ad3cc24a66bae714bcb1536ba2be070d636f61bbdfedf1e66de4d2a610a4f9e1

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Login - Used Airsoft Guns Paintball Guns and Air Rifles_files/a_004.htm
Size 108B
Sample260728-ap8rdseb49
SHA256 ad3cc24a66bae714bcb1536ba2be070d636f61bbdfedf1e66de4d2a610a4f9e1
MD5 67c58a38087e1a243fd14984f663b520
SHA1 d39158107e8711b6d9fbe13be4a3a3156f571e08
SHA512 5cf5428985e4315f7d19fa546e038cbce88a13149772002b4e76dce223270b74313f8fa246368d2486bd06008986671f44a0bf6e1fe5847a23fa8fd2375a4d81
TLSH
T1AFB012F51842000FB660FBE04CCEF2184801C910F0098C40A49031FD54CD70DD8D3790
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2388	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296719624666050"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{B9B73374-6E12-4303-84CF-CD8589DDF079}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6072	msedge.exe
6072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 4560	2848	msedge.exe	89
PID 2848 wrote to memory of 5516	2848	msedge.exe	91
PID 2848 wrote to memory of 2388	2848	msedge.exe	90
PID 2848 wrote to memory of 5516	2848	msedge.exe	91
PID 2848 wrote to memory of 5516	2848	msedge.exe	91
PID 2848 wrote to memory of 3136	2848	msedge.exe	92
PID 2848 wrote to memory of 3136	2848	msedge.exe	92
PID 2848 wrote to memory of 4316	2848	msedge.exe	93
PID 2848 wrote to memory of 4316	2848	msedge.exe	93
PID 2848 wrote to memory of 4316	2848	msedge.exe	93
PID 2848 wrote to memory of 5552	2848	msedge.exe	94
PID 2848 wrote to memory of 5552	2848	msedge.exe	94
PID 2848 wrote to memory of 5552	2848	msedge.exe	94
PID 2848 wrote to memory of 6060	2848	msedge.exe	96
PID 2848 wrote to memory of 1248	2848	msedge.exe	97
PID 2848 wrote to memory of 6060	2848	msedge.exe	96
PID 2848 wrote to memory of 6060	2848	msedge.exe	96
PID 2848 wrote to memory of 1248	2848	msedge.exe	97
PID 2848 wrote to memory of 1248	2848	msedge.exe	97
PID 2848 wrote to memory of 5560	2848	msedge.exe	100
PID 2848 wrote to memory of 2336	2848	msedge.exe	99
PID 2848 wrote to memory of 5560	2848	msedge.exe	100
PID 2848 wrote to memory of 2336	2848	msedge.exe	99
PID 2848 wrote to memory of 1496	2848	msedge.exe	102
PID 2848 wrote to memory of 1628	2848	msedge.exe	106
PID 2848 wrote to memory of 5272	2848	msedge.exe	107
PID 2848 wrote to memory of 5536	2848	msedge.exe	108
PID 2848 wrote to memory of 4756	2848	msedge.exe	109
PID 2848 wrote to memory of 4756	2848	msedge.exe	109
PID 2848 wrote to memory of 6072	2848	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Login - Used Airsoft Guns Paintball Guns and Air Rifles_files\a_004.htm
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2ac,0x7ffa51c5c188,0x7ffa51c5c194,0x7ffa51c5c1a0
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,4285340720024959561,4808480723212629656,524288 --field-trial-handle=2064,i,1981855789364138940,14506966459367824977,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,5394609385982089618,15360659778735454841,262144 --field-trial-handle=2064,i,1981855789364138940,14506966459367824977,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,11611494504937453494,16733015139672738680,524288 --field-trial-handle=2064,i,1981855789364138940,14506966459367824977,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:13
