2ab315537510fc91d73825d0d6661e9f4b141799877e2f5159892886265f362e

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.html
Size 1005B
Sample260723-l494jsbe86
SHA256 2ab315537510fc91d73825d0d6661e9f4b141799877e2f5159892886265f362e
MD5 fd879317e803d0d934db5bcc5ff8fcc8
SHA1 21b7954728b3579bbccddde44255bd8173f96f64
SHA512 2b274bf9900fd88d8697f67fdd82db000d1c1c9447ef1d4fd6b0202ac74008142ada2e30beed8f3b3e6e5ea8931f35cb21d5f5294ac9721a366d0d675043731e
TLSH
T168110EE72204920E3F0091807043312CC9D79EE96FA58C41D9CB989A75D8E81C82B388
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4780	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292747939279158"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{2F114BBD-09AD-4EE4-A307-9FC90A608924}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5196	msedge.exe
5196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 3272	3980	msedge.exe	87
PID 3980 wrote to memory of 4804	3980	msedge.exe	89
PID 3980 wrote to memory of 4780	3980	msedge.exe	90
PID 3980 wrote to memory of 300	3980	msedge.exe	92
PID 3980 wrote to memory of 4804	3980	msedge.exe	89
PID 3980 wrote to memory of 4804	3980	msedge.exe	89
PID 3980 wrote to memory of 300	3980	msedge.exe	92
PID 3980 wrote to memory of 2000	3980	msedge.exe	93
PID 3980 wrote to memory of 2000	3980	msedge.exe	93
PID 3980 wrote to memory of 2000	3980	msedge.exe	93
PID 3980 wrote to memory of 708	3980	msedge.exe	94
PID 3980 wrote to memory of 708	3980	msedge.exe	94
PID 3980 wrote to memory of 708	3980	msedge.exe	94
PID 3980 wrote to memory of 4216	3980	msedge.exe	95
PID 3980 wrote to memory of 3416	3980	msedge.exe	96
PID 3980 wrote to memory of 4216	3980	msedge.exe	95
PID 3980 wrote to memory of 4216	3980	msedge.exe	95
PID 3980 wrote to memory of 3416	3980	msedge.exe	96
PID 3980 wrote to memory of 3416	3980	msedge.exe	96
PID 3980 wrote to memory of 2724	3980	msedge.exe	98
PID 3980 wrote to memory of 2724	3980	msedge.exe	98
PID 3980 wrote to memory of 2500	3980	msedge.exe	99
PID 3980 wrote to memory of 2500	3980	msedge.exe	99
PID 3980 wrote to memory of 3236	3980	msedge.exe	101
PID 3980 wrote to memory of 4716	3980	msedge.exe	105
PID 3980 wrote to memory of 2416	3980	msedge.exe	106
PID 3980 wrote to memory of 120	3980	msedge.exe	107
PID 3980 wrote to memory of 1632	3980	msedge.exe	108
PID 3980 wrote to memory of 1632	3980	msedge.exe	108
PID 3980 wrote to memory of 5196	3980	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffb5309c188,0x7ffb5309c194,0x7ffb5309c1a0
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,7619437766625168546,12550696153687944751,262144 --field-trial-handle=2584,i,15795563278465533369,725928734448754241,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:2
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,5747721806662246490,434737837402348270,524288 --field-trial-handle=2584,i,15795563278465533369,725928734448754241,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,12116784385859425258,16455334101964201173,524288 --field-trial-handle=2584,i,15795563278465533369,725928734448754241,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:13
  2⤵
  PID:300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,8018199015888904931,10917743252367398427,2097152 --field-trial-handle=2584,i,15795563278465533369,725928734448754241,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,13783022002219429902,3096385370443020035,2097152 --field-trial-handle=2584,i,15795563278465533369,725928734448754241,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,13652424447883201711,9085421372244114618,2097152 --field-trial-handle=2584,i,15795563278465533369,725928734448754241,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,15348397036510249178,9671038699748556702,2097152 --field-trial-handle=2584,i,15795563278465533369,725928734448754241,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:9
