0f21bbff549bd8f820a7c833ed832ce08a634d2852f9e026585149ec5fe4922b

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tftpd64-master/doc-help/src/FAQ.html
Size 3KB
Sample260724-aefmvsxxay
SHA256 0f21bbff549bd8f820a7c833ed832ce08a634d2852f9e026585149ec5fe4922b
MD5 8c6dc4120bca4a57f601857af3321e8d
SHA1 d4344ee864eb75c01efc01ef80250fa1ef15c456
SHA512 2de854f5eccea1981297881617e0710010af403890f1f7604ca8cb0eed0ba8fe9f8f494e089ccf628215e76af076bd367399cd47da79cd2fc3d40633161f74fb
TLSH
T12B7173A791452737288305A2719A9BCB9776C2D4F78260700CF842BC13E7DFEC6AB6C1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2884	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293252687584498"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{6FEA7E0C-2AF8-463C-BFC2-98CADDFAF1DF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2152	2560	msedge.exe	89
PID 2560 wrote to memory of 5700	2560	msedge.exe	91
PID 2560 wrote to memory of 2884	2560	msedge.exe	92
PID 2560 wrote to memory of 5700	2560	msedge.exe	91
PID 2560 wrote to memory of 5700	2560	msedge.exe	91
PID 2560 wrote to memory of 4912	2560	msedge.exe	93
PID 2560 wrote to memory of 4912	2560	msedge.exe	93
PID 2560 wrote to memory of 4500	2560	msedge.exe	94
PID 2560 wrote to memory of 4500	2560	msedge.exe	94
PID 2560 wrote to memory of 1736	2560	msedge.exe	95
PID 2560 wrote to memory of 4500	2560	msedge.exe	94
PID 2560 wrote to memory of 1736	2560	msedge.exe	95
PID 2560 wrote to memory of 1736	2560	msedge.exe	95
PID 2560 wrote to memory of 4728	2560	msedge.exe	96
PID 2560 wrote to memory of 4728	2560	msedge.exe	96
PID 2560 wrote to memory of 4728	2560	msedge.exe	96
PID 2560 wrote to memory of 5672	2560	msedge.exe	97
PID 2560 wrote to memory of 5672	2560	msedge.exe	97
PID 2560 wrote to memory of 5672	2560	msedge.exe	97
PID 2560 wrote to memory of 1920	2560	msedge.exe	99
PID 2560 wrote to memory of 1920	2560	msedge.exe	99
PID 2560 wrote to memory of 2900	2560	msedge.exe	100
PID 2560 wrote to memory of 2900	2560	msedge.exe	100
PID 2560 wrote to memory of 5780	2560	msedge.exe	102
PID 2560 wrote to memory of 3808	2560	msedge.exe	106
PID 2560 wrote to memory of 3604	2560	msedge.exe	107
PID 2560 wrote to memory of 3688	2560	msedge.exe	108
PID 2560 wrote to memory of 4248	2560	msedge.exe	109
PID 2560 wrote to memory of 4248	2560	msedge.exe	109
PID 2560 wrote to memory of 2976	2560	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\tftpd64-master\doc-help\src\FAQ.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2b0,0x7ff9d267c188,0x7ff9d267c194,0x7ff9d267c1a0
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,5550128471185364095,16509737749615023930,262144 --field-trial-handle=2144,i,14358034778776698015,12679409720115581541,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,5878519367573165053,17138344546313360934,524288 --field-trial-handle=2144,i,14358034778776698015,12679409720115581541,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,10288512442381677833,12130494328850109603,524288 --field-trial-handle=2144,i,14358034778776698015,12679409720115581541,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:13
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,332652746922917419,10748056517274687443,2097152 --field-trial-handle=2144,i,14358034778776698015,12679409720115581541,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,6089907756450351691,3686268058074219968,2097152 --field-trial-handle=2144,i,14358034778776698015,12679409720115581541,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,9308904183485199800,17156700305294401859,2097152 --field-trial-handle=2144,i,14358034778776698015,12679409720115581541,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,1917856374234802632,5100271352672770376,2097152 --field-trial-handle=2144,i,14358034778776698015,12679409720115581541,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:9
