e9e6a6a564cf56c00a63b49feba06b479fa7538672afb503c6c3041677c4ba39

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
utility.html
Size 295KB
Sample260701-pg46kadz2n
SHA256 e9e6a6a564cf56c00a63b49feba06b479fa7538672afb503c6c3041677c4ba39
MD5 a4fad45bae1a2d71b2b81847cd09f90e
SHA1 c8907b421c7cb2666c1b1830b8375d8efa0b269c
SHA512 cedfe21719372d4bb330035029aa0fdfe776650ddd33a7e10c32e7fc2b89f4069043147f915de9a3e9e6c3ad321a4e641ce278523ce91b3019aaae45d6cec56d
SSDEEP 6144:1Edo2Cp6Edo2Cp9lNuO+L6qFnxw7A+27rpZiow:1Edo2Cp6Edo2Cp9lNuODqFnqk+27rpZI
TLSH
T19654123157813DBB583CCA8C72D13E842E98DECFC6B8924535F5A0E382EE751ADB1259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2520	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273820092678322"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{3A5D9D04-840E-4B98-892D-E776B5AC4C2F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6036	msedge.exe
6036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 1796	2732	msedge.exe	88
PID 2732 wrote to memory of 712	2732	msedge.exe	89
PID 2732 wrote to memory of 2520	2732	msedge.exe	90
PID 2732 wrote to memory of 712	2732	msedge.exe	89
PID 2732 wrote to memory of 712	2732	msedge.exe	89
PID 2732 wrote to memory of 6024	2732	msedge.exe	91
PID 2732 wrote to memory of 6024	2732	msedge.exe	91
PID 2732 wrote to memory of 5372	2732	msedge.exe	92
PID 2732 wrote to memory of 5372	2732	msedge.exe	92
PID 2732 wrote to memory of 5372	2732	msedge.exe	92
PID 2732 wrote to memory of 5536	2732	msedge.exe	93
PID 2732 wrote to memory of 5536	2732	msedge.exe	93
PID 2732 wrote to memory of 5536	2732	msedge.exe	93
PID 2732 wrote to memory of 700	2732	msedge.exe	95
PID 2732 wrote to memory of 700	2732	msedge.exe	95
PID 2732 wrote to memory of 700	2732	msedge.exe	95
PID 2732 wrote to memory of 3224	2732	msedge.exe	96
PID 2732 wrote to memory of 3224	2732	msedge.exe	96
PID 2732 wrote to memory of 3224	2732	msedge.exe	96
PID 2732 wrote to memory of 6008	2732	msedge.exe	98
PID 2732 wrote to memory of 1340	2732	msedge.exe	99
PID 2732 wrote to memory of 6008	2732	msedge.exe	98
PID 2732 wrote to memory of 1340	2732	msedge.exe	99
PID 2732 wrote to memory of 1720	2732	msedge.exe	101
PID 2732 wrote to memory of 5152	2732	msedge.exe	102
PID 2732 wrote to memory of 5152	2732	msedge.exe	102
PID 2732 wrote to memory of 5152	2732	msedge.exe	102
PID 2732 wrote to memory of 5508	2732	msedge.exe	106
PID 2732 wrote to memory of 1568	2732	msedge.exe	107
PID 2732 wrote to memory of 3044	2732	msedge.exe	108
PID 2732 wrote to memory of 1800	2732	msedge.exe	109
PID 2732 wrote to memory of 1800	2732	msedge.exe	109
PID 2732 wrote to memory of 6036	2732	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\utility.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffed44cc188,0x7ffed44cc194,0x7ffed44cc1a0
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,5564610859379599664,11753578889528888117,262144 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,7981663015001180530,13321688350842715179,524288 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,12172341917268277081,6382900258874236781,524288 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:13
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,15598593242562820907,11712093455801016951,2097152 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=1556,i,905440509335449097,13400019619950568019,2097152 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,6995034674571715275,15822386404505078606,2097152 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,5687333399353583811,14745575272316624207,2097152 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:9