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,11772834185343124850,11474915887695525734,524288 --field-trial-handle=2584,i,15795563278465533369,725928734448754241,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,6706017189975381310,12291708101966902199,524288 --field-trial-handle=2584,i,15795563278465533369,725928734448754241,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,5199955844112288626,6706649241815955708,524288 --field-trial-handle=2584,i,15795563278465533369,725928734448754241,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,5199955844112288626,6706649241815955708,524288 --field-trial-handle=2584,i,15795563278465533369,725928734448754241,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,18105921457707348304,3071758725195962225,524288 --field-trial-handle=2584,i,15795563278465533369,725928734448754241,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,17443790100394425745,3006891829128481588,524288 --field-trial-handle=2584,i,15795563278465533369,725928734448754241,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,13009705056126416118,9228776487343522263,524288 --field-trial-handle=2584,i,15795563278465533369,725928734448754241,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
  2⤵
  PID:120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,4118097712034428201,4098111197699138536,524288 --field-trial-handle=2584,i,15795563278465533369,725928734448754241,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6072,i,13972614793070304229,10327000446147238825,262144 --field-trial-handle=2584,i,15795563278465533369,725928734448754241,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

95bde3c6-00a2-49a0-b96f-3fca5c23177c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\95bde3c6-00a2-49a0-b96f-3fca5c23177c.tmp
Size 11KB
SHA256 990f7c2b59e7954330432a7c5fa1279d99cc06a862dbf77dcf9b4052b08d7cae
MD5 41ca22283e93b414321a74efc5bb7fff
SHA1 c4a6558c94bce2228b6e997b2f1aafc06ad7ea45
SHA512 b4936fd4c56a434d66d7047205ca4febd4a6aa711b96d5ce2bdd1c9ebb54d2f6c197d6ced2c8fdd650b0062421c71f0f65c757f57b35e31eac755621a1c378cf
SSDEEP 192:sxRERXbg/fYsGDprQ5kzoA8p4g/g6+WNIYn83hLtG2IgIJ:sxRExg/fYsGDax/5ITRNs
TLSH
T191329716AA68A93B9CC7D21DBB55BF53D6F95032A1D42E48BAFC8B0C04E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 629225b11ed4cb9e90aa0d16e8081c57484593537a6d5432919b3a75b742e0fe
MD5 957f17e1486230d7dd3f4142c43b9fdf
SHA1 687590c5df9f9e5f24151e0077c68296ce3ca282
SHA512 ef1eb097ca97e91ead7474a878181d9072b3c9ce5dd0aff00b9632fbe873099211168946f4d065f67f0db0015d816f8e24105e9ac174d3beaa07afac69f60a3a
TLSH
T13F51D9CB433714EBE3AC48755CE28C6E3E75D5E901CFEED0AD4865B85A9A31B6CD0092
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a081f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a081f.TMP
Size 2KB
SHA256 2807404fb68f6d675c6bc5e25d83c152d6a4170e49c9b80db3ca172632cf2155
MD5 c870d5001bea918c680ee0250ce45a4c
SHA1 6497f1c716332ecda9046dc46c77a9a083221857
SHA512 9d9c2336633a3afaedd0596b00b63c5ef74a25d3423bb2c0b7654374ecf499cff5dc8d10952d87a97342886ca17928fcc70b91fe75959a0166ced944e7fc1854
TLSH
T1A851D9C7432704EBE7AC48755CE28C6E3E75D5E900CFEED0AD4865B84A9A31B6CD0092
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 446a6ad2e19af0a1ca72afab07dbcc2f03c598810f4fa2004a64c022fd9de204
MD5 bf3b4ffe9a116517886b9c94737a6ae5
SHA1 bfaa38f62de4442d9b06403d441f41c0bd20d089
SHA512 8d921078aa8f459b7baed4201e93c9972584529d99fe273037738287afab3255b6a077b98c99b1d5a84ec2cee9b555e85ac33f148c612ea86f67e02a82ca673d
TLSH
T19E519CF7C3E4866D890156F0AB186E1BDE1D0955832C7C66C8E4AF1BA3E2471E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c49b36affb5a573a0192bbe6270a14fe523e650426e52a245ef918d90d6c8b1d
MD5 1b7083f09e7fab9683ace3214c3a54a5
SHA1 6c559e6940c50a80de50be24cedaeca7914a5ae4
SHA512 cd5fcc2e8622574bb84aa1971bfe3df16a5fa978ec44c23384216b4287e26d0776380e17be5105961dbab23d6795499be468434f947428fffa70f66ac4da7df5
SSDEEP 192:sxRbRXbg/fYs/DprQ5kzoA8p4g/g6+WNIYn83hLtG2IgDuJ:sxRbxg/fYs/Dax/5ITRNu
TLSH