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,8376899392198917765,7561155748937416769,524288 --field-trial-handle=2144,i,14358034778776698015,12679409720115581541,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,7769602327343823410,17712145628704369260,524288 --field-trial-handle=2144,i,14358034778776698015,12679409720115581541,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,1350695459170706521,6399903536463575218,524288 --field-trial-handle=2144,i,14358034778776698015,12679409720115581541,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,1350695459170706521,6399903536463575218,524288 --field-trial-handle=2144,i,14358034778776698015,12679409720115581541,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,11285966357454449071,2848425581673885425,524288 --field-trial-handle=2144,i,14358034778776698015,12679409720115581541,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,14097805454175022911,13788653169515427450,524288 --field-trial-handle=2144,i,14358034778776698015,12679409720115581541,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,12920320544325822988,5621852694822534617,524288 --field-trial-handle=2144,i,14358034778776698015,12679409720115581541,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,13556987566598854789,18153973079082355208,524288 --field-trial-handle=2144,i,14358034778776698015,12679409720115581541,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:14
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=816,i,18310717848386153583,15697427725607394677,262144 --field-trial-handle=2144,i,14358034778776698015,12679409720115581541,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 a62754d601ffad49a90921ded291d8021a021f23bd15d9506bc06b98671d6125
MD5 c8481a32137ef4b2b7391e3fd717f3b6
SHA1 1c07f0c0a858cb4e519339f46d65b65c3672a75b
SHA512 d8ac35afefc3615b71d0bba91b11a2889062237bf66599d181c13f79ebb39f74f494e62927a25b2d67bc73f22f7c691135593b0dfb1d9b91865ae298132edc4b
TLSH
T1203182A04B2B0EE1D3DA45F1A0D9ED9D33F7B4E8054B7E72864862B4AC0D3114BC9E00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e565.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e565.TMP
Size 1KB
SHA256 97e7a5e4a69a73cd218339d0b23f2fcc4868ca93a9fc021cfbb1427acc5a4a0a
MD5 f0b0d6b0534131989127eb262f58bd69
SHA1 597f1e1225486b4debcf231c75a81931e909adfb
SHA512 c414d5da78b69266dc3a56029f6f8adcc15e64a07ace9cd2f6caa2dcd6d8e14b86e49ed2079832f86718742cbc6a8b5814a17bd0a95d0d80ee275814ed97c47c
TLSH
T1493152A44B2B0EE1D3DA45F1A0D9ED9D33F7A4E8054B7F72864862B8AC4D3125BD9E10
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8c7b001601a0f10f208337218e4a09ee56275fbe145f8395b84b3c7ef965eebe
MD5 137bc0d658a7077568ff29de6efaa947
SHA1 b3869750cc1a50e4b07f395d5343c68744c84c36
SHA512 d509b0f5def70bf25131f66ba5e4ca38fc578f6786f4d791ef94b88f8190b529e31b73a401dd33ba97074f7d3dbf4fdc517ea2c9a3391ae054c7ba5facf1764f
TLSH
T11C41BEF3C7E8866E890156F0BB147E2BCE1D0915832C3C5AC8E4AF1B97E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9a9856b19524453b265bfed2df2c50acffa1acf856957acde0ffd9618d1de13c
MD5 3edb4c105bfd0ba65d6b96e9e56278b6
SHA1 8cabe128990442c338c0b28c28cbbd9cbe6ae485
SHA512 8d8812b6e85fcdfcb56317dfcda94c5816368b8292ace764a30b0b6a7c77df2e77b5102123af0244e7d61d1d5f04d7786da70a698051b7295376fb921d5513b6
SSDEEP 192:sxRaRSbMf/fuskLq3AtQzoA8p4c/g6+WNIYZFLOwy+G9IgDQJ:sxRaeMf/fuskLqgp/5ISgTY
TLSH
T1EA42C916A928993B5CCBD21DBB55BF53D3F95072A1941E48BAFC870C04EBBDD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c421f040dd62ebd9bc7719717488b65494d187baad621b992cee8f35992a02e0
MD5 d09739d1c32101c3a0f914bfc32a6b2b
SHA1 5c686884d3bf7b57b1d184a75406156cb5f6a7bd
SHA512 68c17391d923bc4059ef3db05264978f959d96b7a454c91160efea5b046cecbae5b4753f62efef8a420aa68b774d7a5a1b7751b44eba3b33a027712611f30f13
SSDEEP 192:sxR5RSbMf/fus0Fq3AtQzoA8p4c/g6+WNIYZFLKwy+G9IgIJ:sxR5eMf/fus0Fqgp/5ISUTs
TLSH
T19232B8166928993B4CCBD21DBB65BF53D2F95032A1941E48BAFC970C44EBBDD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 aeacb73415e129f690fc40a07163ca957cffd5e0a0cc21d15cf77e303dbd1cb6
MD5 8bc47ea7006b62e9afb0481477a1ea1f
SHA1 5beaf0eef5ba0d314d27f52cb026759fdcc0df59
