f17376b0b7ade8c24d17405d6c2d2a8ed5d8aacf1ca16efff18e96bd2fbe0220

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ftx/error.html
Size 1KB
Sample260707-pfk2ashv7x
SHA256 f17376b0b7ade8c24d17405d6c2d2a8ed5d8aacf1ca16efff18e96bd2fbe0220
MD5 ee48901d9c8fd41b99ca875d7c6b0df9
SHA1 c2b548bba5e2a9215b80375f019bebbc02953220
SHA512 e3bdd12d8924ba9d11cb7d36ab4fc1aa0710fc992e2024f46be2cf9a47fb631af22cf766d43b729600e8b0d29e82ac0764c8b020c0a0af435c8e541000d217c5
TLSH
T1F531B19B56E310027923A0A41FB667412B80C027C24FCEA93E9CB348CF955D6ECD378C
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2672	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1581435544-3586420778-2104125077-1000\{DFC7F86B-DAB2-4DD2-A2C1-0E5CE2A16EA2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2392	1556	msedge.exe	88
PID 1556 wrote to memory of 2672	1556	msedge.exe	90
PID 1556 wrote to memory of 704	1556	msedge.exe	92
PID 1556 wrote to memory of 704	1556	msedge.exe	92
PID 1556 wrote to memory of 3016	1556	msedge.exe	91
PID 1556 wrote to memory of 3016	1556	msedge.exe	91
PID 1556 wrote to memory of 3016	1556	msedge.exe	91
PID 1556 wrote to memory of 5296	1556	msedge.exe	93
PID 1556 wrote to memory of 5296	1556	msedge.exe	93
PID 1556 wrote to memory of 2424	1556	msedge.exe	94
PID 1556 wrote to memory of 5296	1556	msedge.exe	93
PID 1556 wrote to memory of 2424	1556	msedge.exe	94
PID 1556 wrote to memory of 2424	1556	msedge.exe	94
PID 1556 wrote to memory of 2664	1556	msedge.exe	95
PID 1556 wrote to memory of 2108	1556	msedge.exe	96
PID 1556 wrote to memory of 2664	1556	msedge.exe	95
PID 1556 wrote to memory of 2664	1556	msedge.exe	95
PID 1556 wrote to memory of 2108	1556	msedge.exe	96
PID 1556 wrote to memory of 2108	1556	msedge.exe	96
PID 1556 wrote to memory of 788	1556	msedge.exe	99
PID 1556 wrote to memory of 2220	1556	msedge.exe	98
PID 1556 wrote to memory of 788	1556	msedge.exe	99
PID 1556 wrote to memory of 2220	1556	msedge.exe	98
PID 1556 wrote to memory of 1120	1556	msedge.exe	101
PID 1556 wrote to memory of 2948	1556	msedge.exe	105
PID 1556 wrote to memory of 2724	1556	msedge.exe	106
PID 1556 wrote to memory of 1712	1556	msedge.exe	107
PID 1556 wrote to memory of 4356	1556	msedge.exe	108
PID 1556 wrote to memory of 4356	1556	msedge.exe	108
PID 1556 wrote to memory of 1872	1556	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ftx\error.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffecaf3c188,0x7ffecaf3c194,0x7ffecaf3c1a0
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,9423010116289334423,15592066687503713311,524288 --field-trial-handle=2576,i,8023894836819573770,16400913810324088299,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,13636461338577133092,1829833780378225185,262144 --field-trial-handle=2576,i,8023894836819573770,16400913810324088299,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:2
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,3245706718928409145,17014535616854546210,524288 --field-trial-handle=2576,i,8023894836819573770,16400913810324088299,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:13
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3332,i,17162454189086637801,17208147058801140476,2097152 --field-trial-handle=2576,i,8023894836819573770,16400913810324088299,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,4300069170353910254,16528967543316464179,2097152 --field-trial-handle=2576,i,8023894836819573770,16400913810324088299,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,14628215743154647314,12101674066024208620,2097152 --field-trial-handle=2576,i,8023894836819573770,16400913810324088299,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:9