T13332A616AA68A93B9CC7D21DBB55BF53D6F95032A1D42E48BAFC8B0C04E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a7235eeae9c75dffa2143e77e8b23da2c1e9045685c79443b1069a556fc10a4d
MD5 7f7c39d0b10d6bba3b2319b566e268c3
SHA1 1729d8d59bd82b48039d5489c4d335ca18d6b13a
SHA512 fe2a89f792605146951753439a46c524704109b7f1006ee9e4c0d3b1cf344cc9289cc8349fbcc17630cb2b68ffb8e954e79a7df0e92288f07732a3a0a3d13332
SSDEEP 192:sxRbRXbg/fYs/7prQ5kzoA8p4g/g6+WNIYn8OhLtG2IgD0J:sxRbxg/fYs/7ax/5IT0Ns
TLSH
T1C932A756AA68AD7B9CC7E21DBB55BF53D6F95032A1D01E48A6FC8B0C04E76CE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 f31acd6bfdedc65012983f7f2dbf3e8cfbb4f21b783fee9292d91616484a04b2
MD5 5bec836adf7253bf34f06bf89e884718
SHA1 4ed56a6a948da4465aa5696c9327d90677a530e5
SHA512 d4bb98b55ffff5b40abb271938a64cb69ed974b6537aed5ce9d6c6db543bbe545134448a6e2e016d4cdf2cb8f05da635a588419e89abc74241cc9fa499386265
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRP0rohMg:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0Vy
TLSH
T11AB2DC3B604DCB7E5F800AEDEC19AFDB6D9802C79A948D4447FE950C02C77EA91194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5aa133.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5aa133.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 c6485a42173ca41c642c119982da070acd8e0bdd658908bcdea332b0ec545c77
MD5 13272264195501937dfe2e84180e7ee8
SHA1 4245b1ed832117ea833d4e7d14d4ebb75b50f2a7
SHA512 67f0b0eee27ff787617022bfbf38505fd95f125001eec4e4d628b13f77b8450021ecd027a25e4d6c5eec15728f108c46a7cb959d8bb7b46fc73719acb34e7372
SSDEEP 768:CFQ+3awgfIcODZIO00U8pNzc4ReyIsPFb9Mi:Z+38uU8ptc44bs9b+i
TLSH
T15703AE33EC64C97BEDFA9B82F94636036DF1516BC2986A94E6D99F0C05471EC031B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a9ac12816e0546c7269f6517267a770a5b50b3bf5502d4bb40b8adf971b35ba4
MD5 76150fec372681a7380a6aad15d5b8ec
SHA1 e416b9e8f906820968305681d99faae9ad67add8
SHA512 e2f529faa2732f75c81a0c6b12df1bd1902f7386bfb8d9bcd9479385f4cf033b5c879b71bd2e2040c69ae6e4f9100f7aca720c2603106dadd78a3901852bed07
SSDEEP 768:lrv+4UNbd03PISODZIO00U8JNzc4ReyIsPFw:lbsbi3P2U8Jtc44bs9w
TLSH
T1F903AE32FD288967ACF69686F40735433EF4515BC2C82AD4D5DA6F4C058B6ED131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1072c1fd5e4db32ef1fd0edb2ffc6e0b99752b543bdc87bc80706739d2695533
MD5 cb161ffaccb6272c9b5c3e7391f5414f
SHA1 2c70dbd5cd096b6f5b71c05555d8ba85e2401348
SHA512 bb881aa2db1b72341c86549cc6e97d339cc9008e87bbe3f310592da9270eaec10b16316cd8a4fb55119f3b781f2b806ce3a3755211857bb23d4654ca0724f1f5
SSDEEP 384:DZcI338NnBEI0KMhqJDZNfNoXOVSUU0UhyzSETRzcoXfK86sfxEZxxsIj4lBFhOS:b33PIcODZIO00U8JNzc4ReyIsPFb9Mi
TLSH
T110F2BF36FC258977ECFA9642F5473A437DF1912BC2DC2A8895DEAF0C09476AC071B422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1145278e5ee7ee04312fd1198b0e2e61faa4dd235fac16931fddc364665defa9
MD5 505482600734feec58a840416dc183dc
SHA1 7a28d06c8061364e0a8531bcbc2a43ae27445717
SHA512 180b37164922d89925f01277c4a46501d0552e584d5dfd0aa263d26e923353a9fa276fbccfd58711b61d4944cb0be82ec3deacdf296da21c7fd46c9e34fc2648
SSDEEP 384:gZcI338NniEI0KMhqJDZNfNoXOVSUU0UhyzSETRzcoXfK86sfxEZxxsIj4lBFhOS:e33GIcODZIO00U8JNzc4ReyIsPFb9Mi
TLSH
T1F2F2BF36FC258977ACFA9642F5473A437DF1912BC2DC2A88D5DEAF0C09476AD031B422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2b3b5f0c6e6abf1d2757dad88d1986ffceba20880c7d23348496a4105a969fdd
MD5 b9721b7dc1e9e99664bdfdcde5a1638c
SHA1 53827c1b10ef118afb88c52c15ad6fa746fdff2a
SHA512 816ff2d488c819c2e217ca4252ba7c2ee2b2c8d66bff3bbb7c23b4777d5c625d132e9475dc7654cf597a733a2c06c7c734821d20d26d94244f753d7c686f9eb9
SSDEEP 768:6rv+4UNbds3yzDZIO00UPNzc4ReyIsXxeVH1S5D:6bsbS3UUPtc44bsBEH1Y
TLSH
T15203DF32E8788A77BCF6A686B54B76133EF85117C2881AD4C5DE6F0C468B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

352d2689-cdca-4b29-9fb2-537cc7803acc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\352d2689-cdca-4b29-9fb2-537cc7803acc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download