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,484495103759895503,2477094219747521869,2097152 --field-trial-handle=2064,i,1981855789364138940,14506966459367824977,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,6894969619993092679,3327353878363922086,2097152 --field-trial-handle=2064,i,1981855789364138940,14506966459367824977,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,7536261153685119660,17171179071106293629,2097152 --field-trial-handle=2064,i,1981855789364138940,14506966459367824977,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,14126448836183665510,6257743931845498213,2097152 --field-trial-handle=2064,i,1981855789364138940,14506966459367824977,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:9
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,696296402897085404,6795798789605013753,524288 --field-trial-handle=2064,i,1981855789364138940,14506966459367824977,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,8341870845970428573,7052246585768969316,524288 --field-trial-handle=2064,i,1981855789364138940,14506966459367824977,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,1028727644474606347,1355738796146752449,524288 --field-trial-handle=2064,i,1981855789364138940,14506966459367824977,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,1028727644474606347,1355738796146752449,524288 --field-trial-handle=2064,i,1981855789364138940,14506966459367824977,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,10028839383384416314,15147052669042240254,524288 --field-trial-handle=2064,i,1981855789364138940,14506966459367824977,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,3471628781085988392,16832432348736837611,524288 --field-trial-handle=2064,i,1981855789364138940,14506966459367824977,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,5542575592982959348,7154709910674350344,524288 --field-trial-handle=2064,i,1981855789364138940,14506966459367824977,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,3926531620098794335,4611116341006366492,524288 --field-trial-handle=2064,i,1981855789364138940,14506966459367824977,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6412,i,16533150943724355068,5989482748745685609,262144 --field-trial-handle=2064,i,1981855789364138940,14506966459367824977,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

871f95e7-ac5d-40ff-94cf-3ffbe522531d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\871f95e7-ac5d-40ff-94cf-3ffbe522531d.tmp
Size 41KB
SHA256 ccddd2baeca86243f30f7a937d9179250d32c3df11d81bcedb7acc1d5d5a38e6
MD5 64bbcf28d7516c4c3dbcec3808809792
SHA1 79946cad294e006c1be4ecf6e8669229de0fa6ac
SHA512 6d9b2d7908e74d5ea25807366e27af27d90b8ee7755ff5f0e8f0f54253baead4e9703f32020ad7372484b2778026feae4c3e9f575f894ab5c76b568aa8d477d7
SSDEEP 768:hrv+4UNbdb3KiZDTd+Zr1fgeX6+qTko0u229a4vsTrWb9MxI:hbsbt3w9vVTVKa48Wb+G
