ae13b297cc7e4c839dd7d1e3ac2658253d5b588df732a39a9655c43a8e402c7d

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
release_Siphon_v1/Bin/citizen/system_resources/chat/dist/ui.html
Size 387B
Sample260703-2bpvxagy81
SHA256 ae13b297cc7e4c839dd7d1e3ac2658253d5b588df732a39a9655c43a8e402c7d
MD5 2a1d6f7c0dbec8db4ad0ebcd5db59589
SHA1 4c3f761698e32f61e66099686ae87c8d8bc8b400
SHA512 fd8808c253dcff710618f83ef94d6d0632eaee1a2d55b847426cb394f935922e1ad02c9d5a5eeb937ab2c4ff377bb3ce7604ed8e44b4e32ed4f4f4cce61f6396
TLSH
T19EE0D848C850235CA6602E96FF81736DC8CF390E1A607C1059B5123885B83CC885DC81
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2388	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275915362316007"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557124681-2609731375-3674401788-1000\{B37F06EC-CBB6-4B2B-BE56-76FCBA543B63}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 3668	5764	msedge.exe	87
PID 5764 wrote to memory of 672	5764	msedge.exe	88
PID 5764 wrote to memory of 2388	5764	msedge.exe	89
PID 5764 wrote to memory of 672	5764	msedge.exe	88
PID 5764 wrote to memory of 672	5764	msedge.exe	88
PID 5764 wrote to memory of 4128	5764	msedge.exe	90
PID 5764 wrote to memory of 4128	5764	msedge.exe	90
PID 5764 wrote to memory of 1012	5764	msedge.exe	92
PID 5764 wrote to memory of 5448	5764	msedge.exe	93
PID 5764 wrote to memory of 1012	5764	msedge.exe	92
PID 5764 wrote to memory of 1012	5764	msedge.exe	92
PID 5764 wrote to memory of 5448	5764	msedge.exe	93
PID 5764 wrote to memory of 5448	5764	msedge.exe	93
PID 5764 wrote to memory of 5628	5764	msedge.exe	94
PID 5764 wrote to memory of 5628	5764	msedge.exe	94
PID 5764 wrote to memory of 5628	5764	msedge.exe	94
PID 5764 wrote to memory of 4452	5764	msedge.exe	95
PID 5764 wrote to memory of 4452	5764	msedge.exe	95
PID 5764 wrote to memory of 4452	5764	msedge.exe	95
PID 5764 wrote to memory of 4860	5764	msedge.exe	97
PID 5764 wrote to memory of 3736	5764	msedge.exe	98
PID 5764 wrote to memory of 4860	5764	msedge.exe	97
PID 5764 wrote to memory of 3736	5764	msedge.exe	98
PID 5764 wrote to memory of 4560	5764	msedge.exe	100
PID 5764 wrote to memory of 5376	5764	msedge.exe	104
PID 5764 wrote to memory of 3416	5764	msedge.exe	105
PID 5764 wrote to memory of 4920	5764	msedge.exe	106
PID 5764 wrote to memory of 760	5764	msedge.exe	107
PID 5764 wrote to memory of 760	5764	msedge.exe	107
PID 5764 wrote to memory of 4384	5764	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\release_Siphon_v1\Bin\citizen\system_resources\chat\dist\ui.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2a0,0x7fff5b74c188,0x7fff5b74c194,0x7fff5b74c1a0
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,12886588695210334801,11289519117566192962,262144 --field-trial-handle=3140,i,7790752641004482065,16654814581310573564,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:2
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,4969601350695831279,3719000632834843317,524288 --field-trial-handle=3140,i,7790752641004482065,16654814581310573564,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,2453108719972748374,9252768790231375552,524288 --field-trial-handle=3140,i,7790752641004482065,16654814581310573564,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:13
