c631bdb2ce41fba482f12ebdbfd6394fd23012b166f9222c80db30032010d0ae

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
softwaredownload_v2.html
Size 1KB
Sample260716-w3geysbs8n
SHA256 c631bdb2ce41fba482f12ebdbfd6394fd23012b166f9222c80db30032010d0ae
MD5 4ac646ff926683339f032caed01438be
SHA1 e2848da55a9ebc96f7b84131761565a41a939cda
SHA512 ca2b16af3a25cda15cf54225b0449bad538a7164fd7da0e96bffa4f03f7a20cdc48662a9082018a782030b3c069f2ec6021be551de2a81d0c34f1e8fe9bb8bd9
TLSH
T19D318B93ED09C88A2D11D8CCE077E31ED187A52BD9BCC4D4EADC85BC02567FA0F06886
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3304	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287000131754197"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{216B0BEF-F158-4191-8EDA-90A17FB7CB64}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 3528	4312	msedge.exe	88
PID 4312 wrote to memory of 3304	4312	msedge.exe	89
PID 4312 wrote to memory of 2132	4312	msedge.exe	91
PID 4312 wrote to memory of 2132	4312	msedge.exe	91
PID 4312 wrote to memory of 4948	4312	msedge.exe	90
PID 4312 wrote to memory of 4948	4312	msedge.exe	90
PID 4312 wrote to memory of 4948	4312	msedge.exe	90
PID 4312 wrote to memory of 4804	4312	msedge.exe	93
PID 4312 wrote to memory of 4804	4312	msedge.exe	93
PID 4312 wrote to memory of 4804	4312	msedge.exe	93
PID 4312 wrote to memory of 1992	4312	msedge.exe	94
PID 4312 wrote to memory of 1992	4312	msedge.exe	94
PID 4312 wrote to memory of 1992	4312	msedge.exe	94
PID 4312 wrote to memory of 3096	4312	msedge.exe	95
PID 4312 wrote to memory of 3096	4312	msedge.exe	95
PID 4312 wrote to memory of 3096	4312	msedge.exe	95
PID 4312 wrote to memory of 3844	4312	msedge.exe	96
PID 4312 wrote to memory of 3844	4312	msedge.exe	96
PID 4312 wrote to memory of 3844	4312	msedge.exe	96
PID 4312 wrote to memory of 3784	4312	msedge.exe	99
PID 4312 wrote to memory of 4000	4312	msedge.exe	98
PID 4312 wrote to memory of 3784	4312	msedge.exe	99
PID 4312 wrote to memory of 4000	4312	msedge.exe	98
PID 4312 wrote to memory of 1752	4312	msedge.exe	101
PID 4312 wrote to memory of 4772	4312	msedge.exe	105
PID 4312 wrote to memory of 1764	4312	msedge.exe	106
PID 4312 wrote to memory of 4456	4312	msedge.exe	107
PID 4312 wrote to memory of 5980	4312	msedge.exe	108
PID 4312 wrote to memory of 5980	4312	msedge.exe	108
PID 4312 wrote to memory of 1556	4312	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\softwaredownload_v2.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffb7404c188,0x7ffb7404c194,0x7ffb7404c1a0
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,12230028395043734186,7824732292283111877,524288 --field-trial-handle=2216,i,3517219951773447282,17671870484171533850,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,2225774279209087976,15386722820684430806,262144 --field-trial-handle=2216,i,3517219951773447282,17671870484171533850,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,14388330244339894719,8334254095798790084,524288 --field-trial-handle=2216,i,3517219951773447282,17671870484171533850,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:13
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,10492935421600753458,10075519244573979538,2097152 --field-trial-handle=2216,i,3517219951773447282,17671870484171533850,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,1793540280961007020,8876014280375902469,2097152 --field-trial-handle=2216,i,3517219951773447282,17671870484171533850,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,13783629154438386525,3944378558350699896,2097152 --field-trial-handle=2216,i,3517219951773447282,17671870484171533850,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,13850939335196094972,3568488366019220386,2097152 --field-trial-handle=2216,i,3517219951773447282,17671870484171533850,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:9