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,9060630714343821572,11172096413877349821,524288 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,2238647391686183242,1275446259040692656,524288 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,2615435738671178812,11871734448779856053,524288 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,2615435738671178812,11871734448779856053,524288 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6320,i,7799732745053864047,3605939217269245969,2097152 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,8790450428940007817,5755642054218284193,524288 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,18203187118058254268,603533971845920826,524288 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,16800884333436260027,13744915938916428851,524288 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,11651859497240825433,9704041282369876765,524288 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5064,i,3116283784544229147,11435103123015122454,262144 --field-trial-handle=2324,i,5300491642208339326,13376534039899147292,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bea28d9638dac59990bdc6b9fece9f477f8d28c508c1a253fd1565bbc9fc4ae3
MD5 f10d65bdc736c03466ef52fb3e973cc6
SHA1 1553d68481be544f8fcd8f4f31978854061662fb
SHA512 1789433df7c4cb6b8c6af88635e9335389bfe36da7d8457f3b16e6d774ad9e050c045de056bbf16dcb7c5f7f882bdde6345ed9e7f12c4d6295e169346b1bbbf7
TLSH
T186D08015378CFC09C945303258515751F5255861645F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27eeefdbc28c4562b0f7961dbf8ecc36dc6cdfdb8dba90b92fab4f8d38495733
MD5 02240668b330773d82eb39ca82064ff3
SHA1 da6a7c95e21b04cb7aa5296fa464996f592a9476
SHA512 850ad2cbde9cda49998ffee162ecf4a7e854604619f29434682d460d4b33049219c253cb3208a75d43cda1a23a05ad280b0f98228e3cc9146d1a22b246e53b30
TLSH
T1E2D08011379CFC09C945303658515751F5155861145F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2ea90ebdb3e8389a75d49faae5d271acb83ea08d4cfcc24661226926e23f575c
MD5 dd4f6eb94316010b061da39d73023e94
SHA1 43f7f58ac4cb966825f86f4102ee08a2ac35873d
SHA512 a945d0229f1f9f98b5fd78b13ae26dc9c1388f111c3e861d1d0dd13ed4a908af5974219605b01dfcd95db0fd02620662bd8106c83137c2396367c7542636bb69
TLSH
T1AB61E916B36209E3F72B37B16BFD50597371D09372476EC01750BB79BC5672A85C2840
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d43e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d43e.TMP
Size 3KB
SHA256 6c79a474c8635df5687f890c0de4cbda3a18ddd16f6d4ddf93b213eede88826f
MD5 c93d91f2a970a649eb1e4a16a90de546
SHA1 4ad90e8b77fb52df470a2516a1cfedc28235e606
SHA512 02d7e81eba619c2f8e2f9523072c3784e2fcb308d1129da246ab13e0e76ac07d0aefbaa8082f669ce07ca200f876fed39aacde7cf5200e4bcfa272e85db764c7
TLSH
T10B61FA16B36209E3F72B37B16BFD50997370C08372476DC007507BB9BC5672A85C2840
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 161c6668f820ea475414106a8dd9b62254f8eec32d6b6d244f0102209a3d71fe
MD5 1403e40e58f4f9b281b0fa795e7b9b16
SHA1 010ca261ed96cadb7a973ef7cb41f97c56d24f23
SHA512 0921202753fcdd6e9491024307bc8d617657295a3b66834666abea55d5cb8db14c51da99fa22cdae0f3530c0d9b244537755d3cce3bc1faecba6457e0d9845ed
TLSH
T1DF41CBF7C7E8862D890146F4BB186E2BCE290915832C3C5AC8E4AF2B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2e0364f05b874c5dc35e064a96a27dde7b85b8dcad303fa47225e97dd6687179
MD5 23998ce98704f85a27fce0a9bc157059
SHA1 43cdc4cb11fcc4f8232a11d20565f9316c066827
SHA512 46c2f9e873e796601e7386f336361d0285f998631cb3869d4df3544edfd84b96b2531640c42e5843c0f172704c73d2b7be8ecbe98de2ad7aef32dea7abf167f8
SSDEEP 192:sxRV+K/yM/jK1Ml8wFYK/fK0svCkVWvvdNzoA8p4VP/g6+WNIYTKVlP+GsFZIgIJ:sxRj7bx/fbsvxgWc/5IJ9es
TLSH
T1B552D9159A24593BCCDBD20DFA55BF53D6F91573A2901E44AAFC8A0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7985d3474a1eee01c78a47a38d47263ef730650da0b363e0055bb808ea1c7b29
MD5 d02cab4a61d7d28d033233666716c11e
SHA1 b0fe7d199c99c1731622b7973848a7f19a10b1e9
SHA512 3a0ef9f357fefe312005769238153de4df575d28a2c0ce662caa22a79e7be2ca6f095809455147ce9b4ea7ca9b068aac6b4a0fe42ff53ef9a2fabef240e085cd
SSDEEP 192:sxRVzK/yM/jK1Ml8UQYWFYK/fK0sY3CxvVWvvdNzoA8peVP/g6+WNIYTvVlP+Gso:sxRs7qbx/fbsWYgWu/5IY9eM
TLSH
