38f2783081fbcd701cf789e68c3ecf8bc9d778d2e1617802eb631f7e0196c0be

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
postdownload.html
Size 26KB
Sample260708-wt77baev2r
SHA256 38f2783081fbcd701cf789e68c3ecf8bc9d778d2e1617802eb631f7e0196c0be
MD5 66a5577e2aa20658b7da327074128d58
SHA1 6aa6231425a70e25ae22b3fcf79138291acfc487
SHA512 729ff069305debd784615483ada219600f41314d4c5c4064684e84ee722cc5c8f8f7780a13c1be660fb6d9f6b5bb473099392ad04a1c3b51d6e99e12eb44d61d
SSDEEP 768:pQLzPfV/CZFFJqaMzlClnMhOhooWdqwqUhlZW:4PfV/CZFFJsHW
TLSH
T1ABC2E80758B35811A327A0F477FEB21FB0B28D07AF17DA4532BC516A9FE9E54846334A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2732	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280080547800727"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2786392678-1011493168-3329660577-1000\{1F796BB9-1CC0-4F6C-88B6-F455AF4A49FB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 5256	1480	msedge.exe	88
PID 1480 wrote to memory of 2732	1480	msedge.exe	90
PID 1480 wrote to memory of 1476	1480	msedge.exe	91
PID 1480 wrote to memory of 996	1480	msedge.exe	92
PID 1480 wrote to memory of 1476	1480	msedge.exe	91
PID 1480 wrote to memory of 996	1480	msedge.exe	92
PID 1480 wrote to memory of 996	1480	msedge.exe	92
PID 1480 wrote to memory of 3020	1480	msedge.exe	93
PID 1480 wrote to memory of 3020	1480	msedge.exe	93
PID 1480 wrote to memory of 3020	1480	msedge.exe	93
PID 1480 wrote to memory of 716	1480	msedge.exe	94
PID 1480 wrote to memory of 716	1480	msedge.exe	94
PID 1480 wrote to memory of 716	1480	msedge.exe	94
PID 1480 wrote to memory of 3572	1480	msedge.exe	95
PID 1480 wrote to memory of 2400	1480	msedge.exe	96
PID 1480 wrote to memory of 3572	1480	msedge.exe	95
PID 1480 wrote to memory of 3572	1480	msedge.exe	95
PID 1480 wrote to memory of 2400	1480	msedge.exe	96
PID 1480 wrote to memory of 2400	1480	msedge.exe	96
PID 1480 wrote to memory of 1456	1480	msedge.exe	98
PID 1480 wrote to memory of 1992	1480	msedge.exe	99
PID 1480 wrote to memory of 1456	1480	msedge.exe	98
PID 1480 wrote to memory of 1992	1480	msedge.exe	99
PID 1480 wrote to memory of 5960	1480	msedge.exe	101
PID 1480 wrote to memory of 3040	1480	msedge.exe	105
PID 1480 wrote to memory of 1704	1480	msedge.exe	106
PID 1480 wrote to memory of 4972	1480	msedge.exe	107
PID 1480 wrote to memory of 4772	1480	msedge.exe	108
PID 1480 wrote to memory of 4772	1480	msedge.exe	108
PID 1480 wrote to memory of 2416	1480	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\postdownload.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x290,0x7ffc76f7c188,0x7ffc76f7c194,0x7ffc76f7c1a0
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,14340761300234889513,10062783312663856239,524288 --field-trial-handle=2736,i,9460939669599204808,38112893026090184,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,4234497364168668967,12576952799402858852,524288 --field-trial-handle=2736,i,9460939669599204808,38112893026090184,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:13
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,7348265071545971322,2380969581776017587,262144 --field-trial-handle=2736,i,9460939669599204808,38112893026090184,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:2
