a955967e3bb939a71c092384a94e41105cc2cbabb50155aa3f1446e40c76d16d

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LogIn.html
Size 14KB
Sample260708-ws2cdaft5t
SHA256 a955967e3bb939a71c092384a94e41105cc2cbabb50155aa3f1446e40c76d16d
MD5 6ac400817c2cacdae4725129cc193909
SHA1 3138e19e6261c4cc924b0cfcc03ff78dff01a56b
SHA512 066b5bb2e754e66be138db51be02ce3c3ae3b674850559ff26a089338e74c42499c82761969acf10ec5d4f026773beff69f192d9a1d1cc3ddf5f36b44360168e
SSDEEP 384:J9iIuOtDCM4/Ioa41w/HCxknQM0EggmHy:J9HuOtDCM4goTxBgIy
TLSH
T1FA52D56625B704126357E5B43BEB870972348003A906CE797DBC5348CF8EF998AB739D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1364	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{1F2F8EDC-73FE-41EA-A612-B699EDE1AC2C}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{C81F15DD-1F71-4BDB-B389-E247899807D0}	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5496	explorer.exe
Token: SeCreatePagefilePrivilege	5496	explorer.exe
Token: SeShutdownPrivilege	5496	explorer.exe
Token: SeCreatePagefilePrivilege	5496	explorer.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
5316	sihost.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 808	2384	msedge.exe	88
PID 2384 wrote to memory of 2252	2384	msedge.exe	89
PID 2384 wrote to memory of 1364	2384	msedge.exe	91
PID 2384 wrote to memory of 2252	2384	msedge.exe	89
PID 2384 wrote to memory of 2252	2384	msedge.exe	89
PID 2384 wrote to memory of 3412	2384	msedge.exe	92
PID 2384 wrote to memory of 4460	2384	msedge.exe	93
PID 2384 wrote to memory of 8	2384	msedge.exe	94
PID 2384 wrote to memory of 3412	2384	msedge.exe	92
PID 2384 wrote to memory of 4460	2384	msedge.exe	93
PID 2384 wrote to memory of 4460	2384	msedge.exe	93
PID 2384 wrote to memory of 8	2384	msedge.exe	94
PID 2384 wrote to memory of 8	2384	msedge.exe	94
PID 2384 wrote to memory of 3172	2384	msedge.exe	95
PID 2384 wrote to memory of 3172	2384	msedge.exe	95
PID 2384 wrote to memory of 5108	2384	msedge.exe	96
PID 2384 wrote to memory of 3172	2384	msedge.exe	95
PID 2384 wrote to memory of 5108	2384	msedge.exe	96
PID 2384 wrote to memory of 5108	2384	msedge.exe	96
PID 2384 wrote to memory of 2564	2384	msedge.exe	98
PID 2384 wrote to memory of 2492	2384	msedge.exe	99
PID 2384 wrote to memory of 2564	2384	msedge.exe	98
PID 2384 wrote to memory of 2492	2384	msedge.exe	99
PID 2384 wrote to memory of 1920	2384	msedge.exe	102
PID 2384 wrote to memory of 5456	2384	msedge.exe	104
PID 2384 wrote to memory of 2828	2384	msedge.exe	105
PID 2384 wrote to memory of 2328	2384	msedge.exe	106
PID 5316 wrote to memory of 5496	5316	sihost.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LogIn.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x288,0x7fffdec4c188,0x7fffdec4c194,0x7fffdec4c1a0
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,11264706373570763223,10357136140367094697,262144 --field-trial-handle=2280,i,6684205596760029707,4406012845716220807,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,7902537732488451509,8891655046519791794,524288 --field-trial-handle=2280,i,6684205596760029707,4406012845716220807,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,15704552576096963189,15076754952602471055,524288 --field-trial-handle=2280,i,6684205596760029707,4406012845716220807,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:13
