hxxps://eurostick-my[.]sharepoint[.]com/[:]o[:]/g/personal/andres_eurostick_es/IgCfr5G9gFNBTbs-nDPMYwSnASgHV6Eby1ehQ2Fe8kQmkcE?e=Vdnd8t

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://eurostick-my.sharepoint.com/:o:/g/personal/andres_eurostick_es/IgCfr5G9gFNBTbs-nDPMYwSnASgHV6Eby1ehQ2Fe8kQmkcE?e=Vdnd8t
Sample260701-pmxnnsf18v

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5380	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273824602325565"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{F8CF55FA-E939-4E28-AFE0-06A791BD54D5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1796	msedge.exe
1796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 3532	1040	msedge.exe	88
PID 1040 wrote to memory of 5380	1040	msedge.exe	90
PID 1040 wrote to memory of 2856	1040	msedge.exe	91
PID 1040 wrote to memory of 2856	1040	msedge.exe	91
PID 1040 wrote to memory of 2856	1040	msedge.exe	91
PID 1040 wrote to memory of 3664	1040	msedge.exe	92
PID 1040 wrote to memory of 3664	1040	msedge.exe	92
PID 1040 wrote to memory of 5312	1040	msedge.exe	93
PID 1040 wrote to memory of 5136	1040	msedge.exe	94
PID 1040 wrote to memory of 5312	1040	msedge.exe	93
PID 1040 wrote to memory of 5312	1040	msedge.exe	93
PID 1040 wrote to memory of 5136	1040	msedge.exe	94
PID 1040 wrote to memory of 5136	1040	msedge.exe	94
PID 1040 wrote to memory of 2340	1040	msedge.exe	95
PID 1040 wrote to memory of 2340	1040	msedge.exe	95
PID 1040 wrote to memory of 2340	1040	msedge.exe	95
PID 1040 wrote to memory of 5052	1040	msedge.exe	96
PID 1040 wrote to memory of 5052	1040	msedge.exe	96
PID 1040 wrote to memory of 5052	1040	msedge.exe	96
PID 1040 wrote to memory of 4388	1040	msedge.exe	99
PID 1040 wrote to memory of 4832	1040	msedge.exe	98
PID 1040 wrote to memory of 4388	1040	msedge.exe	99
PID 1040 wrote to memory of 4832	1040	msedge.exe	98
PID 1040 wrote to memory of 3412	1040	msedge.exe	101
PID 1040 wrote to memory of 1364	1040	msedge.exe	105
PID 1040 wrote to memory of 4988	1040	msedge.exe	106
PID 1040 wrote to memory of 4360	1040	msedge.exe	107
PID 1040 wrote to memory of 1176	1040	msedge.exe	108
PID 1040 wrote to memory of 1176	1040	msedge.exe	108
PID 1040 wrote to memory of 1796	1040	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://eurostick-my.sharepoint.com/:o:/g/personal/andres_eurostick_es/IgCfr5G9gFNBTbs-nDPMYwSnASgHV6Eby1ehQ2Fe8kQmkcE?e=Vdnd8t
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff8b947c188,0x7ff8b947c194,0x7ff8b947c1a0
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,3514583469330755565,10104839472868418390,524288 --field-trial-handle=2576,i,9606588280718284070,14810924903655990179,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,1676625434943230780,15258483318599541500,262144 --field-trial-handle=2576,i,9606588280718284070,14810924903655990179,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:2
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,9253322647638794644,4908697860039490667,524288 --field-trial-handle=2576,i,9606588280718284070,14810924903655990179,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:13