TLSH
T1A313CF32F8658E738CB2C695B10779477FB921A3C7C81B54E9DDAB4C064B4AC270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ffd5b7a2b3f03da20d038c938e013b62ad49c746110f2ce71c8f6f340e689809
MD5 ec7063f6c16a959144349b3d8e51ad07
SHA1 fc427e801a841a243213590007c8d03fdb252287
SHA512 a56a1f54a0b5026842ebd8ace05bb5d7abc26ee6a35627c06f543928b460e91528eee8504c2a2b56d8030e4c5d3f39b8493b67254ea54795d612130c628a6d0b
TLSH
T16451A684176D16FAEB24C4BB6AD9B8DB76F48C697E0B6FF110806DB00443F1829E3217
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598340.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598340.TMP
Size 2KB
SHA256 c2018887a8ceb3f370381c5cf64a70a92098f814b0d12844a43da6c4706f30e2
MD5 b8bda405988fdf62b8ffce2bc74c19ff
SHA1 6ec56f0a40fffe49dba9a0e536408576cd785b7c
SHA512 29315cb20f513b13e5ddca883476a79444505395dbec0dcefb846b967116572a4f371e0acc574221aa42fde2f79be93069c72144da98817bb1b7895500950372
TLSH
T11A519784176D16FAEB24C4BB5AD9B9DB75F48C697E0B6FF100806DB00543F1829E3217
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 997175c02aef228370920607c2fbc942c740a81f384e8567f7c1186108e7aaa8
MD5 2e31cc0489215fe5d1f8a5fa41ce64c4
SHA1 2f70f3e3d3e1d216dfedeaf71073f14e6e34820b
SHA512 d2971e36cce093b88f9a2a56d03b73aff120a6319f9be9f6c8f68ed60c4a8b4c4b85fab85bc1a82f08bdd4a42063d2c8d77fc70992323aa8f9b7175970971e06
TLSH
T14941ACF7C7E8C56E890156F4AA146E1FCE2C0915832C3C5AC9E4AF1B97E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 63c5ab70391c2723fe8be319eaf431366b33fa0347ebefc04ca3f4bb035b71ed
MD5 8aa9e918d276121047ef896e0de821ed
SHA1 d73b00b284b68b7ca704fc2984b669f53c1577a1
SHA512 f33bf3da0d5890f41f8ad26b4eadce3f3f4e1895c4c3868e11c3cbd74e32c79b6bd170b933380aedceb31b46950a25bf4b550d708c990328e9d3ccf15b4b43fd
SSDEEP 192:sxR8RobB/fksjz9YCbRzoA8p4D/g6+WNIYER3nGBvIgDuJ:sxR8AB/fksjz9PMW/5I5w2
TLSH
T17532B81669289D7B5CCBD21DBB567F53E6FC5032A1902E48B6FC870C14E76DD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c65bdce0d62338bfbaf5660808834fe9baa7331603cba0b871ca78b58e30534d
MD5 4228c659df4c01732e3d369cdc79202b
SHA1 7969590acd32f9d3d5f0607ffa266ac1ac8bdcc4
SHA512 229e0586c30005a9b942b539798a5adcae98189aa9658fce3ede75fcfdec2ff89d9511cc84ea8b5e4a2e81d277354cce7f9e7823d4e85e0159ca040c381af8fe
SSDEEP 192:sxR/RobB/fksR9YCbRzoA8p4D/g6+WNIYE93nGBvIgIJ:sxR/AB/fksR9PMW/5INws
TLSH
T14D32B8166E28993B4CCBD21DBB56BF53D6FD6032A1902E48B6FC871C14E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 aed68f73a1dea2c5b00cbd6e0b049afad3eb3a30a18c929a3e3eaddf4485b768
MD5 1d0f498f1e10fb943882a1b6b81390b3
SHA1 b671ea41f40e759dc2d021575bed921aebb9f64f
SHA512 88d1393478af657baa5d8d2830834794325e1c8c05f36b8e2ef3186ae043f7fc4e200d014e92de3be3579fbf365960f61c791322fec1818f4245c25356571594
SSDEEP 192:sxR8RobB/fksj9YCbRzoA8p4D/g6+WNIYE93nGBvIgDMJ:sxR8AB/fksj9PMW/5INwM
TLSH
T13F32B7166E28997B4CCBD21DBB56BF53D6FD6032A1902E48B6FC870C14E76DD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 3f5a7878a99cd6615504b9d688b8547e5fe0c6ebb730b773dfe1de86d04b2697
MD5 4032e1fbd6f7ff16645647792a1c3bb0
SHA1 3880679dafc8d7eeacf340bd60f4e61a057ae446
