4aacfe9bdfb837af05aae672854920968ed7235ad312e71b1a147059b3b64516

Resubmissions

06/07/2026, 11:38

260706-nr4r4set314

09/06/2026, 18:40

260609-xbktqsgv5v4

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ad.html
Size 4.1MB
Sample260706-nr4r4set31
SHA256 4aacfe9bdfb837af05aae672854920968ed7235ad312e71b1a147059b3b64516
MD5 aa48f4016aeca8db6f4038211a326732
SHA1 a41cea0468e85fa0285225e3e39126764926843a
SHA512 71c7f5f5b1d4709f963d87700408c5954aa3bef3559c91bb05413f5891fb4cff6c334483599bae84f583ad6c1f742a8d99d8e6d1f9986559769c91bff2c2b6ba
SSDEEP 49152:IZQgEWFjTotnUzHODMhsHX3eK9JyGc9Ool3ycl+Sjhi4vibAtSYiCuYX:BI
TLSH
T1EB160284B261B4310A5365A4806F050FB33B79AD605980FCB65CD8E6AEFD48DA17FF78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4944	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278115785864305"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{1914C526-4883-4C49-BBC9-6375404AE349}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 2984	688	msedge.exe	88
PID 688 wrote to memory of 1092	688	msedge.exe	89
PID 688 wrote to memory of 4944	688	msedge.exe	90
PID 688 wrote to memory of 1092	688	msedge.exe	89
PID 688 wrote to memory of 1092	688	msedge.exe	89
PID 688 wrote to memory of 5792	688	msedge.exe	91
PID 688 wrote to memory of 5792	688	msedge.exe	91
PID 688 wrote to memory of 4436	688	msedge.exe	93
PID 688 wrote to memory of 4908	688	msedge.exe	94
PID 688 wrote to memory of 4436	688	msedge.exe	93
PID 688 wrote to memory of 4436	688	msedge.exe	93
PID 688 wrote to memory of 4908	688	msedge.exe	94
PID 688 wrote to memory of 4908	688	msedge.exe	94
PID 688 wrote to memory of 816	688	msedge.exe	95
PID 688 wrote to memory of 816	688	msedge.exe	95
PID 688 wrote to memory of 816	688	msedge.exe	95
PID 688 wrote to memory of 3640	688	msedge.exe	96
PID 688 wrote to memory of 3640	688	msedge.exe	96
PID 688 wrote to memory of 3640	688	msedge.exe	96
PID 688 wrote to memory of 252	688	msedge.exe	97
PID 688 wrote to memory of 248	688	msedge.exe	98
PID 688 wrote to memory of 252	688	msedge.exe	97
PID 688 wrote to memory of 248	688	msedge.exe	98
PID 688 wrote to memory of 2684	688	msedge.exe	101
PID 688 wrote to memory of 3556	688	msedge.exe	102
PID 688 wrote to memory of 2944	688	msedge.exe	103
PID 688 wrote to memory of 3480	688	msedge.exe	105
PID 688 wrote to memory of 1448	688	msedge.exe	108
PID 688 wrote to memory of 1448	688	msedge.exe	108
PID 688 wrote to memory of 3792	688	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ad.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x238,0x2ac,0x7ffd1323c188,0x7ffd1323c194,0x7ffd1323c1a0
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,14957983095758517578,14684385360403808240,262144 --field-trial-handle=1900,i,1576475914852778957,10741472982556734820,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,3529253946690926602,3479729999930527826,524288 --field-trial-handle=1900,i,1576475914852778957,10741472982556734820,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,13479733291145734235,18183594404152164769,524288 --field-trial-handle=1900,i,1576475914852778957,10741472982556734820,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:13
