1fc5b524da2bf03d7f8d97289b8684bb9a01bc8f2fcaf2d40d175943598f7551

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
swiss/thank-you.html
Size 4KB
Sample260702-pellfags4q
SHA256 1fc5b524da2bf03d7f8d97289b8684bb9a01bc8f2fcaf2d40d175943598f7551
MD5 7334913270e29f679687a13ac9023515
SHA1 4a5964ff685204e6232e71f2f4e8f28d8a2c3051
SHA512 5f0bdfc1600fb346039e8ee8b5dc207e0dd47f3162e7d550fd924f6c6aa2ebd807a74648c89b1b525dd3389e5c7a8edfe39715a3a3414b5d77e041ff95bb9e03
SSDEEP 48:00Yc5nBsZ/j7IyqmHfL6meQmaZmXmCPPMeiwYoQ45ygd5JbaxVfgM:sanqZXrexaEWBzO5X5JbaxVYM
TLSH
T16A91E28BD6B7084A7446B4787BF727892399D003950ADD793D9C72B8DF886F5483264C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4572	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274680814591696"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{C00D741D-AD2C-4181-B683-9731F2DB9659}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 4524	1928	msedge.exe	88
PID 1928 wrote to memory of 5560	1928	msedge.exe	89
PID 1928 wrote to memory of 4572	1928	msedge.exe	90
PID 1928 wrote to memory of 5560	1928	msedge.exe	89
PID 1928 wrote to memory of 5560	1928	msedge.exe	89
PID 1928 wrote to memory of 2408	1928	msedge.exe	91
PID 1928 wrote to memory of 2408	1928	msedge.exe	91
PID 1928 wrote to memory of 3820	1928	msedge.exe	93
PID 1928 wrote to memory of 4088	1928	msedge.exe	94
PID 1928 wrote to memory of 3820	1928	msedge.exe	93
PID 1928 wrote to memory of 3820	1928	msedge.exe	93
PID 1928 wrote to memory of 4088	1928	msedge.exe	94
PID 1928 wrote to memory of 4088	1928	msedge.exe	94
PID 1928 wrote to memory of 4316	1928	msedge.exe	95
PID 1928 wrote to memory of 4316	1928	msedge.exe	95
PID 1928 wrote to memory of 4316	1928	msedge.exe	95
PID 1928 wrote to memory of 2732	1928	msedge.exe	96
PID 1928 wrote to memory of 2732	1928	msedge.exe	96
PID 1928 wrote to memory of 2732	1928	msedge.exe	96
PID 1928 wrote to memory of 5868	1928	msedge.exe	98
PID 1928 wrote to memory of 5868	1928	msedge.exe	98
PID 1928 wrote to memory of 1940	1928	msedge.exe	99
PID 1928 wrote to memory of 1940	1928	msedge.exe	99
PID 1928 wrote to memory of 5404	1928	msedge.exe	101
PID 1928 wrote to memory of 3288	1928	msedge.exe	105
PID 1928 wrote to memory of 5156	1928	msedge.exe	106
PID 1928 wrote to memory of 4876	1928	msedge.exe	107
PID 1928 wrote to memory of 1620	1928	msedge.exe	108
PID 1928 wrote to memory of 1620	1928	msedge.exe	108
PID 1928 wrote to memory of 3976	1928	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\swiss\thank-you.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff89edac188,0x7ff89edac194,0x7ff89edac1a0
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,6900117428336439322,9721348922241824249,262144 --field-trial-handle=2304,i,13960349746529088692,13167041799203301216,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,15856636807169997897,8128491462754812224,524288 --field-trial-handle=2304,i,13960349746529088692,13167041799203301216,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,16628611426793686414,6686777862170229871,524288 --field-trial-handle=2304,i,13960349746529088692,13167041799203301216,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:13
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,6953320705695610858,1267342367385729115,2097152 --field-trial-handle=2304,i,13960349746529088692,13167041799203301216,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,16041467495326668092,5216411957325529113,2097152 --field-trial-handle=2304,i,13960349746529088692,13167041799203301216,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,2228491009828187886,329766127511102933,2097152 --field-trial-handle=2304,i,13960349746529088692,13167041799203301216,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,7580137823392114477,11904660656042803224,2097152 --field-trial-handle=2304,i,13960349746529088692,13167041799203301216,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:9