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3384,i,15490346725532020933,6091975106897817798,2097152 --field-trial-handle=2280,i,6684205596760029707,4406012845716220807,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,9244906500817848716,16143442661798926799,2097152 --field-trial-handle=2280,i,6684205596760029707,4406012845716220807,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,14599041162974245395,16679940037867202381,2097152 --field-trial-handle=2280,i,6684205596760029707,4406012845716220807,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,5385561197847559654,11132806867682853317,2097152 --field-trial-handle=2280,i,6684205596760029707,4406012845716220807,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,11685868976606398437,239897313540327887,524288 --field-trial-handle=2280,i,6684205596760029707,4406012845716220807,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,17121285076625408133,2419729421032455455,524288 --field-trial-handle=2280,i,6684205596760029707,4406012845716220807,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,2026896353876694439,10286629499952870058,524288 --field-trial-handle=2280,i,6684205596760029707,4406012845716220807,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,2026896353876694439,10286629499952870058,524288 --field-trial-handle=2280,i,6684205596760029707,4406012845716220807,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,13870019799648820838,4249329675877379789,524288 --field-trial-handle=2280,i,6684205596760029707,4406012845716220807,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,8329251327353096057,13311717866186246042,524288 --field-trial-handle=2280,i,6684205596760029707,4406012845716220807,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,11440322729131649790,13476847517578926238,524288 --field-trial-handle=2280,i,6684205596760029707,4406012845716220807,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,3695313873565280672,6356760723202058890,524288 --field-trial-handle=2280,i,6684205596760029707,4406012845716220807,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=804,i,1230935510758706776,3343079078982167382,262144 --field-trial-handle=2280,i,6684205596760029707,4406012845716220807,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:10
  2⤵
  PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3996

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:5496

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1340

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4acc3622a6662d636f64bc2a557e94202652dee3bee503a6adce01901d091232
MD5 4ef94c058e8005b55c21ae80b45ad202
SHA1 d23747cd4814ac3aaf4d6cef55d43441298583f5
SHA512 c3a7a45ba4ae0f5761dae7913dbda814da70ef27e9cd90d74889b092a8cb78629a962b0fa39f2742c7fc1122e5d5b1b47e76c6384307f49221416d70d2e7084d
TLSH
T1025150500FFA07C8CB191DFA61F66485B7F898EE420FAE033385913E0B09B04DD9283A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599958.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599958.TMP
Size 2KB
SHA256 16e05b684276b602cc992b5136eb76657d2db1dc16af232ecf7cc86538b83b16
MD5 78477d644af6b7a02fc68fa57af6d75d
SHA1 0dbabb8ead0bd730cdac6df5bff87a9dc9a6881d
SHA512 0393982c82c3f698bf8e82c788ac200a16091744cd861cc3b892ebd74ec378282983194fb8c8cf45fa79685e1cd401f9200f27d90f0e335586e68931e07df970
TLSH
T1815140500FFA07D8DB595DFA61F66485B7F898EE420FAE037385913E0B09704DD9283A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 36cbf7495eeb40b3f12fedcfedd0a828b65d9b72bc28090d16435050ad3c7ca8
MD5 5dbf5d2825b649a3a508a29ba8236ef6
SHA1 9d9f0bb636db7e1dc554c23a31bde22b4ab51a5b