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,12336885060064273983,17996142176846860874,2097152 --field-trial-handle=2576,i,9606588280718284070,14810924903655990179,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,3600314762472473509,1578956816780898653,2097152 --field-trial-handle=2576,i,9606588280718284070,14810924903655990179,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,10618664961251137547,11508874157767971008,2097152 --field-trial-handle=2576,i,9606588280718284070,14810924903655990179,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,16423797759104213901,14208125385951103252,2097152 --field-trial-handle=2576,i,9606588280718284070,14810924903655990179,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:9
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,5255650333668280379,6835565593255804731,524288 --field-trial-handle=2576,i,9606588280718284070,14810924903655990179,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,16613202778840615307,3232765047083230492,524288 --field-trial-handle=2576,i,9606588280718284070,14810924903655990179,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,14601873830665260332,13456878513104655047,524288 --field-trial-handle=2576,i,9606588280718284070,14810924903655990179,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,14601873830665260332,13456878513104655047,524288 --field-trial-handle=2576,i,9606588280718284070,14810924903655990179,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,8955176433404805836,12679388636535749204,524288 --field-trial-handle=2576,i,9606588280718284070,14810924903655990179,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,18373044721096735561,14760907977980135434,524288 --field-trial-handle=2576,i,9606588280718284070,14810924903655990179,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,12216016598097078165,12161634966570833295,524288 --field-trial-handle=2576,i,9606588280718284070,14810924903655990179,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,7526126314687118009,291296108406135122,524288 --field-trial-handle=2576,i,9606588280718284070,14810924903655990179,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:14
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5860,i,3328662883430154889,18295268650188726130,262144 --field-trial-handle=2576,i,9606588280718284070,14810924903655990179,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
MD5 df62623cabc43e309a7767f4081f29d9
SHA1 420f1a4b11b86944a73d3cbcd4aec4883dfdfd62
SHA512 02067a08d194a87842f985ff7d0bee13c7b7228146565bf19114ffaebc120cb3d2ba8b19c941bb0d2773043366f064246a55efd57127d4a0de5768f453b2730c
TLSH
T1FDD08035774DFD08C18054717890D3517A204460345AC3186329A01DDDBC68513DF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
MD5 b2c496fb89251ff9b8ff1c46a5315932
SHA1 19626950ca3b280d084016871229a48eb3fa5ffc
SHA512 bbd974e4a08ca8f629f0b9a8892ba78ac7d4191c1640d1037e4fd018dadb4d8edd0a663e4a673a29497151c4defd9be09b6a4a4788adf24b182cbc36b18ccda7
TLSH
T1C5D08031774DFD08C18054757890D3517A104460245AC3186329E01DDDBC68513DF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 594d0967893338dc0a86441dc9aa1882aa24f64482c57567eec335e83ff13768
MD5 a7dbc2588063468ffcc0bff670fae2d8
