0ceea4780d4003e9f5d5aada25ca0e05dabd39225d39dc935920cf0f82402b88

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
services.html
Size 15KB
Sample260729-ap2cbadb23
SHA256 0ceea4780d4003e9f5d5aada25ca0e05dabd39225d39dc935920cf0f82402b88
MD5 05555e48a72606fbde1d6b05bbb22b22
SHA1 16d29d4c95d1786b57c640bab77158029cf17e14
SHA512 eb0a99193772a6310a8539b90f3b17f8f862015fa8a4b216b5084f9e00f80d2f94d2677c085986ea546a3b627463dbf3c014a037de8e2e37c87413e862edb39d
SSDEEP 384:WrDUmt4qZwPnlS5EZ7k+bP4V1S5QiP7DJ7c7MvdAJ4aZ1oPnXyy:WrDUm4nl+EZ7k+bgi53PB7cAdAdKnV
TLSH
T14662E923A340043B0B6719CA74FB238AF25AD44D97915C906EACC4BB47D9DD85E3B34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4840	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297588545057959"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{D0C8113B-C827-4BAA-9D21-751F8DC2E0D2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5188	msedge.exe
5188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5552 wrote to memory of 5204	5552	msedge.exe	89
PID 5552 wrote to memory of 4840	5552	msedge.exe	90
PID 5552 wrote to memory of 1412	5552	msedge.exe	91
PID 5552 wrote to memory of 1412	5552	msedge.exe	91
PID 5552 wrote to memory of 1412	5552	msedge.exe	91
PID 5552 wrote to memory of 2532	5552	msedge.exe	92
PID 5552 wrote to memory of 2532	5552	msedge.exe	92
PID 5552 wrote to memory of 6132	5552	msedge.exe	95
PID 5552 wrote to memory of 2588	5552	msedge.exe	94
PID 5552 wrote to memory of 6132	5552	msedge.exe	95
PID 5552 wrote to memory of 6132	5552	msedge.exe	95
PID 5552 wrote to memory of 2588	5552	msedge.exe	94
PID 5552 wrote to memory of 2588	5552	msedge.exe	94
PID 5552 wrote to memory of 4544	5552	msedge.exe	96
PID 5552 wrote to memory of 4544	5552	msedge.exe	96
PID 5552 wrote to memory of 4544	5552	msedge.exe	96
PID 5552 wrote to memory of 5000	5552	msedge.exe	97
PID 5552 wrote to memory of 5000	5552	msedge.exe	97
PID 5552 wrote to memory of 5000	5552	msedge.exe	97
PID 5552 wrote to memory of 3952	5552	msedge.exe	99
PID 5552 wrote to memory of 3952	5552	msedge.exe	99
PID 5552 wrote to memory of 4444	5552	msedge.exe	100
PID 5552 wrote to memory of 4444	5552	msedge.exe	100
PID 5552 wrote to memory of 4880	5552	msedge.exe	102
PID 5552 wrote to memory of 4116	5552	msedge.exe	106
PID 5552 wrote to memory of 600	5552	msedge.exe	107
PID 5552 wrote to memory of 4236	5552	msedge.exe	108
PID 5552 wrote to memory of 4848	5552	msedge.exe	109
PID 5552 wrote to memory of 4848	5552	msedge.exe	109
PID 5552 wrote to memory of 5188	5552	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\services.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff95dc0c188,0x7ff95dc0c194,0x7ff95dc0c1a0
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,12269791388776870435,12071228923032864325,524288 --field-trial-handle=2264,i,10041826493783145784,1552542724125508881,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,5895747843539070816,7991071524077040730,262144 --field-trial-handle=2264,i,10041826493783145784,1552542724125508881,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,1576477342855788165,16752059270564754794,524288 --field-trial-handle=2264,i,10041826493783145784,1552542724125508881,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:13
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,719015862372591781,10017868906549943528,2097152 --field-trial-handle=2264,i,10041826493783145784,1552542724125508881,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,13512032142308640048,17108027661062779502,2097152 --field-trial-handle=2264,i,10041826493783145784,1552542724125508881,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,15257470008543485617,18097830466378054202,2097152 --field-trial-handle=2264,i,10041826493783145784,1552542724125508881,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,15615136749566686823,14822567213268748813,2097152 --field-trial-handle=2264,i,10041826493783145784,1552542724125508881,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:9