SHA512 da4f40dab1e888575d21a45c355fee3565369c1d21c3309713920a85f755cec40c5d92ea718c621228eeb4133cb6c2f7201e0fad8ece45c217f2de6408d35216
TLSH
T16451AFF7C3E4867E891195F4AB147E2BCE1D0515432C3C5A8AE4EF1BA3E24B1E101A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 19893ae1227cf48023190e17efe17714aef274ee326b0eb18bd39abb76b79d8f
MD5 c27a3a277ffe54da111bf4f19213715a
SHA1 0a09b5e2906aba48070201232053421df9627717
SHA512 8dcea49edd87bbc12424e2d6c56bd824c917d538153c9cecbd8141286192e15912b240b163fb5769778306ea8eb43049e36cb41e86cc6503b9134ad6e8721a2e
SSDEEP 192:sxR+R/yM/jK1Ml8wbc/f5sKo8K3rgdYzoA8p4C/g6+WNIYndtTGFIgD5J:sxR+Dlc/f5sKgkDD/5Icsf
TLSH
T1C552DA15AA345937CCDBD20DFA517F53D6F81463A2941E44AAFC8A0C01E76ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 669b3c7c8146c8e3d3aaaa309164b7f7aefb41aeee05ec469bf0dab3af3aad07
MD5 97b3b88612b3cdf8d34686ce8ca74308
SHA1 554b8e2af4009e780e098e24d262693a84ad7076
SHA512 5a58f344104be35cf9fff6bdcddddf2cf7a35a60351f5da8a2361cd4010b37efd93d656ecfbe1b3383aa0a16160ba76132487bf4263092a2f3b6a5c149b647bb
SSDEEP 192:sxRRRrbc/f5sIo8K3rgdYzoA8p4C/g6+WNIYnotTGFIgQJ:sxRRJc/f5sIgkDD/5ITs0
TLSH
T14032B7166A38A93B8CC7E25DFB657F53D6F9103261D52E48B6FC860C05EB6DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 e93e8e5465683dcb46771e2488774cc92662c3882b280a44348d5105da3151b6
MD5 88ded9fc7b1e1aaa28f2d61f8b17a9af
SHA1 0aa0e2b292e1d711be1d3a9c61117489159b0f33
SHA512 364e6055f1b1a2639aa015afea4433f7566f197b70b5ad11bf3e7d706714fd9249fa7589acd712542eb963d3da5ee6b036f9240f24f16890f7c405ccb91a455e
SSDEEP 384:J1WYh3kfCtgqUFfiwKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVdJ9gMRRVroGlm:JoYh32Wgqcfiw8F1+UoAYDCx9Tuqh0Vf
TLSH
T16AB2C92B704CC77E4FC14AADAC196F9B6D9802C797588D4047FE994C02CB7EA921A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3bccf3edbee86b09b445949c7a349689024da7146aff3cb5f58894e6261e6d9b
MD5 203c4fd96b85df8bf589d16763f2099c
SHA1 aac931e1adfc100aed89dc97b791db05abd59e30
SHA512 a8c14fef9d704faf91dec2522407353a174f1f39f3349922b007322f983c884480ef25c84895079c6accbf8171b7d57cc1c023d4ce8c0f7b6ffb99cc99f94e6a
SSDEEP 768:Jl6h92WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxXguVroMgGB+Y:Jl6h92WgqcfHwu1ja4QuuMgm
TLSH
T12CC20C2B640CC77E4F844EACEC296E966DD801CB97988D5447FA894C03CB7EB521A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 78307be5319523aec09c8d0663fe7d164719453a0dbc03f18c2ed2778f6cee6f
MD5 eb69e8770ee8b5703d6fd8a243125fcc
SHA1 4b8738253b80fdbf67b90b5590df5626d0a36bc1
SHA512 096f85242d20b15b1e4e504b2e3de002467e0b3aecdc33082ee1f4afba25800a8a93874db5445a916b3d5c4d7bb98698e305923f7df1ec60ba2d3d1a4848e8f3
TLSH
T14B31C110383E06C12CFD6959D0568496B6D271AA721C663F7BBB01D60B6FE41BEFC4CA
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 118ee1040fe94dd600a4f43f0abd659bafd0a5fe674bd60d37509ce49f582bc1
MD5 6079877f5d42fafdafa6289f9dde691f
SHA1 93bd9e3d1bc67b856e8547de6ceaed7e334d4d4e
SHA512 2528656b9ab1b602953c63e872dac73eff32c947407aa4ad5122bafc5a345513845d16616c1bbd0bde14b8cc17ebc992265a099cdc8e9043e1d074ff1e892e6d
TLSH
T19E51B010383E06C12CFD655990568496B6D271EA721CA63F7BBA01E60F6FE41BEFC4C9
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3653.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3653.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d7f582fbe8eed7dedf41bf1337976b941bdfb5f86a8f32a877fd21c84f25e091
MD5 33c403c73231f84b2a3892c57cf30214
SHA1 0602ae5c2625d21d6f4b136e04cdfdbebae00452