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,16818913549537062431,6675361237471629874,2097152 --field-trial-handle=2576,i,8023894836819573770,16400913810324088299,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,583536419997326472,6263846377684757229,524288 --field-trial-handle=2576,i,8023894836819573770,16400913810324088299,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,2488868901959831990,6419816475008667938,524288 --field-trial-handle=2576,i,8023894836819573770,16400913810324088299,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,18430141397885000029,13561505296271231515,524288 --field-trial-handle=2576,i,8023894836819573770,16400913810324088299,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,18430141397885000029,13561505296271231515,524288 --field-trial-handle=2576,i,8023894836819573770,16400913810324088299,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,12838348370357465735,15157356874490584573,524288 --field-trial-handle=2576,i,8023894836819573770,16400913810324088299,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,4962898817401803874,1519347331724488593,524288 --field-trial-handle=2576,i,8023894836819573770,16400913810324088299,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,15542163851447373622,6980911942530018600,524288 --field-trial-handle=2576,i,8023894836819573770,16400913810324088299,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,7975125851541403737,2318820486781084277,524288 --field-trial-handle=2576,i,8023894836819573770,16400913810324088299,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3756,i,8638483960295725669,12259432612442038563,262144 --field-trial-handle=2576,i,8023894836819573770,16400913810324088299,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27950d40a9551c84ad47cd8133b3dc2562d0cbfb9e6e2862e52b6ffc59465636
MD5 3cdef261498cc0a89a5099917822c668
SHA1 8386a4997ce2ae9e730585e5e657293325681cc6
SHA512 3a8de603951463432923081d35c238e0d798a1d4f2e6ccf76499aa997c2e7f6498ecd60523b96ebdec43384983d689dd047458813137f74e88aba315a69353a7
TLSH
T1F4D02B5932002D44C483383732502221E3209432082401084051B17C4C5C546066F4EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c6cefa1e36fc8c458c1103dc425dc7d4774e2a109aed9ce8254e2f005fb9cc99
MD5 ce6d65fb8c0c0020b2525439c0b95194
SHA1 a2e2e5c2fbd1d6df05e8e5aedb7fb4f66906627d
SHA512 5b2ae476b36e7a5d7be156e29405a78d59922fd34a87bb430ddc143f501f55bfeb3b0c1103f165ecc20fb18970c574188e4b078cfc4406a77b6c5f6c8c03c9ae
TLSH
T11AD02B5532102C44C483383B32512221E3109432042401084051F17C4C5C546066F4DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 583d373bc38f3b6036fe5c83046f0b8c8241a00fd0210c82ea6ab3760fb75ad3
MD5 14f14c4db46fac38a19448962873a573
SHA1 f7c8513052a1dea73cccb0bf43f19bec966cced8
SHA512 01e0e2ab1cfc13a201493f04cd6ae89ce01d173adad5d9ae296bf33f101ae2ace8708376a412ca002837e2416e73377942bee785ef2c576c2e855483d5cd4369
TLSH
T1A251A2210B3ECAD2C35046B122E3FDADB338C8D60ECB6FF81A6350700836B493042A28
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1e091f6bacf0df045090d287cac754d0834844ad5a384b63fe9263afdef1f0d3
MD5 9bdfc6f642781f903d00c11a6ee79320
SHA1 73a321bacbbed2860084c66aff81f2666f470021
SHA512 012e2e03be1695a35bada54f304b74bc2e715315d51ed6709a9133aede9142ed2e5fd772655f25832c26651993fc3ec46ffc9fac02cba355127415315923f7bc
TLSH
T122419DF7C3E4866EC91196F4AA187E1FCE1D0A15832C3C5A89E4EF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9685efd4ce364e2dd91ae4acd0e91b6735d6d259bc3094a066018357e1b16e4d
MD5 5af4ae740e4f5b3ecc17b18ca4358017
SHA1 e0dc9fa56594695859bb471ca125013accc0f826
SHA512 6219a8b190e18a1883a20db1b9df3d88ca9142c5563777c18a30a0f67a19b7c2d38218c02c20ede2f3098d799e596e10d0e421bb8b4e76a2a834bccfc5c4d11e
SSDEEP 192:sxRnRzyM/jK1Ml8wbM/fbsJ87wathzoA8p4x/g6+WNIYkKJH7++GBnIgIJ:sxRnTlM/fbsJkqY/5IwH7+Hns
TLSH
T1F452D91666289977CCDBD20DFA517F53D6F81573A2501E44AAFCCA0C05EBAED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a4df33f6c566e9ea80bf27701dc39746bdd136fff0f17c6e76ea346e0703bb53
MD5 9c2416d8d2465273ea8965a289819e95
SHA1 ded75478c87cf39a681804161b2ad66c2404accc