SHA1 9bb25b51954783353de15620cfa9a5e7607b4c94
SHA512 f3b2d2a24871df2d77758a84006459a41e173fa081cd72b5ded7b6b7f6921f1b8990a9d7cfbd514e5aa11214596c9b0a5cf1229c02c9f6f32ca18000123018e6
TLSH
T1EF5175273BB2EA1EEB6000B54BD257F97371C55A6E0FAE201095B1FBCE8B7779080840
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 beb4bdfab93d553a3a3c1c1563961e28bd44dac471dbad55c358652d12df1e38
MD5 7f6cd16d5c57fd2b6bd550abb38fe81c
SHA1 bf6255aeacf34de86f3a128cb307410ba94e40f4
SHA512 3e0869a95e90f532cc6eb112b9d94f9747f92aa9929985e4c0de984c99855d10a1a8289ecd63527e88ebde208524860fcddb70fa8eed4ade501b78cabe3052ed
TLSH
T1DD61BCF7C3E8866ED90152F4AB146E2BCE6D095483283C5AC8D4EF5B93E2472E24094F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8ec68349822d6d7830b36ab56927d36a02672a1ae908315a95d228a266e878bf
MD5 c4b3e972a44abec8e0417095d8ffb7ad
SHA1 e351071ec8f10e645e97a09307786a1e89620378
SHA512 25af70f97f895142326e682da88746cd68e0d68dc84a1123ce099d7fa2d3f3f848fee3a083bcc64975c12b9c26b551a9b73f4a3e5ea03bba93d7178672989e58
TLSH
T13761CDF7C3E8866ED90152F4AB046E2BCE6D095483283C56C9D4EF5B93E24B2E14054F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 641d222709dac77b8cde90567b1a2d639a4112c03c4c87108718d708ea33048b
MD5 26901062b3e0173e4c11b257d5a29442
SHA1 b45f5586dd7f9422974bfe92bcb7c7097d0f1cca
SHA512 da34572d147e11afb1a460bd1149e0cd36bb26327ed2a68a15a62f660ab0198ab7a22173c6f9b85a1a5a462946b9bf5e1dc68c1eeb3925e255ccbd83a5a548cd
SSDEEP 192:sxRVapdRIRyM/jK1Ml8wFYl/f0FsQffokD6zoA8pAV1/g6+WNgVaY/Y47uAe0IHZ:sxREmbi/fIsQHv+/5k/Ne03s
TLSH
T1E862EA1665246D3B8CDBD209FA45BF63D6F91533A2905E04AAFC9A0C01E77ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ef9c6380ee1c4a86feca5fae5486328ed7f319c3ca99ba396c8c23a899f56769
MD5 e407d175e29e67249395750916a5d75d
SHA1 33410bdd1b79679e9b14ccecdc79988afc4cd5a0
SHA512 af59bee18857b56ba90c5ae1454126249465c4433d85196d7c08a0ce3471167a9d9a258778220c668a4f5a84f26cd22168e1d4d5e1abc27b5ad1724ea38e03ac
SSDEEP 192:sxRVBpdRIRyM/jK1Ml8wFYl/f0FsYQffokD6zoA8pAV1/g6+WNgVaY/Y47uAe0I9:sxRXmbi/fIspHv+/5k/Ne03i
TLSH
T16162FA1665246D3B8CDBD209FA41BF63D6F91533A2905E04AAFC9A0C01E77ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c099405a600f4d9f42b8936b5c6e2c4c2e6b056621ce94e92de445832f467142
MD5 df3e09f990b1e8245a43698aeb003db1
SHA1 54aed4adf44204b996a0b719e2231dea03c73252
SHA512 5c1c018579e28b6649d1f7b5eb597eef63f3f0b5e7d0e2817163dd27fd190c57ad5579abc7ce8c02869e9b15a6280ef29759aafb62b67075ac4e085d2eff7dce
SSDEEP 192:sxRVBpdRIRyM/jK1Ml8UQYxFYl/f0FsYQfOtokD6zoA8pyV1/g6+WNgVaY/Y47Rh:sxRXmqIi/fIspWv0/5k/Ke03Q
TLSH
T1BF62E916A5245D7B8CDBD209FA41BF63D6F91573A2905E04AAFC8B0C01E77DD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 59ffd7dbd2c3630638bfa2765b56594c0dd5fc27bca5d2cfdd080eb3271c83f2
MD5 b22a154dc89387193556133b7a08c590
SHA1 a842a970cefc93eae4098ac2d187557235fa2122
SHA512 e71b60303b372cc11203f1384d457be1da8b0ac647469851e09039b1dd9920fa01c217ec1e5979c6455fd29bb77fc1577f094d8703000768aed85ebc8897d99b
SSDEEP 768:Tqi0E3WgNxfez8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtXNGgroKTy5w:Tqi0E3WgNxfezu1ja49GrS
TLSH
T1FFC2FC2F640CC77E4F844E6DEC2AAF976DD801CB96988D544BEA890C03C77EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ab9b9c43571cd3425b0fa815f9f742053929d134a00e6109486d5ecd2fb9df08