SHA512 6cf8de6a95405fe127448bdfa4d641960f0193800af5b02c85e05bf29f78c95b395e06ec88e4432db9548dd5850d07e4fb0c2936fae09d12976da788410c46c3
SSDEEP 768:5rv+4UNbda3ZOITYreNSLfnfHf7X7DGFzoqPcNMCNFOcynT:5bsb436pfnfHf73WkqPak7T
TLSH
T12B03AEB5ACA459374DF3C2C9B71B3607BFB0121346C81B5499ED6B0E429F6ED130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 93dd70215497a0a634f4be69a02e504cbe3ede2eb00c5c47bb38b0110d11c887
MD5 63b6c7d59b2369ad07726ef616ff0b7e
SHA1 5429fcac097e4ee8c73c21f29e1b50f6d0cc9cd2
SHA512 2823050824e6c6f233e78afe83b9b13f134479099b1ea826d72ed492906e7a908fcb7eb7ffc8f9ce08089974cba2d8e18f4525c750d272fd231c301ee0db8e3f
SSDEEP 768:0rv+4UNbdz3yOITYreNSLfnfHfpX7DGFzoqPcNMCNFOcynT:0bsb53hpfnfHfp3WkqPak7T
TLSH
T1ED03AEB1ACA459374DF3C2C9B71B3607BFB0121346C81B5499ED6B0E469F6EE130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 53bdcabfb75f260ff732d14ef8e153b6269f252ca4817ab1e481d35bae709181
MD5 08b1e6a0383eb2257db6df9436b8dde1
SHA1 a8483757d18f21a47095723436470edc05581c50
SHA512 c345cb034077cda1c96bc70a46af88d50e3ccb72603e45fa4429f9ff3f7c9a57dc65bfa7a7dc095a7dca8b6c0414064a227108f6d94a2f29938712902ef458b5
SSDEEP 768:+FKj+9n3zwgGOJTYreNSLfnfHfiX7DGFzoqPcNMCNFOMj6:G9n3gpfnfHfi3WkqPakV
TLSH
T16003AFB69C90893B5DA6C7C9F71A3716DFF0026385846A54DADD6E0E42DB2FC030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 28d066c84b22c1ec07d95c5a7d6957a5aaaab9fe4a4ec22e2d390e39a105b59e
MD5 61b70f34bedc025677b31a87f7fc534b
SHA1 f63e547bea83219bdf95f9a0b6f9b808306ed804
SHA512 9aae8c925dd18d0412dccc83fee8bf03ff2a5116c77930dc7d0d0bd8e4a52f4236bf247892cc9813955710b96b344f10b313927f4f6e855edb7e2509d2239d70
SSDEEP 768:0rv+4UNbdz3yOJTYreNSLfnfHfUX7DGFzoqPcNMCNFOcynT:0bsb53apfnfHfU3WkqPak7T
TLSH
T11003AEB1ACA459374DF3C2C9B71B3607BFB0121346C81B5499ED6B0E469F6EE130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 aa2c046b9029744fe4fb2d8ac836203f7b94295386b438b9ee3fefa0987e726a
MD5 43af94fa9c4dc1da53803dc81f79b730
SHA1 6eb140ce3aebdacc95eb42a01e2bfbacc42c50f3
SHA512 e08f7edd1052713beb0f8cc284f2841e8ff2169d1141dfe5ae61173add69afc8aec09321d79c62c400283097dec100f4e447774e8eddd12284728e2e87aa8b73
SSDEEP 768:+FKj+9t3zwg2OJTYreNSLfnfHfcX7DGFzoqPcNMCNFOMj6:G9t3MpfnfHfc3WkqPakV
TLSH
T12D03AFB69C90893B5DA6C7C9FB1A3616DFF0026385C46A54DADD6E0E42DB2FC030BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d5d38e6ead2581d2d3d10167d660de2d9c64cf929e0d70c6900172386f35c74f
MD5 949c293899f87095a92435c2b1f3e5fb
SHA1 454bff42ce728c647b3f6c66080a011d1a0a7173
SHA512 b1b2ae8e6859753bbca6fa3200dbfdb509d0a3d6cea3f4897637c47523f8531e570c5293a02bff456a60005c72611d3330977e66965af5f7bef950a3f387e4e8
SSDEEP 768:8rv+4UNbdz3ZOITYreNSLfnfHfpX7DGFzoqPcNMCNFOcynT:8bsb536pfnfHfp3WkqPak7T
TLSH
T10603BFB5ACA459374DF3C2C9B71B3607BFB0121346C81B5499ED6B0E429F6EE130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 65990749626b0e3d852287427629baadeb89b110f1d86808ffd0d87406cbb585
MD5 8ee22abfb229653cb221351147fa474c
SHA1 4585f16ff92917aeda3f3cbdb30ffe659a1e909b
SHA512 d3056af704b4d7b315d4f73e6bedaa5fe470d591bbda6677046933bed2a9db5f198b3e5813c756e9980a8a00d19e8e3d4be043a4f10efada98e2228cbfceddef
SSDEEP 768:Vrv+4UNbda3HHYreNSLfnfOX7DGFzoqPcNMCNZNeVH1SkM:Vbsb43YpfnfO3WkqPa7EH1Y
TLSH
T1B603BEB6ACA485374CE3C6C5B75A3607BFF4015746840B94D8EE2F0E879F5AD130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc70e745-3db7-4cbb-9fcc-c92ba215ed7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fc70e745-3db7-4cbb-9fcc-c92ba215ed7f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download