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,7909980144750500988,15868233761471534448,2097152 --field-trial-handle=3140,i,7790752641004482065,16654814581310573564,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,17696716005584693711,7919031891010626392,2097152 --field-trial-handle=3140,i,7790752641004482065,16654814581310573564,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,281828446648538219,535707144580116706,2097152 --field-trial-handle=3140,i,7790752641004482065,16654814581310573564,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:9
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,14897015602334340032,5808688128395245691,2097152 --field-trial-handle=3140,i,7790752641004482065,16654814581310573564,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,10574069167339394885,14837044964584999022,524288 --field-trial-handle=3140,i,7790752641004482065,16654814581310573564,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,4965762497048259327,9331928037383288800,524288 --field-trial-handle=3140,i,7790752641004482065,16654814581310573564,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,7680700152535239040,2424628645267597364,524288 --field-trial-handle=3140,i,7790752641004482065,16654814581310573564,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,7680700152535239040,2424628645267597364,524288 --field-trial-handle=3140,i,7790752641004482065,16654814581310573564,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,7361754701926159860,13453694334247557573,524288 --field-trial-handle=3140,i,7790752641004482065,16654814581310573564,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,11234061975360864897,10626495252462768567,524288 --field-trial-handle=3140,i,7790752641004482065,16654814581310573564,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,14657059506032776973,10671020229690592360,524288 --field-trial-handle=3140,i,7790752641004482065,16654814581310573564,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,17089945974859628404,6280550810411259735,524288 --field-trial-handle=3140,i,7790752641004482065,16654814581310573564,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5432,i,4355223127391799653,9353103577442895993,262144 --field-trial-handle=3140,i,7790752641004482065,16654814581310573564,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d4768ca53680cbe73471e7e7e20fcecca5f677c329e6dde10a9a5cd8c5d9aeea
MD5 350e276b7ad7e2ecef8bb501be41cc47
SHA1 23becb63d8e483408e7d4fddb258a53badd7ad36
SHA512 2bc8ca9b12d87d3ac8610b154b232960a01fc38689558de33b6a2c6e51358e0224147bc1a9fd6494fab448e063321ef4125089d341cdfd4762066fcffbf5dcae
TLSH
T1ECD080747F04A505C1911531BCD55751B52544716D7B874CD050E01DCC15185376F1FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5ae221908285db4719a807e2425a6f6732ddc1c73479482370457ee753fc89c7
MD5 520c2031f5ecabbc157ceac9f596ecd8
SHA1 22edf0e64699c903241400bd6c846811295ca362
SHA512 08764eecf9136bd2ae304a8a479d84a9cdd4faad137bdd47172e9fb79dd70c63a1236c83111416df8577d12f9b471fa3323939c8e383beb748ee03fedb348751