SHA512 653a01d6616b1c2f4b16d21048275c75fb53859ce976719b75db9d8a532824eb4aae3b3dad3caabcbf0ebb45ec46f24d93dd265921cc7b6dd7f9323f94f2feda
SSDEEP 192:sxRwRzyM/jK1Ml8wbM/fbsH87wathzoA8p4x/g6+WNIYkKJH7++GBnIgDwJ:sxRwTlM/fbsHkqY/5IwH7+Hng
TLSH
T1A252D916A6249977CCDBD20DFA517F53D6F81573A2501E44AAFCCA0C05EB6ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ccc0b2eec8bb2fb93b0f9fa09ab39f687add6549765ef5a7b0f9b7199acc04fb
MD5 17d9367aaacad7f588da8b5bae99e98e
SHA1 9ce643f08b8e53297df5c5c218c02bbce38379fc
SHA512 734e48f86a693928669bc0f72a473bce4055c5198714d8d74c74254c6f646078f623a87eb0573ad49162f890279436f110ac8e81b2aab3df67f925f592fa22b0
SSDEEP 192:sxRwRzyM/jK1Ml8UQUbM/fbsH87wathzoA8pex/g6+WNIYk0JH7++GBnIgDwJ:sxRwTqSM/fbsHkqe/5ImH7+Hng
TLSH
T16162C816A6289977CCDBD20DFA517F53D6F81573A2541E04AAFCCA0C05EB6ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b3124db5689c0ec4d40824ba26073d463078ac49605801582ac92aae831d825a
MD5 80cd0091e6d6864bfee7bb4b5fddf261
SHA1 c5ef5db275bdea08892bed54a2600ee798e3ea39
SHA512 d9d727b438bb505dda0358bb6e01080232d5700ffa7e1d22c63c9e65d8b98962abec0dac7d84fef15e504320eb62d6ca8e17a9866bb0888aea7e830ec45007c4
SSDEEP 768:ZUwiMHWgRhf2r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxnxe3rols+Mr:ZUwiMHWgRhf2ru1jaoxekbMr
TLSH
T1E8C2FB2B640CCB7E4F844A9CEC29AED76DD801CB97984D5447FA894C03CB7EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4c2b020b927c1e85b6e66e46d80bee94fe610d7f5adef75e611cb51f780b5e92
MD5 3cdee59d28010345bf17e2cd6bdf5b4c
SHA1 e775f0b3216cc384dc7f43e1aa9d2cb4827e3fe8
SHA512 a2db0174feeb16a0117d86220cbb47cb84297173f923518946b5b5154692e2ec9ed6d6c994705650ef5c7a60ff9c001243548a4ec88cbd758995c5f67ca546f4
SSDEEP 96:KR9KD3tHbPWDYGg/PK4eghPcF9wTrEHuDSOowg2Ww19gO2K4TgM2cmut8ustY82w:C9KD3tHbuDY3/1eghEF9wTrEHuDSOowt
TLSH
T1FD918605B1774690383E259C82A598A696C270A53119E53B7FF815F31F27E03DEFE8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59eaf3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59eaf3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8b3a2053c70a18833a058d1cc3f9d617b8da01c2681af7a4c822bfb736e5ba5d
MD5 2614ed3c91635b379c5abb7a8792e97d
SHA1 d60326bd8d6631a2420c7a5e83a436637a98fbb9
SHA512 c81ee6c650b51254c9b05446b64e8969983fe65f268b2dcea52b84b521464c3e24f01ebc8961b9673e1e747e3272cf2808ffc570fde39e58a45653281ec54eed
SSDEEP 768:sj+923I1OkImuN3bR6/IpR5myymCbavb9MP:r923QIpGhlAb+P
TLSH
T1BBF2CF31AC554EB39DE29389B2073956EEF09277D5C82EC4A9EDAF0D02D76DD0343816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3b5ba348ee8d59de6a87943ac62913badcb3eb329c58c67185918754d697a0ea
MD5 294855ba8304b5e44a76d3e2f15e1de9
SHA1 3a682d0a8d6a38754feede7a48380b8d237f49c7
SHA512 b5cf011b2e0be901c1e886e77352ee9a2e23e05ebccdd7f9d4426d6f790e70759bc165a0159cbc6a1bd5080e112cceab84747e63c3c02d3721a09a25a0c9be2b
SSDEEP 768:Yj+923XiOkImuN3bR6/IpR5myymCbavb9MP:H9236IpGhlAb+P
TLSH
T1CBF2CF31AC554EB39DE29389B2073956EEF092B795C82EC4A9ECAF0D02976DD0343816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 3196ad3b564f5d8c80dadf48a145d5a8cebaa3de567d960e6399288a62f6549d
MD5 b76a5d89703c8e4ed179b1c06ceeb418
SHA1 d241532f9c8d4ffe4695014647ff851ac314fda4
SHA512 98b95e382f6fde8ac7aad335300c55a6890d4e1aa816840b8a9b81af3e6d59addefde82d1536b8d9ba5e2ca308ea0b78fbf29dc9935719d015cce1b988b85588
SSDEEP 768:OF1j+923mwg8iOkImuN3oR6/IpR5myymCbavb9MP:r923dIpGhlAb+P
TLSH
T11F03BF329C458EB7ADE29B89B6073556EEF192B7C4D42AC4A6DC9F0D02976DC0343C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 36060037b6ff0f39ec85c11901839adf1d1b1c2c491d44077065be82238bcdb3
MD5 ed6b122214befd14bb83e4253107d575
SHA1 72abce1a0c5ceebda690e16c44a7050892c9191a
SHA512 49c397aa2045cfd6145cda10163faf35674cb3fd0e97b757f7aa470a75a22943c3f4786a7d6968b47cbf20ed466b5d1c7865c189723a8e7ad23d880d265af375
SSDEEP 768:Srv+4UNbdL3Vf0kImuNDR6/IpR5myymCbebUiBf8j:SbsbZ3RIpGhloUL
TLSH
T1DD03D032AC588AB3DDF2E285B1477953BEB4617399C50BC098ED2B0D429B5CE1307DA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download