b95572a02789dec99453acc5fc6915dc2d04ecac4f165225cd6c587582858bae

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
portal/index.html
Size 732KB
Sample260723-pg1hdacj7s
SHA256 b95572a02789dec99453acc5fc6915dc2d04ecac4f165225cd6c587582858bae
MD5 3c208f5c39cb660ea81e4c0a89218a19
SHA1 1a1a3d9b03c2f9505dcedcce5f99766568e454af
SHA512 f6f8b0a42d97cbb2af553b58e0d4af4f78c12e7cece4056c084b0ee7ef94034ae5e672d2628c394bad9766077d9bd026947dfef77ee2dc95ca4278ee3024381c
SSDEEP 12288:ZMhFPE6UrnLU4qz9LmfvaICGINkd1YNVKCaCqz3bfvQpCQ6t:C7PwY4qzc2Nea3DaCqvI8pt
TLSH
T1FDF4AE62F5C1312EE08FC9145182BA6A5A6BD553C2141FFAF927B7B04F966C706B3F08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2520	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292827388528260"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{CD37694F-D165-4BED-8900-DF37E13A900C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 5496	5060	msedge.exe	88
PID 5060 wrote to memory of 2568	5060	msedge.exe	89
PID 5060 wrote to memory of 2520	5060	msedge.exe	90
PID 5060 wrote to memory of 2568	5060	msedge.exe	89
PID 5060 wrote to memory of 2568	5060	msedge.exe	89
PID 5060 wrote to memory of 5580	5060	msedge.exe	91
PID 5060 wrote to memory of 5580	5060	msedge.exe	91
PID 5060 wrote to memory of 5960	5060	msedge.exe	93
PID 5060 wrote to memory of 5960	5060	msedge.exe	93
PID 5060 wrote to memory of 5960	5060	msedge.exe	93
PID 5060 wrote to memory of 5524	5060	msedge.exe	94
PID 5060 wrote to memory of 5524	5060	msedge.exe	94
PID 5060 wrote to memory of 5524	5060	msedge.exe	94
PID 5060 wrote to memory of 4340	5060	msedge.exe	95
PID 5060 wrote to memory of 4340	5060	msedge.exe	95
PID 5060 wrote to memory of 4340	5060	msedge.exe	95
PID 5060 wrote to memory of 5116	5060	msedge.exe	96
PID 5060 wrote to memory of 5116	5060	msedge.exe	96
PID 5060 wrote to memory of 5116	5060	msedge.exe	96
PID 5060 wrote to memory of 1420	5060	msedge.exe	98
PID 5060 wrote to memory of 1420	5060	msedge.exe	98
PID 5060 wrote to memory of 4052	5060	msedge.exe	99
PID 5060 wrote to memory of 4052	5060	msedge.exe	99
PID 5060 wrote to memory of 6012	5060	msedge.exe	101
PID 5060 wrote to memory of 3196	5060	msedge.exe	105
PID 5060 wrote to memory of 4280	5060	msedge.exe	106
PID 5060 wrote to memory of 2200	5060	msedge.exe	107
PID 5060 wrote to memory of 4620	5060	msedge.exe	108
PID 5060 wrote to memory of 4620	5060	msedge.exe	108
PID 5060 wrote to memory of 3288	5060	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\portal\index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7fff9614c188,0x7fff9614c194,0x7fff9614c1a0
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1784,i,8311753488492808232,5418798013858350354,262144 --field-trial-handle=2376,i,9274833315384271083,17234476034347221188,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,10407024350635686573,605721092423541146,524288 --field-trial-handle=2376,i,9274833315384271083,17234476034347221188,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,4356234586418734299,4817861733716200724,524288 --field-trial-handle=2376,i,9274833315384271083,17234476034347221188,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:13
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,1285987472056896126,9071895892544697532,2097152 --field-trial-handle=2376,i,9274833315384271083,17234476034347221188,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,15183273206391157979,3714697545522268693,2097152 --field-trial-handle=2376,i,9274833315384271083,17234476034347221188,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,14108890262303243256,15146923222642078209,2097152 --field-trial-handle=2376,i,9274833315384271083,17234476034347221188,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,18183500694029162030,3079345828840675110,2097152 --field-trial-handle=2376,i,9274833315384271083,17234476034347221188,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,17815149829292958347,1846533083877410468,524288 --field-trial-handle=2376,i,9274833315384271083,17234476034347221188,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,16635612095058533670,12277800077393068482,524288 --field-trial-handle=2376,i,9274833315384271083,17234476034347221188,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,17912834487089453016,6274887236800668147,524288 --field-trial-handle=2376,i,9274833315384271083,17234476034347221188,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,17912834487089453016,6274887236800668147,524288 --field-trial-handle=2376,i,9274833315384271083,17234476034347221188,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,9466148030565934229,11036223102245148793,524288 --field-trial-handle=2376,i,9274833315384271083,17234476034347221188,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,2212269372756552117,17594519479231964334,524288 --field-trial-handle=2376,i,9274833315384271083,17234476034347221188,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2824,i,5131579417681558211,258962954792602689,524288 --field-trial-handle=2376,i,9274833315384271083,17234476034347221188,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,18218346172555148391,6043085643076774080,524288 --field-trial-handle=2376,i,9274833315384271083,17234476034347221188,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:14
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5816,i,2241790325666864028,13957826542135413453,262144 --field-trial-handle=2376,i,9274833315384271083,17234476034347221188,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

74c7b13e-7f19-4892-acfe-c0e0af7daece.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74c7b13e-7f19-4892-acfe-c0e0af7daece.tmp
Size 11KB
SHA256 76d4069d84cd016163db21a05eb0c208ad727c845047b1378ffcab2fc05a08d7
MD5 68a39082733e5db46c018af382138881
SHA1 ca811c76216a7d03784bf694b39efff0b567fbb3
SHA512 8eb15d518a97f05248714aa6430f91d7458dfbf025c9e179a3654cf89f636939d53aa1db64a2842b4f5a4d5836a50a7d1239fc5fb544a7c239c896605ee1d926
SSDEEP 192:sxRmR2bJ/fssgm3At7zoA8p4Y/g6+WNIYZFLKJGRIgIJ:sxRmmJ/fssgm71/5ISNs
TLSH
T11332B6166D28993B5CCBD21DBB69BF53D2F96032A1946E48A6FC870C04E77DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 316bc8f36c12a249bcd5df1c113216a23e72fd78e8bb5f184c0296242afaad6f
MD5 0becc44e3438f1a31feaccf8226ff33c
SHA1 2ecfc2629b4476e64ebd768798eb3a36a60cc127
SHA512 f43c637997b468c659602ba00c37df0a3c8375a0e38192143c1c03023262d4384915150e4696bb7b905f0c282657ee22d9a959b1597a96b71d523d01e2e7c3c1
TLSH
T172616E15332E16C3DB2478B261FB968837FCC8B792CFEE6065006E764A06F16A4E0023
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e6fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e6fb.TMP
Size 3KB
SHA256 9dbcef06b16a5dd6ca08e56999f9adcb40fde11bc9e9b074b25dc53a296ee9cb
MD5 6a4815bddbb2e13126a18c9ec850a30b
SHA1 f406fad2c209d19d4c9ed97242b698ba617bf59f
SHA512 936ab9e2beb5f246927fb1384cf39863aa64e88d754e66d3be7f91173154088bf27ce5f6fad8a66a41ff270347b6268c46924a4c67d6a2b9a5e8b6ca4d390054
TLSH
T14A615E15332E16C3D72478B265FB968837FCC8B792CFEE6065106E764A06F16A9E1027
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 4b52a318d1b2ebd2452ba9dfc507021652de1c06316fc39e28b8cb57219b75da
MD5 807c6c17ae11a8d191bb0fefb26f7a9d
SHA1 5a54585be8a472cde5517ea70d54b54bf8ac839b
SHA512 f47ca0e3834f11c922d781bca64f532080bdef1f392fbd8d45668eb42ccb2b7c482a171b21671f699ea209650c74a12e38bb3364c13438884a792d8262937a52
SSDEEP 48:YALlNuOg9gKAsJlRsJMfoKsJYgmzsJrjhhnONgCZseWrsmAWZDs2QW9gTFjsXWz+:DoOcDjVB6jhnp/fZlOpTzkZ+Jp1GwQ
TLSH
T16091CDF7C3E8877D891152F4AB252E1BCE1D0956832C3C5688E4AF0F63E24B1E14159F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ba83cb01703004bc172abb7ef1a14865f748aceadf33edecab3f24473cf877f5
MD5 53a12505cee712644d7a9dc35d7c010c
SHA1 13afc5d1bcd73c8f07bba5c1a8d368b1f9780474