SHA512 2f46af72b98e7f0c8eacc02f36d87004ae03f59056913155d25e93a0972e6c4ea25597fb5d08d73e132b70c7070aac7cbda3e3e9c4ca1abd2d2b5a002008c3b4
SSDEEP 192:sxRaRSbMf/fuskFq3AtQzoA8p4c/g6+WNIYZFLKwy+G9IgDqJ:sxRaeMf/fuskFqgp/5ISUTa
TLSH
T1F342B916A928993B4CCBD21DBB55BF53D2F95032A1941E48BAFC870C04EBBDD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 1e8f3cc4a62602380da5c63a2555fc6a783d6fd88a731b2262aec20c454d7366
MD5 4a404151a5d1276451802c36c235ce2f
SHA1 0b352b5ee7e3a6478add1bde40410bd4987e7734
SHA512 cb95a7e8fae8e9835c7e896df2eeadcb0e3b61dd6c868c1b67649c19c2ed6053caad00ed01ba514c8e12fbc6fa90447838b9c18a499fca2d6ab7885ef194d63e
SSDEEP 384:KAX0EdqfCtgNbFfVNKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVui9LZRGXrocmY:K80EdwWgNhfVN8F1+UoAYDCx9Tuqh0VD
TLSH
T1C7B2BA3B640DCB7E5F800A9DAC196FD77DA802C796588D4047FE994C02C77EA91194DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f75bc0a825b730e9aa53fc864338c339b8938b51b9e4a7b72466e8d3cfb1b10b
MD5 7775c84327df571a0caaa90acd9b5fa3
SHA1 8312b53abea4ce1464371b82952727a610640955
SHA512 4bc0a6139bf315ab46c980a66c7ee4d2a06bf72dddee29c72901c4db7d1593bbce3bf7b6f71b54974ab463e182ae084a27ae33b3990490b9509cccbce9ba6245
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5F8HtaTHd3LfWTI2gPfK4Ogxfc1NAjOQwKB21:C3gFB31lERe1JDggH2vHG5F8HtaTHd3G
TLSH
T1F691E30072BF0280783D695D9075D66B92C2F0673019B96B37A843A64FA7E138EFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 bffb061a4d11693bc8ddfc29aa086d62208e9a15d3bfe0910a118e5d13ad2ed7
MD5 db89b07d813f4038d539a13b7f747847
SHA1 0a73a61f0ef6b4105a611e36f2fca36a1c4a23ac
SHA512 9a57f8630c0e61bd7f03cf9af71582e8a7142b86040db263f03b72906d0a5b133fae3c54a9dc27b9e7fec0f49860bccfa2da7919152ee2ab17f5a2b2e45f5c74
SSDEEP 768:+rv+4UNbdd3Dz+LeSFOUAmX4fouOToPvB2thtA9VAg+eVH1Sl1:+bsb334snnwthttHEH1i
TLSH
T15213BF32A9B88E339DE6C398710B75432FF4415395D40F849EDE6B4D068B9DE530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 edaaca7c38be314924d0f6e3c4de819c885518056f0382019c4e53bcd23021e0
MD5 e0f78b66afbff0ad4a9c8902018f3031
SHA1 f43c7e52c519d0a489407175b11d2a6a4781756a
SHA512 7d6f469515de0ca1c3e7d17236ec91a7e5bd7fe71af9889f33fad73ef0ebb1e381d76c7151ff8ee3d6e0c54fcee10c2afdafe0a2c08870f34e1c862ffb5991e1
SSDEEP 768:cm3xz+LeSFOUAmX4fouOToPvB2thtA9VAg+b9M+:cm36snnwthttHb++
TLSH
T100F2D072EDA98D33DDD9C3A4720A35526FF08163D2E81F846EED6B0D058B99D8707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e1f5ccb71c43ed8ba509f2a6fcfae598bf6153ac6b2eb1e4d8e26bb86b2d5d85
MD5 65259ee104f001e7ddd57c63770e0d1d
SHA1 66b0a967bc62a177ee4dc45aa70804442024bdc4
SHA512 9f964a254e2a9ed61399ac3a48e13a6b7a16cfb3cef9285615bfd2d3905b27b71662e2fd12c0223a77bdf9ed54ba3beaadf981760f47d189b8a55bb379e9ca12
SSDEEP 768:cg3xz+LeSFOUAeX4fouOToPvB2thtA9VAg+b9M+:cg32snnwthttHb++
TLSH
T171F2D072ECA98D33DDD9C3A5720A35426FF08163D2E81F885EED6B0D058B99D8707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d4a9f3c128554273ebc039da9c1ff89e684c36042c54f5a887884dfe6424a83a
MD5 0b2396494dcbb1b3efc622c9b25fe174
SHA1 fd8854d46128879430aa0938de195c5cc00deb90
SHA512 a2762d2c1cf02d11543128e19b2d779ccd9585db4201afb54d4147222df5283104e2c360ae4d63b2ad752c44094376c9558353c5dc3a95b904f8dd9673f9bdce
SSDEEP 768:Sm3Az+LeSFOUAmX4fouOToPvB2thtA9VAg+b9M+:Sm3xsnnwthttHb++
TLSH
T1FFF2D072EDA98D33DDD9C3A4720A35526FF08163D2E81F846EDD6B0D058B99D8707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b96121ec778d9b821377bb1ac833ab5589802546e385e7fe46b17e51c33eb5ac
MD5 50dbd5620703e935bc730def5c350d1e
SHA1 2cc508612c6b09b24834660aaab66b7fe04660d9
SHA512 13eb0ddb5ab111b9d6373ef43ba97eac158b80a0f803c9ecf34db57a8dc55eada1f9aa3328a018fe8f769e88ffd794afdf53c2d1c36d2e0c4c63b9c7ae00553c
SSDEEP 768:grv+4UNbdH3uL+LeSFOUAReX4fouOToPvB2thtA9VAw2eVH1SlX:gbsbh3vsnnwthttnEH1Y
TLSH
T19503CF32A8AC8933DDE6D388720B72572FF4815396900FC49DDD2B4D069B9DE470BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe8cceec-fedd-4ead-9f21-fbbd4ebb5e96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fe8cceec-fedd-4ead-9f21-fbbd4ebb5e96.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download