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,7188692062982621090,10615585554101501504,524288 --field-trial-handle=2304,i,13960349746529088692,13167041799203301216,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,18167658861361012806,11213984843577532298,524288 --field-trial-handle=2304,i,13960349746529088692,13167041799203301216,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,569315746676280890,10439507815470004539,524288 --field-trial-handle=2304,i,13960349746529088692,13167041799203301216,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,569315746676280890,10439507815470004539,524288 --field-trial-handle=2304,i,13960349746529088692,13167041799203301216,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,1647668108533070474,1363537365941423554,524288 --field-trial-handle=2304,i,13960349746529088692,13167041799203301216,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,6926055423391852200,2124345227704048255,524288 --field-trial-handle=2304,i,13960349746529088692,13167041799203301216,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,10370013083800186225,1912351195051820522,524288 --field-trial-handle=2304,i,13960349746529088692,13167041799203301216,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,6370458193555966584,8624783890237159451,524288 --field-trial-handle=2304,i,13960349746529088692,13167041799203301216,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,8373296011495213380,2439096706723610021,262144 --field-trial-handle=2304,i,13960349746529088692,13167041799203301216,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 7ca6d33ad1c89ce3960342fd051e85c5c47c52bf08f0de961c49976b853749a0
MD5 99a31247f6493f4a0cd3d12bd19a31c7
SHA1 c34e750335e64b0435338a96718c8a9ed04f3903
SHA512 49304e45abcd71b9d244d1f5bbaf5b4ecacf22e1940692a5dcbb2854c38ee5e5ff4df56b4d7f1e4251cc3788aa2093553391b4af07bcdd04ab5b466abdbb6e0e
TLSH
T1F471398510D70A3DC72B34B520D2B0F8FB70C9A266C73F1711A4A4B5946A72CEB9937D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f807.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f807.TMP
Size 3KB
SHA256 9402857dc50317bb0153161727dfb70c63f71b456372b858fcc417269ff6e6e5
MD5 160b545602e3f7a020a69f0368acd60a
SHA1 d487fd4d1eb3f17ebff9e64a065e41100fb8d9db
SHA512 e75a32dbb35c903aea4401e3121944c634b1e639ddaa58c9f0af814a470cd8ca0ddee1745bb1cb66007473a4718558530ed5e99fbb760f9f8bc0a04edf6e3440
TLSH
T16171298514D70A3DC32B34B524E2B0F8FB70C8A265C73F1711A494B5942A72CEB9A37D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2749aa2bb6d4ba9679fbe2d842e1d5d3a0a23bf28c18f929237dc6c7b85f029b
MD5 a6f060798b61944a04490dc667133cc2
SHA1 4556c77becc4393bb2ec5e09208e968bd748b9d0
SHA512 1547d790a231725f9953c0afa9e182f8cc8ea0f7836bf893457d03dc2ba0864fdce6f6574e68118a3ea9a24157f1b868f604ad1747a122a5f653fcacb1861c78
TLSH
T19651BBF7C3E8867D891146F4BB146E2BCE1D0915832C3C5689E4AF1FA3E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b1c49f0a931a2b92382ab4980e562d8021441bc7a8e220795b51354cede900e0
MD5 e6168c40c2f3d1dff63520efde09b7be
SHA1 558ffb3a1c7b8398041ff550e3565061a211ed1d
SHA512 a6c7fbab722eab1722e8e2dadfd8aa7ca792fef43f13cebaf4cc75686c7a40f7fa5cb44a5948acabd46deb835314768bed6ea09a2cc08ae39e502beb7a94b9f0
SSDEEP 192:sxRmR2yM/jK1Ml8UQxFc/f7sJLOvdfCrnzoA8peq/g6+WNIYyQJPGDjBYIgDwJ:sxRmcq3c/f7sJLa4Od/5Ik2B0o
TLSH
T1F462D916AA2859778CCBD20DFA527F53D6F95573A2901E44AAFCCA0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7c4805dcbd367e580f680c70dd17fa8cc6a546566395d2d6e285019003230603
MD5 58cc77fd786f9e8d261f4f0bfd90f5bf
SHA1 b258b5614618e531eb31bd47b4d83ecb9a2893c5
SHA512 653b7eff5b7ca142575d7ef302e57bad38011d0dabd485ccfed4fea44663a973bfa0ee448c0e35bea45d81d3f6763f420f9ff859efc7a48c5ce25b4f03fd6930
SSDEEP 192:sxR1R2yM/jK1Ml8wFc/f7sCOPdfCrnzoA8p4q/g6+WNIYyNJPGDjBYIgIJ:sxR1cbc/f7sC24O7/5IZ2B0s
TLSH
T1D952D9156A285977CCCBD20DFA517F53D6F95573A2901E44AAFCCA0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 36dcdecdf2322174ba36c7b73e9d6dd1b9d86afd76727fa7cba70c01fff1ac4e