TLSH
T119D080747F04A405C1911531BCD55751B51544711D7B874CD150E01DCC15185376F1E7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ceb9a56ee8344f8de7fe8c82f11a7a08b7967d1743939f39327a6f0bd43c5185
MD5 04009dbfde1b32f4b29790b11ec95a67
SHA1 0ed4010e6e2b1f3414c5a41a51bc0ff638a7b234
SHA512 87cbe728638b56f0f626172fdcbc92f98394564bafb9bfd727e6df76d1fbba007f81636861f8b4c45eb99a6b75d8a7b4f9747670aa3b3713b6449bbafbbf045c
TLSH
T18C613C1328FC69E9DB15937A14D21DB737B8449E39C76D0D88D0B2B9FD0678863CAC28
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5953f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5953f2.TMP
Size 3KB
SHA256 3ec56ce5575367367fd8d1626c2d9e3e8b30367e9ccd63c4fbb7e04a686bc177
MD5 b7076c88ab29a1820f1c377f8b12c5b3
SHA1 1835058b3fa869766e3928dc3a09b97a4d459e2e
SHA512 9b73207cd9dde9f067f0f4b4dcd534008e67e37424abb1e49a1e6b8867807e5a9933873fb91413445a261c19f47967a8032e6d618eee7b7045b8c094ff972336
TLSH
T18A614E1328BC69E9CB15937A14D21DF73778449D38C75D0D88D0B2B9FD06B8863C9C28
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 34f4575fb89aa301fd3a3b02b60d95454505c76c500a1d35cbbceceaf7606586
MD5 b46a7cdd11aed94e1cda41a3ef72dd10
SHA1 2203d2d81c08ab28092197af12f7633af2523dbf
SHA512 4b60d0631f4917c9c024c0246eea96bc0f23a5e1bb63cac1c2952c5ee0fe7477f50a973e24cc6522f3115c955305d845b9e1f144d90895264a2ed5993955b474
TLSH
T18B419EF7C3E8857D890156F4BA146E1BCE2D0915832C3D5AC9E49F1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c104ad84db2d5486a6938a1a13f87e2c2c0894ed8ffb78d8bc3941c05f2fc8a2
MD5 caaa4ac653343f6a679543b12b417f44
SHA1 c2138436c9fecd9837e7edad2cfdfe3d5a77ee0b
SHA512 c2e2ead256b0c0e5939b6196cebc60004f36b8533064b15c4854802d79d5be5162a2420acd79866648a1a6d417b21e3dae5c43273efe16ddceb768e8ce185371
SSDEEP 192:sxRWRIyM/jK1Ml8wFnf/fW/siT6qsXPFzoA8p41/g6+WNIYGfs+GNIgIJ:sxRWKbnf/fW/sS3QAY/5IqPs
TLSH
T10B52E9066A24997BCCDBD20DFA457F53D6F85133A2941E44AAFC9B0C01E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 105b243ca0ffde862e2c3e351f467e26e34f8465d79284791375d7becc4a96ff
MD5 cf5a7f9fad6bc0723598cb604ab1b999
SHA1 b34a783360c15f17e8bd11aee93c1fcc4194920b
SHA512 d5ab8939b4673f10e71c8be0bc8e681d3822d1383c55e70c8f1e726dc5091a566fd9dafb1643687a0645577d0b02933e7377e4db2effe78a906988b55a324eaf
SSDEEP 192:sxRNRIyM/jK1Ml8wFnf/fW/sHT6qsXPFzoA8p41/g6+WNIYGfs+GNIgDtrJ:sxRNKbnf/fW/sz3QAY/5IqPR9
TLSH
T17F52E906AA24597BCCDBD20DFA457F53D6F85173A2941E44AAFC9B0C01E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4c097b4f38187de48334036cca672504e4b2c80730fe182009e0dbe91bd8750a
MD5 26e0394a5f15d4c3aa4aad5e37b178fa
SHA1 df4c1663ef412da2a38cb0f795bbdc661c87d1eb
SHA512 62ac29d2d83e5c580f0cf9e922fa887820e6835c9c593c69684d5da8e8836edad11f69eb726b91630d591f658ab91a300196f1784b6b9607c2d5ef7173ba8b07
SSDEEP 192:sxRNRIyM/jK1Ml8UQmFnf/fW/sHT6ysXPFzoA8pe1/g6+WNIYGis+GNIgDt9J:sxRNKq0nf/fW/szPQAO/5IzPRH
TLSH
T15762EA16A624997BCCDBD20DFA417F53D6F85573A2941E04AAFC8B0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6e8290f741292c052950daca4b1ba7159ff3f33b9a9b69ead22b35358b640d0d
MD5 60fc3fcf4e0f075908e92b884b71f67a
SHA1 8f965d33f355d67290919542014519505625569c
