491ef4578defac49ddbd8a3df9fa8dfc61bb6d140a7532fd7948b259b07223e2

Analysis

max time kernel
148s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
readme.html
Size 7KB
Sample260723-w4b7macf47
SHA256 491ef4578defac49ddbd8a3df9fa8dfc61bb6d140a7532fd7948b259b07223e2
MD5 5ee8d4ed40e9db9f5f74dd6ae092f07f
SHA1 9c455e63e9f2dcb1444189eb1eea914d6b700222
SHA512 afc7716726ecb6a36d36139918c4bfed68e40b74629302a86116c8ba54d34f7423edf90206f04a4e072d6ef448b7581be76f7d7a342830f6a89a25812eee3af3
SSDEEP 96:CWUK8pz1E/4kF5kyJ0ifN8uueKQMdcwFdFPKuID9kKCZxjD+9+25tdLwGg1IZz67:98/SVPmuN3C/Da7d0JuCidI
TLSH
T191E1966BB5405376131143B16006217A733300BEB79D464654DBE62EBBA23B4AF7F4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
476	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293050809099932"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{30F9B29F-EA92-4A03-9CDE-4A6860284AB6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5216	msedge.exe
5216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 5044	3232	msedge.exe	89
PID 3232 wrote to memory of 476	3232	msedge.exe	90
PID 3232 wrote to memory of 5556	3232	msedge.exe	92
PID 3232 wrote to memory of 4324	3232	msedge.exe	91
PID 3232 wrote to memory of 5556	3232	msedge.exe	92
PID 3232 wrote to memory of 4324	3232	msedge.exe	91
PID 3232 wrote to memory of 4324	3232	msedge.exe	91
PID 3232 wrote to memory of 4812	3232	msedge.exe	94
PID 3232 wrote to memory of 4812	3232	msedge.exe	94
PID 3232 wrote to memory of 4812	3232	msedge.exe	94
PID 3232 wrote to memory of 1444	3232	msedge.exe	95
PID 3232 wrote to memory of 1444	3232	msedge.exe	95
PID 3232 wrote to memory of 1444	3232	msedge.exe	95
PID 3232 wrote to memory of 5260	3232	msedge.exe	96
PID 3232 wrote to memory of 5260	3232	msedge.exe	96
PID 3232 wrote to memory of 5260	3232	msedge.exe	96
PID 3232 wrote to memory of 2804	3232	msedge.exe	97
PID 3232 wrote to memory of 2804	3232	msedge.exe	97
PID 3232 wrote to memory of 2804	3232	msedge.exe	97
PID 3232 wrote to memory of 3700	3232	msedge.exe	100
PID 3232 wrote to memory of 2052	3232	msedge.exe	99
PID 3232 wrote to memory of 3700	3232	msedge.exe	100
PID 3232 wrote to memory of 2052	3232	msedge.exe	99
PID 3232 wrote to memory of 1460	3232	msedge.exe	102
PID 3232 wrote to memory of 236	3232	msedge.exe	106
PID 3232 wrote to memory of 300	3232	msedge.exe	107
PID 3232 wrote to memory of 3404	3232	msedge.exe	108
PID 3232 wrote to memory of 1516	3232	msedge.exe	109
PID 3232 wrote to memory of 1516	3232	msedge.exe	109
PID 3232 wrote to memory of 5216	3232	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\readme.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x278,0x7ffdb18cc188,0x7ffdb18cc194,0x7ffdb18cc1a0
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,18261422129870816524,17296558262250395934,524288 --field-trial-handle=2560,i,13810994471179027312,16995150921068219182,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:11
  2⤵
  - System Time Discovery
  PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,16511687797416553785,3399119729838042425,262144 --field-trial-handle=2560,i,13810994471179027312,16995150921068219182,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,1785434531037712754,5372081594188874310,524288 --field-trial-handle=2560,i,13810994471179027312,16995150921068219182,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:13
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,14693244699092389647,11111719710639916480,2097152 --field-trial-handle=2560,i,13810994471179027312,16995150921068219182,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,4919821644508447290,5209568235001042651,2097152 --field-trial-handle=2560,i,13810994471179027312,16995150921068219182,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,586558660116129922,1441215777706957889,2097152 --field-trial-handle=2560,i,13810994471179027312,16995150921068219182,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,7296298687024963518,5295350171124813177,2097152 --field-trial-handle=2560,i,13810994471179027312,16995150921068219182,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:9