MD5 7055164778f65b7a011fe9cf50c9419b
SHA1 f80b73f99cd2611f31ad62840b7e2a4df1aba0fe
SHA512 4d6691d9919ddd7da823df3373f9eb00514518ef90a1fbd8a2a62c50066f7faba77188db684677e9d3428887a27ea042ab69df7e6ca50e9efa4673fed446501a
SSDEEP 96:KobeKUgWyUIK5WiAxEwCui4WGbrg44K4dgq4c4YLqwVHJGXThDXzz:odznAxEwCuivGb04cdgqX4YLqwVHJGX9
TLSH
T166916FC5B0BB1B00397D2D1995A4985ADA81706330EEE4FB3BE810E55B67E024FFD9D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

10128f8e-d4c8-4312-a036-ccdee32fb870.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\10128f8e-d4c8-4312-a036-ccdee32fb870.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 fc937e5520cee8bebfa1e4761928ee9ed1b64f388f46ad4fbbdd8fcaad6b8153
MD5 d32d5c57f5546b0666a4e9fa606ed99e
SHA1 2001b42ef45fb7c866eb56327872a406cd1b3f7c
SHA512 5e0843ff19b4bbbd17fccee1ad3217f06150026c4ac44ef11a87b019be2fad0a987a163dd6bab2056a76814f3db27e9d457fdbd6cb2803828a2e3323a64c74b7
SSDEEP 768:orv+4UNbdC3nRethX9ltI9Kh+AW+152MvSCai+c8KzNIo:obsbo3w9I9Mpx2pVctzNIo
TLSH
T1B113BF32A858AD778DE286C0724B7A137FB4525382851F64CDDD5B4D02DB6CD230BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5c5a5fbe0f18ba4cb08d50a9b408f61ad70e7d751232b552ed508181db29e562
MD5 ced2dab1e606fc1b0533c93ac94b60d0
SHA1 1d177b830d74a3b6f7ebb3b2d610bb63f6737816
SHA512 9738c20e9039564bb5b76c185dabfeda8bcd481e1f9e2dc1f9f34dfd205a302512472ab8b7e955b5ccab9116bec022990763382a54b91b55286e84cf1ea65abd
SSDEEP 768:xj+9c3SethX9ltI9Kh+AW+152MvSCai+c8KzNIg:s9c3z9I9Mpx2pVctzNIg
TLSH
T1FBF2AF32AC55AD778CE286C4774B3B17AEA1535382812E548DDD6E0D02CB78D634BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 7b1f6e48fd91a783ccdcc275d153f4646e13ae38fcf01f2b9eebfe7d176c2dc7
MD5 aa3c60b73f484892c27597b1c2f17ccc
SHA1 50d26d9b6a0940ed6ef3d1da341b7041ce6a8f9e
SHA512 bc3717d78a7a0fe6d567883507ca665c410ecf3712ea9e555761b367978ef6549cda5c41adeb86e034edd892fed623c04d261e7d58bca503903568a86a9e8a45
SSDEEP 768:RF1j+933gwguethX9ltI9KC+AW+152MvSCai+c8KzNIg:w933a9I9Fpx2pVctzNIg
TLSH
T139135BF258C78976CC9D4BC3673E2E129EBDC253B1811950BBC9590CCD862BFD24A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 726c932a9429c3a387a87d3d9570d5d1ccd9dd69f1f87303e4d2a587a5f10ed5
MD5 b8b53b091c3f94a7578ddd97ab8b4e1d
SHA1 ba15bb1ca075f3fd3c6243d616fd4f38ced6f5ac
SHA512 8481539ea5c040094bfbf267128203e7cd66a72d3b3442e7700ab911104570b7659bb5ddc29a27f26cf9b31525267951296ddd227a0be0a60b9e458f37a75d36
SSDEEP 768:Hj+9c3LethX9ltI9Kh+AW+152MvSCai+c8KzNIg:q9c3e9I9Mpx2pVctzNIg
TLSH
T19AF2AF32AC569D778CE286C4774B3B17AEA1535382812E548DDD6F0D02CB78D634BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 aecc3949474f6b729097b95c3b7572d773e56bbb4c31e00645cc60048a970627
MD5 ac5bf05087d452e3a031c1f5322acbf0
SHA1 05820c5bc1ecef4aad141168b3128a03a6dcead7
SHA512 170e0dd638afb1f2b2060b7c9ba1fff9bba5c9d49a8334cca9e950714581015e1f658458a95f3783f9c7352c4989a4df8bd8146ab6ddf2d241620d072660ed92
SSDEEP 768:Arv+4UNbd23cPthX9ltIB+AW+152MvSCa2Tkr+8rir9:Absbs3o9IBpx2pckrDriR
TLSH
T1A403CF32D869A9738CB6C6C4764B36137EB0519386C10F94CDDD2B4D429B6CD230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download