SHA512 658c5e31aa1d9f87cdda894e4ae67e966830817008a0305c5d813fef5e9b8f47a5bf811c76f0be4da3ead2d3eb37d2def16a9b55ee78323513d47f79b9adc1a6
SSDEEP 768:VJWhNWWgmcf458F1+UoAYDCx9Tuqh0VfUC9xbog/OV0iYCMro/e:VJWhNWWgmcf45u1jaxpCX/e
TLSH
T10AC2FC2F640CC77E4F844EADEC29AE966DD801CB57984D5447FA890C03C77EB521A4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 baf298532f381b6ee564b653c9884ed89f648c4146042938c3f1d5e1645c9088
MD5 23b525bea77f570b7a13c6e1f6b9cb7b
SHA1 16fa6f7896507d820b44b3a909658043979841ba
SHA512 6195e15fcf3b5e4ded09a929e32cf3586abb8cb14383cf62e680d0a9821a8f0831cfb53ca14db0c44d92fe8e66cb8b43ec23fe6447cea315027934bda57ea9c6
SSDEEP 96:KUswKJ2ayoAK9+bnwVRnlV5WhOUgZ5K4QgX5cfXWJVKHN6zn9Xr/z:KrjenwVRnlV0hOlZzQgXGfXWJVKHN6zh
TLSH
T15C919810B1FA2740387F745692A5991B8AC63053348AE47B7B7910AE1F26F428DFD6DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59ee8c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59ee8c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b10e9a57121cb3ffa23c32240f937b12c3a7aa3e18de1020166ad4d3b1715346
MD5 83e50a5ca9a46b080b2d9d398a9a7cd6
SHA1 b272090ba081cade80b9488d0e157a5a84f3290a
SHA512 387415efca763acdaa638d2dc30f4cd7f55393356297137dbe1f4fadd01325a547c443c43426e62d6fa779d35363af41648213f66591351b1de017f6588626c1
SSDEEP 768:vrv+4UNbdE3KkBiJ+v62lE8cPE8Ye3W6s70H9o8IUY:vbsb63lQEjctY+V99IUY
TLSH
T16903AE71985C88B38DF64689B606BA137FB4121786C50B84CCCD7E4E069B9DD671BC32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 410599af06aaec641099ae10ce6a726d2e9887a650e0d52540c1cf6ef7d4491d
MD5 376c73be119a43d4bc580ff0b5db2c4c
SHA1 ee5253f0425902bd51b96efad21d201348484457
SHA512 469f82bba32e3b1043290ea0c6898d10629d44862f001f3cafdfbccaf5cddb5bb695e864ffc11e463526f82e7a4c37332f6e326871b695d5af39508a58a70376
SSDEEP 768:zj+9m3mkXiJ+v62vE8cPE8Ye3W6s70H9o8b9M3D:W9m3xS4jctY+V99b+3D
TLSH
T1D7F2BF759C598DA38C9686C573067B16AFF0132786C81F4488DD7E0E069BAEC971BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 f561524aca05bfa95752f601e5404cd90418a309b63ef0236988ee35f41bb584
MD5 be3b8493351a799d978067229374f809
SHA1 ed6996e57f8465b3b2378183a0c37bc9019d5c7f
SHA512 cf8e42f1bbf00db4e58cb401066453e68fbc2b31e842b14cfdcb2b006b89f64b4a691063271afccdfa1d1f24b93cf00bcfd40f549ad0d084fc1c24e607098412
SSDEEP 768:BF1j+9/30wgPkXiJ+v62JE8cPE8Ye3W6s70H9o8b9M3D:A9/3LSajctY+V99b+3D
TLSH
T1B703AF769C48C9B78DE68BC9B70A3716EFF0022785C56A84D9CD7D0D06976EC930BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 24ad2e98be1b7ad04cc75431cddd71976227e1e845214e21c5e653f06946a8d8
MD5 95013d79a450fba305aed5471f3cef28
SHA1 d08f1cb9a1b4c6ea600edc45d3a4d42c94120a18
SHA512 3170a50778d62528c0769fd1c86039eea26fdecd1f0226d57e38a7c69b99f88fd6e6492e3939ab725e40ec211d3dde4ed534e288dc3df4a080e514192685545c
SSDEEP 768:5rv+4UNbdq31MJ+v6ME8cPE8Ye3W6s70H9Ij+8rWqW:5bsbo32WjctY+V9qDrWF
TLSH
T15903AE71986C89A38DE98A85B60B76177FF052634AC50784C8CD3E0D469BADD631BC73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9cb0818-ae5e-4ea7-b485-d0b1cf6bf444.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b9cb0818-ae5e-4ea7-b485-d0b1cf6bf444.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download