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,8002866078309156516,7065786814048168986,2097152 --field-trial-handle=2736,i,9460939669599204808,38112893026090184,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,3046809471477158562,9936595243732708726,2097152 --field-trial-handle=2736,i,9460939669599204808,38112893026090184,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,16732787151262667372,2514357382325371073,2097152 --field-trial-handle=2736,i,9460939669599204808,38112893026090184,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,16046750391024683521,8871722825902255360,2097152 --field-trial-handle=2736,i,9460939669599204808,38112893026090184,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,4793088043633872175,17866209303706426745,524288 --field-trial-handle=2736,i,9460939669599204808,38112893026090184,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,1694695033461398808,16409929579014674616,524288 --field-trial-handle=2736,i,9460939669599204808,38112893026090184,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,17182515055756632601,8519493061208382343,524288 --field-trial-handle=2736,i,9460939669599204808,38112893026090184,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,17182515055756632601,8519493061208382343,524288 --field-trial-handle=2736,i,9460939669599204808,38112893026090184,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,143264429503721018,17229959818303629727,524288 --field-trial-handle=2736,i,9460939669599204808,38112893026090184,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,2611523397263716764,18323916555585919215,524288 --field-trial-handle=2736,i,9460939669599204808,38112893026090184,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,1199022838343658216,7974206601013714365,524288 --field-trial-handle=2736,i,9460939669599204808,38112893026090184,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,8784946241282317554,2890684083870417028,524288 --field-trial-handle=2736,i,9460939669599204808,38112893026090184,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6224,i,3158245465098741582,9073830250154125864,262144 --field-trial-handle=2736,i,9460939669599204808,38112893026090184,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 99856548fba2b09b26625f38792bc79bdd7b32d45b519c4f695f0c02b1f9b790
MD5 56cad0e2a0b77dbb713fe58128bdd05f
SHA1 bbbc2d67892cc177ca9a4cdd80e59b98d7e85044
SHA512 45e78603d1d496442fe7415895fb68db4abe5c366b4cc78a7aacc8ee188c19be13c62ca471f444e7cf61081562ad79aca905719506e78854282bd937745810ad
TLSH
T17BD02BEA23444D88C0C031323971B348A1105E20124511DC140071388CE22C105030F9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9fe82d5f89c093b9e73bc61db1da47b34ed26b4bc4ce053a376d95b06e248beb
MD5 b67e56e2cf3581861507f308f128a4b2
SHA1 4790a7b2b125ba2d334c30cf03dafd3a44da2c15
SHA512 fd22534f43f03d6756f66d84b103b212adc924d91541c367fff64c4201692480d2f4a5275b267ad2fa32b4a23db117666ee6a633564a65ea97ba291b29aefec5
TLSH
T138D02BE623544C88C0C031323972B348A1005E20024511DC1500B1388CE22C105030E5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a914a73bd4251b42ea6044424ee0625ad6240a291316ea2bcb989c4d0bbf140a
MD5 a7b2b293914c64c0898ab75e8b0589e5
SHA1 5b1d753bf8a7f5e0ce758edd4cf7f8d1fbb2f2b7