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,17570958063511380218,8893972786602538265,524288 --field-trial-handle=2216,i,3517219951773447282,17671870484171533850,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,10925831181643912167,16679791780437301956,524288 --field-trial-handle=2216,i,3517219951773447282,17671870484171533850,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,1052576397139558099,12811581786825700114,524288 --field-trial-handle=2216,i,3517219951773447282,17671870484171533850,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,1052576397139558099,12811581786825700114,524288 --field-trial-handle=2216,i,3517219951773447282,17671870484171533850,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,15994604021634280557,12851008254205460588,524288 --field-trial-handle=2216,i,3517219951773447282,17671870484171533850,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:14
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,10034931579850361814,6266762432777945637,524288 --field-trial-handle=2216,i,3517219951773447282,17671870484171533850,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,2042130724910298924,5957759738034074028,524288 --field-trial-handle=2216,i,3517219951773447282,17671870484171533850,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,7001668838572032471,15979059537029278279,524288 --field-trial-handle=2216,i,3517219951773447282,17671870484171533850,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:14
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3704,i,9755748963381181172,10328149066797375840,262144 --field-trial-handle=2216,i,3517219951773447282,17671870484171533850,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

7e3057ef-7950-4832-82c3-eeca7b296d5b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7e3057ef-7950-4832-82c3-eeca7b296d5b.tmp
Size 11KB
SHA256 1598ad29ce1b9a71ae7bcc6de5415c99d376e91585187bb0a0c74526b6ebf9d2
MD5 f1bd39fb76bf1830be07fedbc2ce5fc1
SHA1 85573db22daf09d03adebcdf99ec8601a902b6d6
SHA512 bf3ea038d26e989335777ca5df52717e88d7237f9215b13e2debfb369d57fb70dc2cb8aeaa47ece8457b828fa071e8e14a72ce988945082fde3b322bbf272024
SSDEEP 192:sxRNR6bW/fqsMQ0OBDde5lSZzoD8p4t/g6+WNIYCyuOMGkHIgIJ:sxRNWW/fqsMhwc5l8A/5IQcs
TLSH
T19532A7166A2CA97B8CC7E24DBB657F53D2F92033A1D51E48E7FC860C05EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8bd1c2e7076cb50184a992540fcad76a34403a534325b37676a9681f0967308d
MD5 5d396ecc89d9ea50a5d825eec00ebda3
SHA1 d2cbbceccc3e36b4fe8469d60dfcb9716aa43d6c
SHA512 bb287919887c431b6ea72dd4ed68bd2f05daaab9bbe2a5af84d689ca1eac261abb19f94157ec7bdf90b27c22c41ca38d97e6162176e1ba5a326f94ea47161284
TLSH
T1375151D3132259CFD3E159B121F16468B2FEA87C81176E88417B2D74CA01FCA50E347B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595951.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595951.TMP
Size 2KB
SHA256 b80eb1ab263c1fdedc9919d5e2f6c118c882a91a550a8aadf35e4972c79e4f6f
MD5 591889ad3f0bea885f44b40dc86d7b92
SHA1 c10c5aaa6d0ea1ad1bd622e9a72ad419943b0503
SHA512 2829bed02aa0b2666504d3223002c611430616960e9142216622498d7bf47f56dd586ce2623f577f49a926cb5ecc256293e7da98afcd5b25cce1412513761148
TLSH
T1235151D3132259CFD3E159B121F06468B2FEA87C81076E88417B2E75CA01F9A60E347B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 381b66194ae1b363cac84ebb5311c7f80c213be4b16a12001d30873a102eb4f8
MD5 8d4354a4a85b2bcb5dd61e52d52fa71d
SHA1 59befd98ae7fab915e3fa5ad59b1a290dcae72fe
SHA512 37e127ce46d6f1d712ebd62bbe9b2f197fc112f5a712e551c29572bc25aaee5a2fe06a1559742df1a35769f26a729fea918fb82eb9c1a50f3cbeba0370e84265
TLSH
T1BE51CFF7C3E8867E890156F0AB157E2BCE1D0919832C3C5A89E4EF1BA7E2471D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 89f76ef134d34c69d5ba32de0072b10e32aabcd450e3445846c72c6342d7e9d0
MD5 29a44d2980342c97dc35ee5ce1416aef
SHA1 836b7310bae78a487f62d46628c32850948f3107
SHA512 9b2567e0bc565d53b3fa540b8039d9b9baa4620407a20e8084317ad87cde1cbb7257cee6f4e68189062ca192af2358e7f99d52e477a4a23285f907942cede5bb