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,1208627343140966176,7607861046917300746,2097152 --field-trial-handle=1900,i,1576475914852778957,10741472982556734820,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,14646837655940821321,3053627993242740145,2097152 --field-trial-handle=1900,i,1576475914852778957,10741472982556734820,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,17954009396585445839,13061128485928413702,2097152 --field-trial-handle=1900,i,1576475914852778957,10741472982556734820,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,6376968149897707344,10271734317928886382,2097152 --field-trial-handle=1900,i,1576475914852778957,10741472982556734820,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:9
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2964,i,5527895398469715318,11479948768615664422,524288 --field-trial-handle=1900,i,1576475914852778957,10741472982556734820,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,8977895935030149851,10471690652179809130,524288 --field-trial-handle=1900,i,1576475914852778957,10741472982556734820,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,9554107278180907743,843944303124847730,524288 --field-trial-handle=1900,i,1576475914852778957,10741472982556734820,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,11082124276772695219,4129225929400550859,524288 --field-trial-handle=1900,i,1576475914852778957,10741472982556734820,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,12143637528793020728,9292290916435687827,524288 --field-trial-handle=1900,i,1576475914852778957,10741472982556734820,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,10881201801226506680,12935973025077066943,524288 --field-trial-handle=1900,i,1576475914852778957,10741472982556734820,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,9554107278180907743,843944303124847730,524288 --field-trial-handle=1900,i,1576475914852778957,10741472982556734820,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,11534366827786873437,9900842196456125485,524288 --field-trial-handle=1900,i,1576475914852778957,10741472982556734820,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4692,i,16082670369162535097,6536885672428988984,262144 --field-trial-handle=1900,i,1576475914852778957,10741472982556734820,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 74e8fce8412dc15530837b64a2bd137062b1563a8149d0e9ae726cfedbaed8df
MD5 7990a4c2b3b4e02c874ee258c9f3d31a
SHA1 5ff7a8748cbe7789f7bb5663aed3ceebf7b1ceea
SHA512 c94b3be21df1808699a6797bedaece44180a773d2f0fa269ba2a70acc59c5088b6ee320b79fcac23e72bf754ba03a13c33bfa9727e89297f731ad9e499b817ae
TLSH
T126717119D5220D1DFB2637F1A1FD94A877B8EBB6423F6D16806490B5AAF7F607842330
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591a25.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591a25.TMP
Size 3KB
SHA256 ccf765ed32ca904697cac3c46548a3b6a9b0ada2d5235a6301db02054a7bc8d3
MD5 d5e95f9fc39d549dab2e6859a2692f9b
SHA1 fb0d9f30878f3ab72d1576b0b7b203dd0fb6ec55
SHA512 65983ddfe4a3ac307a3dd124e60a779a953d985306728d008da6443badad915a4c0da1c276f9e08de86c36b4ee17d3e41b804cdb5093f9b3b9e2a56e731381ed
TLSH
T142717119D5120D0DFB2637F1A1FD94A877B4EBB2422F6D16806490B5AAF7F607841330