SHA512 38fdd1959f6c3de787ec78a64a633ce8ff2da69e7ed0ea6c51f27a5e20f9e3e5851746c5bf722d1479a54f7ee951595af788f8a56a6903e9237c9444ff8767bc
TLSH
T10961C86C3B7D0FD1F7146E71D2D114B933B097D2864B6EA45284A170CFAAF246CD19E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598b10.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598b10.TMP
Size 3KB
SHA256 b0459711b4454b3378a3b3e340c6493b965693e79e4e95a000b2375be8302b15
MD5 604eacd1cebc3b1dd6058084b222a8df
SHA1 60fc6f84a7e83ba6e1127f641549e9196f6e7c78
SHA512 c0bd32f94dcca14207dc42e946f80a5fcace6ae5fa00b72699874c0ba8c74adbf994913a752a86e19796fe14fb597f59d12a4970f7561b7735313eb8c3686821
TLSH
T1B661C76C3B3D0FD1F7146E71D2D110B933B087D6854B6EA44284A170CFAAF246CD19E4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 28247817196ee49f2dbc7389aa3b94addae2e3319c97d1a63e328d5ce75c73ad
MD5 12369b4faefb8fccfb49a302c426775a
SHA1 3215a23dbb665d909c9e730f64a5817b289d034d
SHA512 dd89ae2b6b6b93db7b2e5fb5f21fde250dbe66aad0235a7b036c35284e279cf9ad70ed0114c935f49f659fdc4e852f2280de95b373264e3ca4704c276ae5a5ae
TLSH
T1AD41AAF3C3E4956E8A1146F0AA186E1BCE1D0A15432C3D6AC9E4AE1B93E24B5E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dbe95305287589e4a6c2de553cf376d7ddab52555af02205c728812fc8623bfb
MD5 a9e9f3f1b118ade6dd444b655496f554
SHA1 5aea818bf9922c6c4af1c8a74eca5a3578d6eed8
SHA512 0eeceb7e98620ab7d0b2363f80e018a49ad31f9a14487103d85c35ac669ccf233dc0853b2a089377273b07490dbdcd7a2a19540f01b628597662df93d8d97eb8
SSDEEP 192:sxRgRAyM/jK1Ml8wbO/fdsfUPP6jCR2jzoA8p4h/g6+WNIYn5EbMAG1IgIJ:sxRgilO/fdsc3GBSA/5IcFs
TLSH
T19C52D9165A28993BCCDBD209FA557F53D6F91533A2901E44AAFCDA0C00E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c5d9573b9793e7297ad497c64e7d6ece24a12962c69893e27699c4884ac0266a
MD5 c12f893fc66c3faa48156c22bed918b7
SHA1 dfc77598bf532ab21db82ea4ff3e98c994cd7a68
SHA512 67eeb31a577ffa80199f95d83c412283a2aaa363201a234641514f843b56128429de1081a4b3b5b0167ce18cf706fda1e7947bfa94d7955853e1c548175cee7f
SSDEEP 192:sxRrRAyM/jK1Ml8wbO/fds5UPP6jCR2jzoA8p4h/g6+WNIYn5EbMAG1IgD/J:sxRrilO/fdsO3GBSA/5IcFd
TLSH
T13052C9165A28993BCCDBD209FA557F53D6F91572A2501E44AAFCDB0C00E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ad50de5e88782706c3a957d28057004b254f2043712d92ef56a133c5dbb107d9
MD5 b7b31b8530d52862b23457a458cfb0e3
SHA1 cff34bd3a5dab94c82ce0700c6131e8db695e5ca
SHA512 421f612ab6baa1892a6e6b842fd5608a0db5cdf4d46ae9b122b18b4bbcd8478956c422e999be40bdd8d2a0fd3ecf7e8cb97edb665fcb99639f71067b751e1d54
SSDEEP 192:sxRrRAyM/jK1Ml8UQHbO/fds5UPV6jCR2MzoA8peh/g6+WNIYnBbMAG1IgDhJ:sxRrKq7O/fdsO9GB9a/5IdFn
TLSH
T18162D8165928993BDCDBD209FA51BF53D6F91573A2541E44AAFCCB0C00E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c9b1a5f99b2c5f1a9181ea94a7f6f9621c26017772b4369511c7534395716313
MD5 bdff1cec1498aacf9904df817055072d
SHA1 5e19e05bac6172f98cfb6930c8ccf92ef21ab6aa
SHA512 43de53dceefa3587437465107d163dde1ad213bc5a6364536e05d425b5bfbeaf7d1a77b84264e50d962daa5ee68e107222dcd876079686b8baafffde798093b0
SSDEEP 192:sxRrRAyM/jK1Ml8wbO/fds5UPV6jCR2MzoA8peh/g6+WNIYnBbMAG1IgDhJ:sxRrKlO/fdsO9GB9a/5IdFn
TLSH
T11162D8166928993BDCDBD209FA55BF53D6F91533A2541E44AAFCCB0C00E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e52044f7a6d79fbc550cfe5f034a270fb89d677034ed1deb924b37e8fcd1dc79
