a63e0ce0e8c3f3907df84718ad78d
MD5 719ad324db5e3489abe4cdca943d6108
SHA1 fa0b4a34222a8792120ae752d29856114b45dff9
SHA512 5e7f192d1aa7aecf8c3aca5a5af8ca93005e76d993f2d41877ac5a7c365c5e707cfee00a37165f5e14b6407763a79aff5d9d56731d8ef0d6a970ad2e7eec0057
TLSH
T19531DBF3C3E4857D8A0186F4BB186F1BCE6D0915932C3C5AC9E4AE1B93E2870E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 45902092761b37916f78632b804069cb4257528fee5a7a9b354b756ddfce1227
MD5 7c268c83a125f942f100882f903e2be7
SHA1 940d23a9d595d2dc60b4d904467b07bec601065c
SHA512 c70c70872ac61524b9826aef2b7ca61dbf96628aca2fa07f307d122b83694e703b113a138273a5669d4b104dceb6937bff948c2bca1b82bbdc3300280e5f59d2
SSDEEP 192:sxRcRpyM/jK1Ml8wFy/fGs6J2cTd1zoA8p49/g6+WNIYbzjZGkIgIJ:sxRcBby/fGs6J2WYg/5Ikfs
TLSH
T17452C815AA34597B8CDBD209FA557F53D6F81573A2901E44AAFCCB0C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e68b0ffdd8284aa94ea0af79251c1a4c41b0665705438a4abf3a11c2462d9266
MD5 9a538a928ab0b15c21c43cdfb06dbaad
SHA1 67ffc3b0076ebab41dc8c88707c7687ce4c26896
SHA512 0056a0f109ca5a02ec5a51d6871b8aa914fcb1499ce571611a8512b0d5d22dd7961b6c20e63f2ccc372e93d1c80c0c47cf818e8c9b72920fdade4b4c103c44df
SSDEEP 192:sxR7RpyM/jK1Ml8wFy/fGsoJ2cTd1zoA8p49/g6+WNIYbzjZGkIgDpJ:sxR7Bby/fGsoJ2WYg/5IkfP
TLSH
T18852C715AA34597B8CDBD209FA517F53D6FC1573A2901E44AAFC9B0C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d67e232a578c491f26264764e382e44e4265dbfc94fb8c06a86fd5c6601cc492
MD5 92a40a07a366c3f37f5cc647ccfaa1d1
SHA1 f1bba7fcc544d7b2ce2b06ac1ddfe69b317b60cb
SHA512 7e94552d3179bcf207c20d5875aa531f6f58589b7a886387722737090688d81357b3e61b04c476ab6f359a8bf92e16180c6b16ccae6cab09f35e781bc8842181
SSDEEP 192:sxR7RpyM/jK1Ml8UQHFy/fGsoAW2cTd1zoA8pe9/g6+WNIYbjjZGkIgDPJ:sxR7Bqly/fGsoAW2WYy/5IWf9
TLSH
T14062D715AA2459778CDBE20DFA517F63D6F85573A2901E44AAFCCB0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 bd2f49122d0f73c1d0a82961be77e244f51b122e512e3f9275ece97970809231
MD5 e76ca2d668ace5532e3934b9ec88cf68
SHA1 46c31f0e1c56a7c92232fd3e49d1df93bc5b72b5
SHA512 77f02371df4524ff5b0f65f4826a5b9e91c8c5edce48f5d496440b9b7527182c0e58175c446d55e5fc87882a7d569dcacd412f6e4af85db616d8e9c9605f515c
SSDEEP 768:BcfLYDWg5tflq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZLO/Qro4uRQnD:BcfLYDWg5tflqu1ja8K/74MQD
TLSH
T116C20B2B640CC77E4F844E6DEC25BED76DE802CB97984D5447EA890C03C67EB911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

65223a6d-2dff-4d0a-a1b0-a876ec4d6ea1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\65223a6d-2dff-4d0a-a1b0-a876ec4d6ea1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 36c51453ccf2bc5920307dfff892240253af21a80c8282a7dfee6a6d98c64740
MD5 c716ea1226c4996366bfc873ab986cbd
SHA1 408bbae2d1dbc8925811f084d9b3a26a04a31c31
SHA512 493ba5badb0f005f80a387b9857472d3ac9f40acbf9bab6f41d9ece973a49518ec602b4c89f97cdeed5a3dbbccdd22ea003cdf2274e2e7d117a217b1d60c4668
SSDEEP 768:qj+9g3at0fFcf/fv62tbnuGfDqzn12bfJD6:J9g3aqfOf/fv62tbnxOByJD6
TLSH
T17BF2AF31EC6449375DE29585B1063757BFF98663D3C82A8899DC5B0E46E73CC230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ddf687ab28a952535b4655d70002ed77961def37a343599777112d63b4b9777d
MD5 e0ffc137403de57edfc656523f47a7c8
SHA1 855adc0b8e314def0760e62c3c2f30f074f644e9
SHA512 94a57854e43d6f2f72b059caa38bc489436c889faba9905c1c75589922743ab27e02ee44f04b305503162bd8ca68255ed931ec32f7f4ef042af3f26281b09a3c
SSDEEP 768:aj+9g3Zt0fFcf/fv62tbnuGfDqzn12bfJD6:Z9g3ZqfOf/fv62tbnxOByJD6
TLSH
T1F8F2AF31EC6449775DE29585B1063B57BFF94663D3C82A8899DC5B0E46E73CC230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 08a416823b5390daf8422bb0514d549fa365f95c97ed582930a8e3b14208a384
MD5 c441902af0d331bf3f9a9f825f1db073
SHA1 8f939fba31a73a3e20020b9067265175f13c5a6f
SHA512 8385dc92533a8f62f0568aa7d3a612ca8752e03190ec273f6ab7f9ced1e5f4bc72f24e54e0dbbd4d3b244acd73c1cdbb677103329116cfd3a92b4ee5f570ffcc
SSDEEP 768:uF1j+9m3Fwg8t0fFcf/f2i2tbnuGfDqzn12bfJD6:L9m3gqfOf/f2i2tbnxOByJD6
TLSH
T19C03AF32DC54897BADF29A85F60A3757EFF94263C2C926949ADC5B0D42D72CC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 aff5508b3d8c1b5ce74200996090da5951377b3f730ee545d8285bfaa901bb97
MD5 e5d4ac08027356366a4141a5eba622cd
SHA1 a3a3ed7ebe71ae6502a86d1c845c8d6e86cf95cd
SHA512 0b83c00db6d644345d1baf5f1bb7d16f4d1f54b8cd77fdeaf136d33b14b73a47cb5e45b993c51d6070d91a01a152e3fade045527358904750022493c7fedb2f3
SSDEEP 768:ajaeqD4MlshiLdMms3FR/fFcfi62tbnuGfTJo+ApXpfTS:aqcjhIdMD3FBfOfi62tbnx6+KXs
TLSH
T10903BF39E85808779CB3A585B2467B576EF842A3C7C53B98ACDD1A0D02E72CD234742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17a1746f-4106-4ef6-a172-67a94e1869ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\17a1746f-4106-4ef6-a172-67a94e1869ed.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download