SHA512 1474784837ed49b8e0be84f2975a67fa9b3ddf75652f01283019d7ca69ef7901c3504c0a83b19bf3f0d0d28ecd6a6ac4b7980ac095999fb2f229deb2b7211674
SSDEEP 384:40DxK6DJQD810DrfCtgQ6DRFfIQDFKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVO:40Dk6DJQD810DbWgQ6DjfIQDF8F1+Uoj
TLSH
T14DB2DB2F640DCB7F5F804A9DAC196FDB6D9802C796988D8047FE990C02C77EE92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5d00aa21df6a45d9b14518d735ca10b3c170a5ab94e290614ce73b5cbc27ca31
MD5 8da87d1710aa6af38e65d9c6857fc9ff
SHA1 edd586b5f9ae91371172b18ad6b82aab0d8b4f3d
SHA512 f54f3a63bbcf1faa149000a5c037ff698fa22c9eb2423f881e0c37acc78add06b5941339195235bc49f58a704570ab2cf51fda060f8371dd571ab765696b8b84
SSDEEP 96:KRT8ZNbRRtWFKAg1tK4MgbtcjbylxWHm7KmgIIOW4tVgGOKLAAKNWaymwKDt:CT8ZNbRRIFKR1nMgbCjbylxWHm7KmgI4
TLSH
T12B918750307A1290397F661491B9C85AC3C1B8AB311CE46B7BA94176CF2BE035DFEDDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0fa3179f34c696fbe6c2b4d4dd8f466d99eb0274a57dd58f9f88d378976dfc65
MD5 6d13b8b488402197fd5ef8760f3b38f3
SHA1 531e5fa562b2f3649cad3e1ad2666a32443f8214
SHA512 2d634bb03b7e06ddd202127d87e77a48fbee4393b21741e80825d27a40e13e6146b79746be2e5833db8d7838c5c531493202ccdb50f10444d84731604a28f4a2
SSDEEP 768:Og3DhZDTd+Zr1fgeX6+qTko0u229a4vsTrWb9MI:Og349vVTVKa48Wb+I
TLSH
T1B0F2CF31F8618D738CA6D785B21736476EB96273C7DC2A48A9DDFB0C064B46C170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2310e2d86768858418af73fd17e85f91db49e9c32c94d0face7b8d93976d38b7
MD5 778ae64384a9b08ae75a47d7961666e2
SHA1 8952c5263f453a1adfd8477f113a737b4e1dbc15
SHA512 e5ee834ca731f4171a72d251b0ea567577b23fe4a827b33c1de2901ea05190656e466850dfa68952dfc671e2c2163490c4322dacc459e57291d3aa548285434a
SSDEEP 768:Xg3MhZDTd+Zr1fgeX6+qTko0u229a4vsTrWb9MI:Xg3z9vVTVKa48Wb+I
TLSH
T140F2BF31F8618D738CA6D785B21736476EB96273C7D82A48A9DDFB0C065B46C170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 7e9e44e25c861f042b7b859af057d9aba84a50b79d48aa27803473ae5c8e963d
MD5 f6f8721e4f405dada57e7ebb557af6cd
SHA1 7c82d2c0fcb7918fa584540b09ea615065fd8e52
SHA512 4eb208b04391726fe52e315f53a3a24ead8a12830c8817959e53cc77af54c9933bcef61d3d2f4b18f09ae5c5aea021ce56a4aff1e3c0f4242ed0ef63614423e8
SSDEEP 768:vX3DhZDTd+Zr1fieX6+qTko0u229a4vsTrWb9MI:vX34jvVTVKa48Wb+I
TLSH
T1EBF2BF31F8618D7388A6D785B21736476EB96273C7D82E48A9DDFB0C065B46C170B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5b796746c3323764da767464c3280bd2c02f16e1b871ad10f2f77196cffeb663
MD5 dbf3dc9afc104d4f157e3f9bb2cf43f7
SHA1 a9232fd1964d517e5205043c71383a7a17f2aa9e
SHA512 c74dc2b003c6cf497d8285c72748610935d7e2244c5cd22cbea5e3be6d90a5cea5b53cd09398662274319dc88429685568a0715fd3c83425c8de232e8b302981
SSDEEP 768:prv+4UNbdG3yuYDTd+ZrIeX6+qTko0u229a4vsDrzeVH1SdW:pbsbU3dbvVTVKa4EzEH1h
TLSH
T15903BF32E8A589778CE6D789714B75472EB92173CB880B90D8DD6F4D064B5AC230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bce87072-5b3a-4a96-8b21-a20d3cbbc38e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bce87072-5b3a-4a96-8b21-a20d3cbbc38e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download