MD5 127e5be610d2d694d6ef43e5d160d0f2
SHA1 1036a5f5689f1df0fbacaf8213f01815a6231d91
SHA512 83192cbb420fc4fcc4f8753abfd397ea05916684135a10a1a3a9dd9a139fe52ea5054b5adb2898ca049beec14c45c6053af0eb1769db82aa67907f044558fb39
SSDEEP 768:BwSIyxWghdfAx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqQLw6ro0VsWg:BwSIyxWghdfAxu1ja3Ewx0+T
TLSH
T1DDC2FB2B640CC77E4F844A6CEC25AED76DD802CB97984D5447FA990C03CB7EB921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a255c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a255c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d5e4b4d2683fb49bd35a896b4629f180d251f94dcc301b04e905179796c9580f
MD5 a0d1a57c91a37d64fb5d6323a97e35d0
SHA1 ac916e0e811804afc7345cbd907f666fd5c913d5
SHA512 c33a93a10e722008bda6f48a6caca0763f813ec8ee3d3ce13abb80f1d9562da4b38ed0a5ec0553d483a8dc40a04744249ed0501405c7e7d250f842f9386a9932
SSDEEP 768:qrv+4UNbdu37/pLsWkYpjxLlVPgd5663kHuMjVP:qbsbQ3cm93Pf6UOuP
TLSH
T15F13CF33E46896B3ECE2D290B4072552BFB8519385C80B94D5EA6F4D45CB1EE631BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 2c5467888347ddd51d74c45571f72eff6656f331c771c11219c6fb1f52f9ae03
MD5 2560360d3067960281909fe909485cc8
SHA1 1baf2c33e66c74a3a7a3e3e72ce2a0bc1e51044d
SHA512 a5a7762bf1c43c97e48e30820e3593b225cc9902dd9a1b1b191f425d2e2cf18baf4a957b1aaef71c496ad481579aa90fb813b8ddecc4692e39622ae8ea672f26
SSDEEP 768:Mrv+4UNbdu3tk+pLsWrYpjxLlVPgd5663kHuUiixrQ:MbsbQ3Jm93Pf6UOUv2
TLSH
T1A713CF36D468AA73ECE2D190B00B2552BFF8515385C40B94D5EA6F4E4ACF1AE631BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 527e947726a43463b08b98a1c4a44a417ce37530b9fdaea9f5927d9431bbd390
MD5 51632165c4123e264d617eef2c9cf1d6
SHA1 3563ce6e5633ddab2d347116cb4ea66f6b5497ba
SHA512 64b1f645a09d1bdfd5b6b08d210af88aa666b7683209ac96ed6c4f1d34246432946226960f6be6eca6151f2bbed1ef3ac7e2b60177607dcb614430bc898c9cf7
SSDEEP 768:0F1j+9p30wgO/pLsW0YpjxLlVPgd5663kHuMjVJ:Z9p3um93Pf6UOuJ
TLSH
T14A03BF338894D67BFCE2C7D0FA0B2215EFF542A385846A94D6D96E0D01CB1ED531BC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 40509ad00278a8cb5c8dda0595c29ed98ac427ac40e54599726145fcfc29a203
MD5 492394094e03189d1f5b4170555dcff0
SHA1 fe6dbdb335874ed6b7fd8dd75c3bc995ca1a88c8
SHA512 d28041a309f46327e7f4c33f68ebccf77711a69166491650d2267e831399823f4a207344fd4fb6f5014b72de8e2f24d0a60dd08901fc53827d1f7ae2f6f88db5
SSDEEP 768:3j+9U3f/pLsWkYpjxLlVPgd5663kHuMjVJ:69U3gm93Pf6UOuJ
TLSH
T10AF2BF37D8649AB3ECD2C290B5072655EFF452A385C41E94C5ED6F0E05CB2EE931BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 66505829f9fa888fe6bc843161964562e399830ee386fef68569ebf172dc2f86
MD5 854c8165ab840177a89f7dde8bb29b10
SHA1 9a553c7e17d897cda82ccd464cb920275640c594
SHA512 6ada40111d910f8cbf457c9ef9b59a125b61aac1a70cb6e0a212d28591f3520818f3226edaaa2639fbab7cb7e034a856e077b88bdbdd1971e560120ffe3487d2
SSDEEP 768:lrv+4UNbdx36fHXLsdYpjxLlVPgd5663k/F5Uiixe/:lbsbT3CIm93Pf6UfUvI
TLSH
T13003D036D4A8D673DCE6D280B14B65177FF8219386840B94C5EE6F0E46CB19E630BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0a5df32-967f-49f1-b5c6-9393511875e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e0a5df32-967f-49f1-b5c6-9393511875e2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download