SSDEEP 192:sxROR6bW/fqsuQ0uBDde5lSZzoD8p4t/g6+WNIYCNuOMGkHIgDCJ:sxROWW/fqsuhQc5l8A/5IBcK
TLSH
T1AA42B6166A2CAD7B9CC7E24DBB557F53D2F96033A1D11E48A7FC8A0C05EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2a20a54a86e5ed7995dd46933965f71b7eb2ed77bfbf8ed70ca6895c30c1f1e5
MD5 85c4cdf7dce068c594eb4b30e622fd7c
SHA1 311cea2f170b06bdc079848f225c85c875e58e6e
SHA512 fdf7f5cbac3914baa1bcaca60ea105dbdf6798e897c755bd9b92a4128e6218370283321279fd2e84bea77e3e6303379833a672e70db21a7f4cd1aff10a934ca6
SSDEEP 192:sxROR6bW/fqsuQ0OBDde5lSZzoD8p4t/g6+WNIYCyuOMGkHIgDgJ:sxROWW/fqsuhwc5l8A/5IQcA
TLSH
T17432B7166A2CA97B8CC7E25DBB557F93D2F92033A1D51E48A7FC860C05EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 1db5252bd54b5c6c68e55f7b5266b1dbe43c6f5933bb19170ed4335482dd846b
MD5 9ecf0d572d7ca92c8e1261753c41c03f
SHA1 4e28e5adc2d617890df3484dc8dff9db32be2d12
SHA512 b45047ee91fd38af8a05642680d5031ba5491fa3fb46d922506798eba625f713edfa8ada6c10b092c74241cdb02670296f500387d32ef918749f0633ee39c38b
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvgroZSo:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0Vq
TLSH
T152B2EA2B600DCB7F5F800AADAC196FD76DA802CB97589D4047FED94C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 dfa0dc8ec23f6dfc1ef5765eed88551fc2461f2e7874390dfcdf5e5527899908
MD5 a39cc679d9ec2ea6a6cc60b14b6a569f
SHA1 be8cc5b835482fec96786284ecbdf59bad246850
SHA512 407e8959bf975b2183d3a3d512c27a944ace2bf10c745feea7d8cad203f74e7624f4b2b92319c5c0f51f3f5be4ac8b5a3cf3c11983d8229dbb789d72024f1ad0
SSDEEP 768:6rv+4UNbdJ3Gb6zf+1np8+p3bd66j+4BRv86aLIWPqzU:6bsb73Gbjp8+p3Z6n4yQzU
TLSH
T11B03AE72E8ACED739CF6C684B24776437FB4116396C01EA4E8DD6B4E429A09D170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6a08fc5bf15e0e1082c85d7f7c937502bd131207c57c3911dca39eece5038f41
MD5 21b875ef0b75f2b5f7e808c92d5c99f9
SHA1 c65eca4604f18846a5e2f91a36652a57cf92d4f0
SHA512 21a9a14aec37d0046d22dd108140bea661b0fb5358485eab6f14877a8ef52f4c193038a0a3f9e546496fb6454377fa5f660f8556e343e7acbb49dd8a589be3e8
SSDEEP 768:Ij+9/39v6zf+16p8+p3bd66j+4BRv86aLIWPqb9MT:X9/39vjk8+p3Z6n4yQb+T
TLSH
T101F2AE32E8999E738CE1C694B2463743AFF455A397C01E98E8DD7F0E05DB1AC570B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d070efdf0417610bfbd41814a821b28d41a028db5afeffa4be870b91db353ad9
MD5 7a1168e0f2f018898a382886c3e8192a
SHA1 62994ccb5caf17efc230250af7cdbfc836f6f01d
SHA512 4524969733f543db29c144f513934bafb1e5452ae3690a1b1c2957fd69be6030026f03cd5164adbe64ea2457881f851a7fcf1ae0b1f6fbf4bc4c07cb96064e11
SSDEEP 768:Hj+9/3Gv6zf+16p8+p3bd66j+4BRv86aLIWPqb9MT:q9/3Gvjk8+p3Z6n4yQb+T
TLSH
T1DFF2AE32E8999E738CE1C684B24637436FF455A397C01E98E8DD7F0E05DB1AC5707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 fb64f9ae88d29eb1a098e05415e44e4063de66f95fdcf1447f7131991a1a298e
MD5 b2f196a1c99408391c9260e807d68e50
SHA1 358edcfd4c65f24aa3a9d6cf6e85097f1a0ef415
SHA512 1a5d54c00207e7d197ed6856e0bcf309bc5d402a90cbe8ca838fe3a9bc1bcb08a810ceb9e9147c346b5c7af1f0ebcb3ed8a49bb6b9471bb0a596a452d8500ce0
SSDEEP 768:0F1j+9W3dwgDv6zf+Xp8+p3bd66j+4BRv86aLIWPqb9MT:Z9W33vf8+p3Z6n4yQb+T
TLSH
T150039D33D898CE779CE6CB84B64A3743AFF111A396C05EA4E5CD6F0D019B1AC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 586eef92b7f791c38f2e890843a33311f1454682b7564603281bc5571110db9e
MD5 31c63d89c2472d782bdf8d8f3fefef32
SHA1 cfeafeb855d6878dfd4c922720336a8c73002677
SHA512 d4d4d444325cb9a7a1f6534bbbe2e0af94a4edb814aa76e1c0293b2c838f4bff5e36b951879731d5debb3a3fd5fc8d98426c4ad225198f0f065760438dc6ec15
SSDEEP 768:Irv+4UNbdD3FcfKNp8+p3bd66j+4BRv86aLIiJ2bwCl1:Ibsbp3pL8+p3Z6n4yr0ww
TLSH
T18D03BE33E8A899739CE6C648B24677437FF851A396C10ED4E4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37e34d58-c1e5-4d89-bad7-23eeec26d9c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\37e34d58-c1e5-4d89-bad7-23eeec26d9c8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download