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9aebb20c-7b4a-43ff-9c1a-260dca240a96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9aebb20c-7b4a-43ff-9c1a-260dca240a96.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 30a4df3b202be6b26c18361e22f3da3d58173b918bb1e2d7b23524e8e09b2724
MD5 56d3378b618150bbbc48d77a99433302
SHA1 10a24d0f7bb6ee235a0fae3830d8da5d57b0f71d
SHA512 129269ed8adb80f54128c2ed91aaa585d8f53d40a18263bd7517be166dd00bd265ddf7f0dcc4063d1f3bdb4e43d8e698ba3b2fd6b92ee80321d6bbdbfd062e11
TLSH
T120419AF7C3E4856E890186F0FA186E2BCE2C0915832C7C5AC9E4AE1BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b21c34658c83669932fb139e98462c5845fbadcb4bbbb8bdc8821e796305a43a
MD5 6ff85db44089a495c50d8440a244dc1a
SHA1 33568a926707e3b3f16f0dd899a8eeb26c35963f
SHA512 2c29fef57e3a65d211ef4ba94a7400dcdfb25536a96dcb2304a5f386c533939ded4d356bcd26bdd3fc9bab89dca94424948498291f65dc8a1d03968a06f4d36c
SSDEEP 192:sxR1Ry7Fq/f4eO1sJkFJE1jItzoA8p4A/g6+WNIY+vuFkG1IgQJ:sxR1gq/f4eO1sJkfijxx/5IEF50
TLSH
T12432C916AA28993B8CCBD21DBB267F53D2F95033A1D41E48BAFC861C05E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 17cd7b8097957ce3c8e66a73d8c7d810b136a1182ffb135308d353af918b6472
MD5 cd0c7d054e9abe104ca7d059ecd43baa
SHA1 2aeec7b4fe51791c3b04cdf20cdb78b1fdaab5d8
SHA512 039a75cb111496e1478810e8c00f8d21c295a2ed221840996da85de3f1ec103446f1a2adac84d8f801202d88be5702e5ce35d84d9de7190bcc308cc838ac4c75
SSDEEP 192:sxRKRyPyM/jK1Ml8wFq/f4eO1sEkFJE1jItzoA8p4A/g6+WNIY+xuFkG1IgD5J:sxRKebq/f4eO1sEkfijxx/5I+F5f
TLSH
T19D62D805A638593BCCDBD20DBA557F53D2F91473E2901E44AAFC8A1C01E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6755cce606ce6c42e10a644d1934478285b389161d9b1725c6c6615bd8cc3e0d
MD5 8e1a792ce5e9f874a1b61a9fbe1ae0b8
SHA1 d16c3f91798c44a4e415a5abb1553a2f241cf8fc
SHA512 225c683dfe8af9555333cc991cdb577c9807c18176242d9432a4bbb9fd98883bea95a7962838eddc03883905703a376c5131e9b4031d466c2a957c8cbdcd5386
SSDEEP 192:sxRKRyPyM/jK1Ml8UQRFq/f4eO1sEkFkE1jItzoA8peA/g6+WNIY+uuFkG1IgDnJ:sxRKeqXq/f4eO1sEkmijxn/5IdF5l
TLSH
T11562D816A638593BCCDBD20DBA557F53D2F91473A2901E44AAFCCA1C01E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 2a4577fcb14cf4f5c0bb1a7bea724e5c7859a4788552dee91a26a25cef66fef6
MD5 a4bc046af5aaa238c3c866f561ef26b9
SHA1 d89d06603a048f9d09863574aa17c0695bb93fcf
SHA512 e7ec4f08f9a7c11d704eaa73031d766a32f060ba0d4f0a0dc3b75379ba7de0ef187c4e09fb229cda58610870dfcab564d1c99177b40fde0c8630b2a8a116e95b
SSDEEP 384:7rk6h56fCtgEOFf+wKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVMo90MRlproRTE:7A6h5gWgEyf+w8F1+UoAYDCx9Tuqh0VS
TLSH
T190B2E92F700CCB7F4F804A9DAC196F976DA902C796588D4447FE994C03C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 cbaf311753e4c80771f14873b43b279c042063fc7920d69a996d4b2dacfeed38
MD5 680fd996e7e9ea1810d071f2620551a6
SHA1 de411357cdf3579d4d5db34ff06ccd995be60445
SHA512 b6ec754407891a4996d8489b9df77643e182c2c673d49e152919335657c98623db4592e3a474c23ed9aecf8e02aca4ae0365ce285911f6ff3a5d381b38d4df3e
SSDEEP 768:7dUhjgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIe0Gprod45qg:7dUhjgWgEyf3wu1ja9RGCd4qg
TLSH
T166C20B3B640CC77F4F844A9DEC29AE976DD801CB9B588D5447FA890C03C77EB921A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b2eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b2eb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5ffdc9bdb35bca9e92cd4bde0785d6f39e94b3811b59b2086ef96190abd89b21