SHA512 71c297c04187c0f23ba5ae82d01dc0a32102123219f4575e65a75cfd05357d446a36caebf29e723443d793dcab844378be7ae083e952a2e2a662e9260b0a9fb4
SSDEEP 192:sxR9R2bJ/fssum3At7zoA8p4Y/g6+WNIYZFLKJGRIgDHJ:sxR9mJ/fssum71/5ISNd
TLSH
T14532B6166D28993B5CCBD21DBB69BF53D2F96032E1946E48A6FC870C04E77DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 1cf9941a739010251deaab72aea75a7349ac1419276521d76ccceb8a3a253263
MD5 80c35d5c378b49f7a158846f8f1ff609
SHA1 3e92560b240c125986515808de6c86be4dd56a32
SHA512 fdaec6084027bcfcb75e69e1e9125dcbf99e1b96ca4a7c450638940e80e5d6a524b56d51270901ae23e4a16c466ed49ac36a2b735f3558afbbdf3a25923dd4eb
SSDEEP 384:KAX0EdqfCtgNbFfVNKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVui9LZRGArocmQ:K80EdwWgNhfVN8F1+UoAYDCx9Tuqh0VC
TLSH
T19EB2CA3B640DCB7E5F800A9DAC196FD77DA802C796988D4047FE994C02C77EA921A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a9dafe71-e961-48e7-8dec-7c2cf9c469e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a9dafe71-e961-48e7-8dec-7c2cf9c469e5.tmp
Size 11KB
SHA256 6f7e3f574ec47170c4eb391457a35c8f2a0411c1bfbe1eac2ce0be2eace7b4b8
MD5 3a077f50a11df1f591cc7be5be901adf
SHA1 77a30e3cbd4e5ec30bcdf973edbf2ff760724a6e
SHA512 258cd4504671287d102565e6c05e90b6a93a822f35ca7b0c0badb0aa92d4325d48f5521c335485fe2a8109ed053de1e8bf0f271b90c0a932d3fc18fa72df0b9a
SSDEEP 192:sxR9R2bJ/fssu+3At7zoA8p4Y/g6+WNIYZFLXJGRIgDZJ:sxR9mJ/fssu+71/5IS6n
TLSH
T11C42B6166D289D3B5CC7D20DBB59BF53E2F96032A1945E48A6FC870C14E77DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 1ef2cfc41915934eaec018924ce722c7647d16904bd35a713b0e32c35eb88010
MD5 63b4a6650d7ead0e2360cb1682d20873
SHA1 8327218272b9853bccdddbf319fbf8f35cbf148a
SHA512 a02ad0d5444bedff8029a2c719bc3ef8832931f35130b022ae4933abff0e8de5fb0c571664247cd80d10412403970aa3e734d79f40e8884381bdb2fb219166d6
SSDEEP 768:/rv+4UNbdQ3UC+LeSFOUehzX4fouOToPvB2thtA9VAg0b9Mo:/bsb23hsnnwthttBb+o
TLSH
T1D213BE32A86C8D73DD96D2A4720F35572FF051639AD40BC89ADD6B4C068B9EE470BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c21e91efc8f6fc42bea04db5c187715f5af436e85244ac1285d91513e2aa08d1
MD5 7c71030ba2e78a745c34de34c806e2b9
SHA1 26a4eceed2b69a7db676e8a2ff832e15d8f216ff
SHA512 52dcbc1c100291083444d4bba666ef2b39159967eb56a83d9f57ef1c6394383d7f9d7d78088f39dd9ee942816c59389d0d9f2e87a1a07306ba927c0f1328de9a
SSDEEP 768:vP3KC+LeSFOUehgX4fouOToPvB2thtA9VAg0b9MR:vP32snnwthttBb+R
TLSH
T1A4F2C072ACA88D73DDD5D3A4720E36561FF09123D6D81FC85ADDAB0C0587AAD470BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5dc23078d6f1f091b0dc618aed29cf757776bbad8fb3fb97017e182d7895f025
MD5 db44df6893c2a850e81b6e7726a0a9f2
SHA1 969af8b9f9adb22800dc7cdf094bff60ab21948b
SHA512 c319222cf11e7fe0fc1dbcb1488db1de12fad0b55f9ca056585fefb512a122ed7450536cf6fc7e5adde257ae520ddac0660578dcd10657bfde192cde91de378e
SSDEEP 768:VP3jC+LeSFOUehgX4fouOToPvB2thtA9VAg0b9MR:VP3DsnnwthttBb+R
TLSH
T12BF2CF72ACA88D73DDD5D3A4720E36561FF09123D6D41FC86ADDAB0C0587AAD470BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5bf3af7cd7d016e666fb84d29b14fc950e53e9c95e892b3a62092340b765411e
MD5 fc9d66379e8e290ee1b1352bfa6dda83
SHA1 cdf7fafed41d21decf90c52105a2d173c4567612
SHA512 55dee92b98d691ab46d107e6bd10c81e71140377f2d3cd803d19b5cdb8335628076b43b8078893f212c8b8748179dd1d5bb6be354bf68060aaf0cff7f428e8dd
SSDEEP 768:0m3KC+LeSFOUehEX4fouOToPvB2thtA9VAg0b9MR:0m3qsnnwthttBb+R
TLSH
T19BF2CF72ACA88D73DDD5D3A4720E36561FF09123D6D81FC85ADD6B0C0587AAD470BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e92c5db968d60f185d4f3ae12688f0936a99a1dc05827b77982e2609fb775a4a
MD5 22dc19b59dc8b8c8e4db4ef72f29e2cb
SHA1 e1ac751b5c2ec029db4cb482a96e4c387ff42c8b
SHA512 0a36179498d4523ec58a50b661dc7963c260008b2118d3b8bb56221cb9b62a6bb9265cc3e19266c0c172ce34eb230d70c8624799861f7dab5b342101616cb774
SSDEEP 768:grv+4UNbdH3Yl+LeSFOUehvX4fouOToPvB2thtA9VAwbeVH1SlX:gbsbh3ysnnwthttmEH1Y
TLSH
T19303BF32A8AC8A33DDE6D398320B75532FF4911396900FD499DD1B4D069B9DE070BD6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download