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,9172270166279689013,9667519704480784854,524288 --field-trial-handle=2560,i,13810994471179027312,16995150921068219182,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,3677508020926004978,6303188259351026825,524288 --field-trial-handle=2560,i,13810994471179027312,16995150921068219182,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,3574244647231856542,8953457076535940921,524288 --field-trial-handle=2560,i,13810994471179027312,16995150921068219182,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,3574244647231856542,8953457076535940921,524288 --field-trial-handle=2560,i,13810994471179027312,16995150921068219182,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,8334415372303509986,16281864563586743495,524288 --field-trial-handle=2560,i,13810994471179027312,16995150921068219182,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,7160151116466508585,13634233208019129817,524288 --field-trial-handle=2560,i,13810994471179027312,16995150921068219182,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
  2⤵
  PID:300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,16531522962351363643,10251955446930513563,524288 --field-trial-handle=2560,i,13810994471179027312,16995150921068219182,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,14255147696466743444,13910603353804021649,524288 --field-trial-handle=2560,i,13810994471179027312,16995150921068219182,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,9985780770967990502,2516317493835368062,262144 --field-trial-handle=2560,i,13810994471179027312,16995150921068219182,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ef74476e4abe9a5a835eded07404b48090473c5acbaa9fbebae670657ffbb597
MD5 f19955daf62710365c46804a46bd4ead
SHA1 eae2fa0af01b2f30571c8f49a709d22de278ebca
SHA512 bbf4fae44acecc33ddad1695e41aae448fbe9c513bec6a2f7f31110fa23ce8cab74e64ad7717114e4208fb49c9c85eda142dab7f5d043450ff34128fefb628e6
TLSH
T1C451E990936739A1D7A9C5F1A9D15B683AFC84661E0F3A28555CAF343486F1E61E00E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5987f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5987f3.TMP
Size 3KB
SHA256 abf631d788538a41e76a51f6998d90f71b456df0a2fc5e1221458394405b8513
MD5 c27f06593c28eda1cd72a0a5632ac7ff
SHA1 43ec8b86094b033edf460441d2aee5ff0621b59e
SHA512 6c2966b9f8265acd8bc2a166cec31f0a07e131c45abe56fae26c1f5826a97a129770d1debba650fe70bed7c8e4572833172916b270af4e135cc9541bb8e10d96
TLSH
T10A51E990936739A1D7A9C5F2A9E05F683AFC84661D0F3A28455CAF343486F1F61E00E3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 97d9184aa6a73c1cb56806f222ec539db7be3d7771ec63599e631f1001c34c79
MD5 a34ed152ef5a93a1db6b3807138e5d71
SHA1 f3738a7927ddb5b7d4cd0a16bff96d7c33630445
SHA512 feabd26b8e8e693592281d5300d879dc103e0bfe0b880d02dcb8153a7b169f198397b7261398986df2f15ea730e638aab896d5a3bfcd07cf50099969d414cd80
TLSH
T13341DEF7C3E4966E890186F0AA14BE2BCE1D0955832C3C5AC9E4AF1BD3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0bc403896b4047f73e65153127e3cc7922f5b11ac0fb7401d21804ed4f879630
MD5 a93663f18a3035ebce6b40d5f223a72c
SHA1 2e64e51467bed777b2a1a3fde272510d033fb4a6
SHA512 8fefa860d48e5746707c2ceb801037017ebed06f470bc81de43f1003fef02f6fb42e911dc8f3c8e0efc11eb01629016c293202fe867d2468edab26abf6883c57
SSDEEP 192:sxRCRJbR/fxsrEprQ53QzoA8p44/g6+WNIYn83hUGIIgDxJ:sxRC3R/fxsrE6h/5ITRUf
TLSH
T18332A516AA28AD7B4CCBD21DBB55BF53D6F95072A1D02E48A6FC9B0C04E66DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cf894022788d3efa7b96941fc21eb7cafb4c92afe155b38d56b804da6b65570d
MD5 dda0289e72599bf52bcc8c0e7995469d
SHA1 9ef98ffe84b2af8c5af444aa12bc31af251e2a4a
SHA512 06bd762cfcb8b18a46cce7e1bf858f9c82f89c5f3607a4bfa9f7ccaa2c87e6481da3761ce8b3bbb1ddb4b8c94fc6e52a01ba15aad459d42c66fcc7ac65cabd2b
SSDEEP 192:sxRNRJbR/fxs+EprQ53QzoA8p44/g6+WNIYn83hUGIIgIJ:sxRN3R/fxs+E6h/5ITRUs