MD5 83cf8a864752e6d6a480b31eaea4c91f
SHA1 5689eed4d9a519624045567940c478f61a21dfc5
SHA512 e79137a40586af0a1e9f813ba1fa415bbc6627fc6051f357304cf52e539f99525b61a7369a9d0a437c94d67fcb4e01a9729b5ebd30b5c7ecf5d4a8615821016c
SSDEEP 192:sxRmR2yM/jK1Ml8wFc/f7sJLOPdfCrnzoA8p4q/g6+WNIYyNJPGDjBYIgDKJ:sxRmcbc/f7sJL24O7/5IZ2B0q
TLSH
T1A452E916AA3859778CCBD20DFA527F53D6F91573A2901E44AAFCCA0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f53103a7680611351b0e08755ee2ca6b2586479df0c70752de369bf6e23c7262
MD5 29e92b0d31b386eb99541cac422a36a7
SHA1 747bb774231104254d70561fcd34db681deeb432
SHA512 165ebdca6f9dfd20d00bd7bc056ea1b108cbbc91f22056f2c63e251454af5fb7ea77fda8a54a15397a6bc24c88c06ebbb627768647757f85284233acc89d2b3c
SSDEEP 768:AIox30WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOcciHro5KljJ/:AIox30WguMfnAu1jazXiU5KVt
TLSH
T115C2EB3B640CC77E4F845EACEC25AE976DD801CB97988D5447FA890C03C77EB521A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

fa81a34f-6ffc-4799-a36b-0a9a38e57778.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fa81a34f-6ffc-4799-a36b-0a9a38e57778.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8b974eea10605e85c3c5d6c9f23456188d4166a993cec05e06b55c83c2f72f76
MD5 3c720b2da0a99f4eea5c6450a085e2d7
SHA1 5e5c46f352a4bb6705d058e2241f03f19dc455b8
SHA512 ba767d44a5e95cfdafff63eb5c5648232baea10ce4748ee800be4dbd4cc9f089ce5b2b5cca29508e120e79b8df512ecde43528cee17a124fff721293a6790038
SSDEEP 768:Zj+9n3qq4bFQOJIrySXT/hUAFjQIMyOV3N5E9E0GDl8BvTPaD:E9n3IwbhNFUIpONNmEDl0WD
TLSH
T1D9F2AE72BC91CEA34CE797C476027287AFF4427795C52A848ADD6B0D068729D134BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a89bb96207578602cda8685239a2ca9e4b2bfa22eb37080c70faa9b29ca5eae0
MD5 728d9e97dfa1c8f259a891647fbaba72
SHA1 cabb53860eafeddabb2ee6b5e7ab6ccd028e0ee9
SHA512 2a32b2790a965b675125b2a23e62ed7beedb6d5d46f3354ac79a6e1f41719b2d21a7626b844e682caba90ddfbb56b9a64765708ff996f207da139e7b2ccdf1d8
SSDEEP 768:jj+9n3Tq4bFQOJIrySXT/hUAFjQIMyOV3N5E9E0GDl8BvTPaD:m9n3NwbhNFUIpONNmEDl0WD
TLSH
T10EF2AE72BC91CEA34CE797C476027287AFF4427795C52A848ADD6B0D068729D134BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b426d53b31362b08d3f2aa63606300c6cad7d5f1e6a867f958a778b462b97797
MD5 b0fffe7fd15cbf1b378327500fe4ecf4
SHA1 567c20f23216793bccaabe9f0f9a7816780b53a4
SHA512 f399ca6f6082a09a97fc938cdf764da24f610f3abf7503f2c908ba25cae2af4c1020bdcd98d7de8eaf01a5a8103b1827ea6f36ad58857429912fe91cbf2f39ee
SSDEEP 768:+rv+4UNbdF3Tq43FQOJIrySXX/hUAFjQIMyOV3N5E9E0GDl8BvTPa6:+bsbz35wPhNFUIpONNmEDl0W6
TLSH
T19613BF72F864CAA35DB7A7C4B607B2837FF8026785C50684C9DE6B0C468719E234BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 9bccfa22ad5b1fd5b72b5521274193a6fbd94a7746e88ffab47322bfa5d92fc3
MD5 04291b481de9e93c3e286c696abe5bf2
SHA1 48c20b1aa426581099453f06cd808f7289aa882c
SHA512 1a57b05fb2eef84efe643512a346ed2d4731b693074cf6f75f6b031777374b9462ef6caf37e23be9154be47ec657c5595698b1cbc8835605f2341d17bf2b7a13
SSDEEP 768:MF1j+9c3Rwggq4bFQOJIrySXk/hUAFjQIMyOV3N5E9E0GDl8BvTPaD:h9c3Gw0hNFUIpONNmEDl0WD
TLSH
T14103AE73AC90CAA75DB79BC4B6167287AFF402B7C4C16A80DACD6E0D02872DD134BC65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 25a78523f2bac24e10d10b0a66937f7b02a123e5e7a6f1fd47ca46a09ce4d7c6
MD5 9b207e62c21b8b4609863941e366ebaf
SHA1 eb89c78e09a865a0b78bc1327f866845ca558e25
SHA512 30b29d33b13107a99b841844308bf6d316a9e14309b16a06cc7d5a10280e8c70dbbace72b6ec9e26a4e7f61e73d662d550f9cf09352df05351d89623c1786af3
SSDEEP 768:9rv+4UNbdF3sK5QOJIryd/hUAFjQIMyOV3N5E9Mlk+8r0mL:9bsbf3RphNFUIpONNmPDrv
TLSH
T19203BF32E8A4DAB39CEB97C5760672437FF441A399C10A84C9DE6B0C864B5DD231BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e043bda-4359-49ab-916b-956353a3824a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2e043bda-4359-49ab-916b-956353a3824a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download