T1B062C816A9245977CCDBD209FA55BF53D2F95573A2500E44AAFC8B0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fb0206622833c7280f6fc203553dae515b4c6b575c1fe06fc47f33a7e1a5857e
MD5 b9cc562af82cd9495783a1cd6c3da360
SHA1 b03c569e9dc42c15c32f417ffab2c143d9fcb9e8
SHA512 680aba0818ddc557e90970f04e6b82df98aeaf2dc0f19aa6e56ccbb7765490ee5a438d26e2f7cd96a63aa334d328f28e61627ba866d3754aeb19b0680f6f7ed9
SSDEEP 192:sxRVzK/yM/jK1Ml8wFYK/fK0sY3CkVWvvdNzoA8p4VP/g6+WNIYTKVlP+GsFZIgO:sxRs7bx/fbsWxgWc/5IJ9eO
TLSH
T18B52D715AA24597BCCDBD209FA55BF53D6F91573A2900E44AAFC8A0C01E77ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6832794da4699b0963a3f07844701fb310a67d2446d6ff416269763d1d346cb3
MD5 432b61cc87eefdfd962355a590443972
SHA1 474894be473822b9e57c7e635d1e58c1aad87845
SHA512 3544ec849b43725cb8bd8b4c0f1b2c405cc6eb8271206afa552ae03981a32c4a166145367de34019610b163817fd244711a16dddc0d887532293688626b46ada
SSDEEP 768:RGqOYrWgTvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJzFYirot8q:RGqOYrWgTvfiXu1jaERY5tF
TLSH
T19CC20B3F640CC77E4F804AADEC25BE9A6DD801CB57984D5447EA894C03CA7FB511A4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f5825a06d9a195e814446fc4f76be80cbdfe8d0c1fb7f428e01e296b3a9e10a5
MD5 aec59b97cbb199771de4ab1f0f3b5885
SHA1 52c0a9f96e6d37c5ab0b530d3ed9950b00c6cefa
SHA512 029fbc70137672bda10852bf1a88ae7354b412f701124390489098f486437506b212ba4fd4064ea8ec588555386bf96a91d8c9874f2c17e594c6a357fd3a4540
SSDEEP 96:KQ/CKAsu+n2K4wMafG6MsMaW0xpgqaK4vgwac6yZIKTHinOiU0kiz:MxNfafG6MsMl0x6qivgwh6yZIKTHinO2
TLSH
T164916A15733A32C0383D781880A5947E5692B153341AB82B3FBA91E61F6BF40DEFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c4acf7db-a628-4e69-9cb2-5dd4980319ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c4acf7db-a628-4e69-9cb2-5dd4980319ce.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 979c8db812654e7de48d6405979153b9137ed6082c72db8729bbdc5483313273
MD5 0b6ee6ecf4def4fe6bbcf849f747ba14
SHA1 3aabece94285cc2dacfcbf11aaf428bfd95e1462
SHA512 9c56164367b1b98dde6e4b9bd8b60d2685f2612d33b50a7f237031ed62eaea22544374a5e315f770ee8b4186feff3722bf6b8b77df0375dc978204f4f072ba7f
SSDEEP 768:6j+9c3XV6x55QHXodOiIyN8Y1M1fmBnZnVc8Kz1Z:59c3XVfHXodI11ectz1Z
TLSH
T145F2C0319C628D634CE281C8B6177746BEF192A397C52F54A5EC6B0E05877FEA30BC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b4d62dcb0d96fccdd64f38f4c54bc9a1a574d34db292328fc4fca1c173bd0a6b
MD5 a1da53f7b47b969842cc51ed43358cc7
SHA1 c9971dd65453118c160649c39a8e92c45158b5e5
SHA512 3c93beea3acc05db5043333cf20bd69ab3bfa058e520f4bb402c599847519694c6f1bb2ba4612bded3f04b7ed441714a7420b90d4ada44e545bfc5d59e80940f
SSDEEP 768:lrv+4UNbdi3SV6/55QMXodOiIyN8Y1M1fmBnZnVv0F:lbsbI3SVNMXodI11ek
TLSH
T1C013CF32E86499678CF38288F55776437FF4A1A78AC81B54D5E86B0E05476FE230FC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 9709f54601aec95789feaa6dabf42b3a3694a92d37eeb8f50d6753f818ce0c78
MD5 b5aa6532ee7dd6a5aaf37743b5dd8f87
SHA1 2809e7efebd7f9b493ca4df8f74bfc31271ee1ee
SHA512 54087db610257424af4dfd7e07103211f4db4d1460c2705109f78c7280acfb2afda22d98b04041cfaf2a9f2c9c9814c298e19c452bcd9fd4500ce3d69cb82429
SSDEEP 768:tF1j+9Y3Qwg+V6x55QdXodOiIyN8Y1M1fmBnZnVc8Kz1Z:k9Y3BVfdXodI11ectz1Z
TLSH
T11603BF328C91CA678DF68AC8FA173752AEF192A3DAC57E54A2DC5A0D01473FD630BC45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 114f2d6a391f83db865fd35bad23942e363ac9ce4a1ba10f0f67268285cddd9a
MD5 eae07bab93f9f406579cdfdedaed0020
SHA1 97056705d0e7eafd3815a8d5ccfd0336a4f83405
SHA512 8012384fb2135591f0e0c4f0cd2cf8e90570f8ade368508193c59b3bb80a1d58eb42f134ea31414fa5ba80d59d5fe9b19c7ae7081200fd88c5c8e2d52487b969
SSDEEP 768:Yrv+4UNbdj3s6ut5vXodOiIyN8Y1M1fmBnlnuv0B:Ybsbl3s9XodI11p8
TLSH
T14F03CF32D86499778CF28288B54776437FF491A38BC90B94DADC6B4E4507AFE230BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e11ac3b-b2cd-4a2e-a564-77af48177707.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3e11ac3b-b2cd-4a2e-a564-77af48177707.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download