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,14117438476099770635,2917077424318660508,524288 --field-trial-handle=2264,i,10041826493783145784,1552542724125508881,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,9562524033642138213,2382726389076912880,524288 --field-trial-handle=2264,i,10041826493783145784,1552542724125508881,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,2876949178469287328,4790833382622237879,524288 --field-trial-handle=2264,i,10041826493783145784,1552542724125508881,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,2876949178469287328,4790833382622237879,524288 --field-trial-handle=2264,i,10041826493783145784,1552542724125508881,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,5470568078522401261,417035841875354315,524288 --field-trial-handle=2264,i,10041826493783145784,1552542724125508881,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,2333107973658490823,2788237292138757275,524288 --field-trial-handle=2264,i,10041826493783145784,1552542724125508881,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
  2⤵
  PID:600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,137187280597135109,1634577194956119892,524288 --field-trial-handle=2264,i,10041826493783145784,1552542724125508881,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1604,i,8379498121072193426,1245557133217980979,524288 --field-trial-handle=2264,i,10041826493783145784,1552542724125508881,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6500,i,8758281334331588004,3904732006949819275,262144 --field-trial-handle=2264,i,10041826493783145784,1552542724125508881,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 27d20a3e13b20ce51df0df7a48502196d0d25a22e8e85c625059434c9bde3ff3
MD5 440ba1aec443af17cd8d32e17d26ce1f
SHA1 33e986298c6546cd5786a45fcf10934abe1c20bf
SHA512 d1e171ce91a7bff164ce7e2b6af1ce1077b9c7bfa4b9f640b347793f647cd9c33078a2155511d3354640b2a141e299e81d6675b3358c393f375cea0c82e20b9d
TLSH
T176512B500B2FF9C9EBBFC87174E0C0E8367DCAA9D147AE4351B891345A0E30C17C0129
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8586fa98b2cc83cf71319ddd504b60af4403864e8d70f62a678dfd28e05fc78e
MD5 89b5d878aa7c35fdbe98a95bf0cd87c3
SHA1 6c159d86078edcae7edc65a67daf32c52f84f65d
SHA512 2a036ffc8aac47dda5fb56d0590eb78bf813f5d522489df31c8f3a2051451ed13006e203569f4c05d12a173959df9a6e28cf2b501f1594b080b93e9ae5d463b7
TLSH
T15E51ADF7C3E88A7E890156F4AB146E1BCE1C0916832C7D56C9E4AF1BA3E34B1E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ce2639dfa10ae161db6964b74bd48e9446a417d4c0e05bf8e05ff1f663a0309e
MD5 7bdd6000f1ddc4840df8e1733b3c5e8e
SHA1 e2e5c637e07a685ae4450b17cdebb2898db3313c
SHA512 674d4c860bf16abff512cec1ca7fa8cd372c1736e66bd39fc31f07f9d45c6adfa4583cae3d2ea332c795dc9f83d0f12bb4f8011e6fd9859123abf2abe09deb5a
SSDEEP 192:sxRXRhbr/fysR8/3UzoA8p4C/g6+WNIYZ7PhiMGEIgD4J:sxRX3r/fysR8P13/5InwA
TLSH
T1014297166A68997B9CCBD21DBA55BF53E2FD5032E1D41E58AAFC870C04E76CE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d2e038a30c67cbb6e8cb2ee8e154829a52e2699bc7724ae80228b130c52292d6
MD5 8e0b06b815b46728ab1bb5bc125961c6
SHA1 8163f922a8d57c232df8d38badf08b4d386aabc2
SHA512 d8bdaa24e92cf142f527db681b08c966ca8970b667b2e9187fd10d2a1281e21be5d45c2ed494607ba0f623d0c0c176ba265eb14245cab3d28d1bfea8a7ef8376
SSDEEP 192:sxRkRhbr/fysfG/3UzoA8p4C/g6+WNIYZ7PKiMGEIgIJ:sxRk3r/fysfGP13/5IQws
TLSH
T13832A6166A68997B9CCBD21DFA55BF53E2FD5032E1D41E58AAFC860C04E76CE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9a8a289a0c9cc9497d6c31783b9a4cdeabec4b98c0aea943b6cbb9778eeb88fe
MD5 a4ff7acb3e81fd986f06c4c6b7f8c04e
SHA1 e74b6e80b53d18a86e8038381719508a4cc541dc