TLSH
T15732A616AA28AD3B4CC7D21DBB55BF53D6F95072A1D42E48B6FC8A0C04E66DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fbdd85012167d687288007fd07cc17c931394986f72d849d6d26c68790364e89
MD5 a1e2036a72b280ffef9e7dff9e694f10
SHA1 f01d451be4bbe36f62bd0f741baecaf162781480
SHA512 56e7450dfb3d55889f99e7d349ad6223240ef098f1e339410a2f2197a9819fd25ca0169ffa6a8ad7526e933b30f0c24cef531a1a53c9fd2db832bc371e49f9eb
SSDEEP 192:sxRCRJbR/fxsrqprQ53QzoA8p44/g6+WNIYn8+hUGIIgDHJ:sxRC3R/fxsrq6h/5ITEUN
TLSH
T1E5329616AA289D7B5CC7D21DBB55BF53D2F95072A1D02E48A6FC9B0C04E76DE230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 4388bddde84e2b7a7246e7828612db04524ed4bb83787025c54b36957e0c02cc
MD5 c7bca4273f05a9063f71e3aa96812de6
SHA1 d20cfd34ab0840b0fae4a9f39082e66cf5af4713
SHA512 94c16de86e72aab6113b0611d68cdaf09dc46604f141e5b34ad7ab48daa453b9631681db8299dde974035e7fa2b7f48dc762812fddb44b6f63178835a1a4a5f3
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRP8rohM0:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0Vu
TLSH
T149B2EC3B604DCB7E5F800AADDC19AFDB6D9802C79A988D4447FE990C03C77EA51194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7e345f60445e23fee20f661b26052832ed7ac35028b3d8229ab5a1ba5d660d34
MD5 01a06363b1638ff62e646ad3e1ad650f
SHA1 20bf6e9caa8c3889495c3a368732e1f0b8128d2b
SHA512 39b827242b530322c0f921a6c827cdc8e7824c99ba87adc3b3426ea10f26442a8145925a63e3090e4f57679f3ea3ee8653c1a003d5ec28b79fd6ebff1679f3cc
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHwBUAyeSIWWLbgIIK4Ng6Icoob6jSwK3KV:CeTieYgQxAl+eODgc1W+9M+XHwBUAyex
TLSH
T1E6910F01317A1250397F6A0C90A6EC1B96C274B67258F62B3BE811A20B67E476DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a20f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a20f7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7340f8add1cdab30b8466d08c608272ec1456f3afb040efb52f1af7ced9d0920
MD5 92d38b682241c315b44a3dfbb5bb3600
SHA1 cf7e2599c4a30b559ecea24d51937534a59891a2
SHA512 54cfde1bc148afee73cf440c672f3befaca3fb50d4ddff5affbdc14a0eb7a5de2aa041a50ac1f7e7c0b3a3f74c7f56b17a74dd8b377bdd8e4f7d6f5148b0f4ae
SSDEEP 768:Xrv+4UNbdo3LCiDZIO0tJNzc4ReyIsPNeVH1S5F:Xbsba3IJtc44bslEH1W
TLSH
T16D13CE36A8788E37ACE65685F54B75037EF4516BC2881E98C9DE5F0C0A8B1DD031F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 93c969dd1a1da6381006aa32a7f801856e9c97fb9e502c9ddc87b3eda47db40c
MD5 4445da63b95422d73ceaf85429623e14
SHA1 fb192385bf06f5b163001b5c8b917fcd6d1d553f
SHA512 4178314ed8383f07747816aec2886d84a67dc5849e394b1c36f3fd7f159ab331f7aa27482cf0ee01fc8af2f682280542746bf5e059013a7a2cdc729870fb5c41
SSDEEP 384:QZcI738NeqqevsCFJDZNfNoXOVSUUEqig3jCETRzcoXfK86sfxEZxxsIj4lBZ/hZ:u733diDZIO0tJNzc4ReyIsPNb9M0
TLSH
T170F2BF36EC248D77ECE69686F64A36127DF0916BC2DC2E8895DD9F0C094B5ED035B412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 e34796fb371e0ca2de3d7910eac8c1481ce7731fb4ad62701f0f38117f9878a4
MD5 ac94ec8534aa8b6547c711d628c2914e
SHA1 5924d8b44998ea8d12f829a2871e03d37405566c
SHA512 32fc42165ff2eb539804de638a30e28543d80f608df8ef95acf46b8c0a66726e538773fb6d7f3f16c0c78a8ca28fcfd2e5ba7a57c69c920f2167f20b095ce33d
SSDEEP 768:4FQ73JwgBdiDZIO0t5Nzc4ReyIsPNb9M0:b73z5tc44bslb+0
TLSH
T16603BF379C64CD7BECEA5B86F64A3612AEF1417BC2D86A94E6DD9F0C05471EC034B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3f32da2c5586ed6b5f90e974ff25a380c67e999b989448148f15e743c2f9c779
MD5 464124803cd3f8ad5f8c52e0242a7e2c
SHA1 34ec0a78caa224eed82a9d348054fa89dd9ccad0
SHA512 ec3d69f95a982dd52aa282a49aa33932afec6aa586271e6bd651d97275edcaf645438e620f89671c8d669dd851ec91972a90c0fc794da325cf6e25d45e88f0a1
SSDEEP 768:6rv+4UNbds3UoDZIO0toNzc4ReyIsXXeVH1S5D:6bsbS3Aotc44bsHEH1Y
TLSH
T1D803DF32A8788A77ACF66785B54776537EF8512BC2C81E84C5DE5F0C4A8B1ED130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5943b0c1-b79f-4ec6-b700-f2161a753f2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5943b0c1-b79f-4ec6-b700-f2161a753f2f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download