MD5 1362fbce077171bfe5c8575c4e684a79
SHA1 9c28f3c21d47ff11cdc444020a6cd0216294a0fe
SHA512 21902f61dec74e2122387e94c4de307757157751ab487b6fcd6493337ad9451fc91e6ef198e00ae0dd971a6e548240da0700df5a08a929ac1c3cd328fafff12d
SSDEEP 768:Orv+4UNbdg36tLWs5g+LMcvnWgWWR+2SrXH78tRMc2C:Obsbu36nJPWg1bSropH
TLSH
T12803BF32B8689DB39CF2D684B1067643BFB41183CACD4B94C8D95F4D429B8DD1B0BD6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 aa517d35e957456852ea12771f385c927ce8316c646dcad5079650ddf5fffb6b
MD5 086fec15c65be470684cb766b57e9637
SHA1 48a2ad08e0a4c3f33833e608898aaebdc0ba6f62
SHA512 a5456ee72b5f4ceab2f5caeb2ac5afaf21baf4ba8ec3fa172faa92e4877cb9765df5613630fd723a26ad2d59ea82848e642727c82fc780c214777dc0826e19d6
SSDEEP 768:Kj+9C3atlWs5g+ZMcvnWgWWR+2SrXH78tRMcb9MFI:p9C3abJPWg1bSropb+FI
TLSH
T159F2AE32A8658DB38CE2C685B2167743BFF05197C6C95F88C4D96F0D46CB9AC5707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0957da73ef5812e6f966cf2dce52868701edfa33b3a4b62627f3368e2782cd67
MD5 eaa094da857b08e038fc42d6fb421570
SHA1 eb3dea837e06523bb8a694076e9930f1165f63f4
SHA512 d2e9047f148afc3251016280675ec9d50678ca0b7c17cc9527aeff83418de467eb594cec92deadfd77bc37f116afea6f84a0f74899205af56cf4fb9fca92cd1c
SSDEEP 768:prv+4UNbdp3AtLWs5g+SMcvnWgWWR+2SrXH78tRMc2C:pbsb/3AWJPWg1bSropH
TLSH
T1A503BE32B8649DB39CF2D684B10676437FB41183C9CD4B98C8D95E4D429B8DD2B0BD6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cd257f516a8d8afb6d2b06f5f2b9508ff142c93a39011f3a189a4b8a04c48cff
MD5 c7c7a62b8305f5111f692835da086961
SHA1 f8d39bd43a3ba75ece090dde5e4eedc18b40c51a
SHA512 457555d5eb55b3322367011c9ff7e099181b3ad1a54d116831970845d0816c030848c3c7aa6a185a8a6674586b75020ce740609cdf19c7ad738dde0e78e73081
SSDEEP 768:drv+4UNbdg3AtLWs5g+LMcvnWgWWR+2SrXH78tRMc2C:dbsbu3AnJPWg1bSropH
TLSH
T11803BF32B8649DB39CF2D684B10676437FB41183C9CD4B94C8D95E4D439B4DD170BD6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b45c00cbfe37eb893b2891d9a5328fba8a6bb742d45f8981789f0f8fd149ca5f
MD5 d03b489a4699218567ee05e664214ed8
SHA1 c60431e4d58ddc2693ef1a7d2db382fddaf72fe6
SHA512 a4d752e9e0e53bc34ffa94f828a750ee447747df07fe5527266aaf1d3a5ce8db4c0c773a56c1a8c288dffb56d1b874ba447bef05948ed04b9cb78167fb844e65
SSDEEP 768:KFKj+9q36wgPtlAs5g+EMcvnWgWWR+2SrXH78tRMcb9MFI:i9q3wkJPWg1bSropb+FI
TLSH
T15B039E32AC54CEB39CE2CB85B61A3743EFF04197C589AE94D5C96E0D428B5DC170BC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9db016a315307b0fea7f47c1c9fbf5fe048a50d2553e0954cfc6b15089b4b14e
MD5 d3a9b8a4c5f3368755827e78509ec7c2
SHA1 0679c3550b3f34ddde25d9f4fc97375f1c5f94c2
SHA512 e0d8c3550a1d0aae2d633151e57702b2d1fb7212d73806e57c98d33dc728f71ac3a3452bb74d67fd7488cd7ee56e0e12b93e9ee3d9165d4d5f722c5882aaa7ba
SSDEEP 768:Orv+4UNbdp3905gdMcvnWgWWR+2SrXH78tRkA+8rr6F:Obsb/33JPWg1bSroRDr6
TLSH
T1C703BF32A8688D73DCE2D684720B76037FF44193D6C91B88C4D91B4D829B9DD270BD6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd48be08-5851-41ed-b816-6a36e2bcb2b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dd48be08-5851-41ed-b816-6a36e2bcb2b9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/3480-212-0x000001687A550000-0x000001687A586000-memory.dmp

Download