SHA512 d05611cc9057ad6ea2a6609a022e5054d9b1dcd1a1fa0e04feb289866e10f2cfd4404e498299896ec907ff909a798a9d58d0759ac8447afa271660d3ee358f86
SSDEEP 192:sxRXRhbr/fysRG/3UzoA8p4C/g6+WNIYZ7PKiMGEIgDCJ:sxRX3r/fysRGP13/5IQwS
TLSH
T12042A6166A68997B9CCBD21DBA55BF53E2FD5032E1D41E58AAFC870C04E76CE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 1151336db97c14163cc5dccb77bc4b357e829e6e979c066d40a94d4e64feeb82
MD5 66eed6cee5413b8a49a4f44174016e6f
SHA1 404b65e8bb37a8750b4fecf8758dfa4fdda63775
SHA512 c68ce9c473a960a6f4b587733488f036f8c1091cc065f106fb352b3eff81f7617fe1333af650b14445eebaf3ae0a0b0549b08cd04194945d2b2d8e299b65fc7c
SSDEEP 384:kyr2SGXfCtgdDFf/bKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA89VXR6proOpp:ky2SGvWgd5f/b8F1+UoAYDCx9Tuqh0Vb
TLSH
T1AFB2DB2B604DC77F9F801AADAC196FD67D9802C797588D4047FE990C03C77EB912A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 692b983e861154ff67bb9925de20c1ee7c6a5ec9017cd9005e6380b48a08afbe
MD5 d53e362ca4810b346184acdaddae81e1
SHA1 c61a1a32df51d28960b8e28c9383ac73b7b455e9
SHA512 bcfde202686d95723511d640f9c00a2dbca826f44587682f85d69270322b80a018d5d495d08e7c5423e6f8e71ed9dd04e16599140f31ea64b2c78a75c85b2cfd
SSDEEP 24:KSiFEiNi4iaPifSiMiIir1i4iHDiaI4iUirKXikhPiGir1RiCi7SriV5iwJiIiY3:K8SI/Kzq43ypCI/KPK8nCI/KDSAHyVz
TLSH
T12C914212717E465138BE2909D165C557C6C2B0F732A8E82B3BE815B64B6EF430DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3e62.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3e62.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 cef725d9cf089308fe36f58ccce6a876348c9b1acce39bfd8b17f91c3d9812e7
MD5 d01a89870106d20c4bdd7d4e4f6d5895
SHA1 91ebab5396aecda23ecb8b9c2f064f37180e1cc0
SHA512 3377ae7c5a0a8fec3713c13f08d23d5264e00008cb9211870c9c3b046b3a40cc48d05e9bd2d934b466f6cd1fd12291948775e7c72ce7b7e0ccddbbb24d10c81c
SSDEEP 768:Crv+4UNbdD3lLXq9LRLveAam6aQMGdjWca4Ghf9rf6:CbsbJ32wmaME6pri
TLSH
T173F2AF32A86C99739DF79695F21B7643BEB451A385C80A94C9DD6B0D03DB08E330BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 46baabcf7eda7a14850a03b2bf7871a0e8958b0807e48d3396fd508843bdf15c
MD5 33effa1b006a5856d486209b17e6169d
SHA1 d05293eada419e14f3df952d17de973c7c132d42
SHA512 b5830d752c7eb69f2317c08a84dad855aef1ddac76b3a67ad3f75ab2e22e392c3a0dbfb1556f14600ee12ea26726780632c1e5feade6bc3f515c9e9ca2b34ea9
SSDEEP 768:mo3DnXq9LRLveAam6aQMGdjWca4Ghf9rjX:mo3kwmaME6prL
TLSH
T13BE29E315C6888779CE7A295F72A2647BEF05263D5CC4E84C9ED6B0D07A718E2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 e992782db9c6a5dbed8bba1d30f55418da09c80bf711b9eddc2c5431a6bfb84b
MD5 0fa6d5d66d00e785e7a6c2d5dd6c30bd
SHA1 01d293f69b39cfa97820a3a346b0f3470ae74cfa
SHA512 b6588a1e645c8191f2d8c065ab84e59d3cad52a0f18e0d3a56d86ed7101347c5890f4e2e10ec29937ad88b9ee4ace5f51596316cf6a521dedf15867efe45cd1b
SSDEEP 768:/o3enXq9LRLveAam6aQMGdjWca4Ghf9rjX:/o3NwmaME6prL
TLSH
T179E29E316C6888779CE7A295F72A2643BEF09163C5CC4E84C9ED6B0D07A718E2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c1271970e8c360e6f33b4826842f71a2c4f1e6808db923c5cbc11908cdb11fa2
MD5 695efe8554a27641510fa7817602ba5b
SHA1 99d583029dab1d8de0a55ffa8d43a7c88b0aa9ca
SHA512 6ad5b7c4387f152299829b98e473100c5829c4f884d912847ee672f991aa7e309cfb0d61f75aea665dccd77338bc32af9925045633cf52fc163cf09eaa69a58c
SSDEEP 768:DPFQu3ewgfnXq9LRLDAam6aQMGdjWca4Ghf9rjX:DSu3ZmaME6prL
TLSH
T191E29E325C98C47B9CE79B95F72E3643BEF051A3C5D89A94D6DC6A0D02A708E2307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 2b796e78fd731b8437d15c9b4ec61b4cc25911755fce7e927c9e86a77cd53c7e
MD5 0c9f787de987012dc117f05b2c22fac3
SHA1 daf9f12a3173e0f500817fff02223cefc2a95974
SHA512 78c5e7f5e4d4abbdf5cae514c249f12d2d92abd8058b37b1b814c672b5e8d0bc3a670777ed844912db6e2e1a51d4f3586e17f450e371a148d17f92150416b41b
SSDEEP 768:/rv+4UNbdq3gXq9LtAAam6aQMGdjWca4GhfB7PeU/:/bsbc3tKmaME6pDH
TLSH
T1BAF2AE31A86C9573DDB79A99F21B6787BEF421A384D40A80D9D92B0D439748E3307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download