34f1453d9d2bc915c8941a85d6c57f794daac895e174aac1609c3a5168016307

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
forshellAttachBCC/FILE/PHPMailer/docs/faq.html
Size 1KB
Sample260730-fx5ycsdk4v
SHA256 34f1453d9d2bc915c8941a85d6c57f794daac895e174aac1609c3a5168016307
MD5 dc17fa572db619e87e123cc5f0be3fb7
SHA1 f19074833e4b60ebb891252065b0a0680a87e847
SHA512 de4b2d64e2cd0811fa5cc9136a4da29c7df2fae2640278e7c301c0d2b59dd5fd002ae3304f476c65e06f3c38a869ec6dddab3c9b1eb0d3f447eaaec4934cdf15
TLSH
T14D31449BF79923551E6003602B5913A76B8970EEF50220E13DDEC1746B00A39AAF2DF4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1204	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298621754255848"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{92D7DDC0-0AF6-49A5-97CA-B40C3A6DBFE8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5832	msedge.exe
5832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 4960	1672	msedge.exe	89
PID 1672 wrote to memory of 1204	1672	msedge.exe	90
PID 1672 wrote to memory of 2240	1672	msedge.exe	91
PID 1672 wrote to memory of 2240	1672	msedge.exe	91
PID 1672 wrote to memory of 2240	1672	msedge.exe	91
PID 1672 wrote to memory of 3064	1672	msedge.exe	92
PID 1672 wrote to memory of 3064	1672	msedge.exe	92
PID 1672 wrote to memory of 204	1672	msedge.exe	94
PID 1672 wrote to memory of 204	1672	msedge.exe	94
PID 1672 wrote to memory of 204	1672	msedge.exe	94
PID 1672 wrote to memory of 256	1672	msedge.exe	95
PID 1672 wrote to memory of 256	1672	msedge.exe	95
PID 1672 wrote to memory of 256	1672	msedge.exe	95
PID 1672 wrote to memory of 1220	1672	msedge.exe	96
PID 1672 wrote to memory of 1220	1672	msedge.exe	96
PID 1672 wrote to memory of 1220	1672	msedge.exe	96
PID 1672 wrote to memory of 2092	1672	msedge.exe	97
PID 1672 wrote to memory of 2092	1672	msedge.exe	97
PID 1672 wrote to memory of 2092	1672	msedge.exe	97
PID 1672 wrote to memory of 4836	1672	msedge.exe	99
PID 1672 wrote to memory of 4836	1672	msedge.exe	99
PID 1672 wrote to memory of 5852	1672	msedge.exe	100
PID 1672 wrote to memory of 5852	1672	msedge.exe	100
PID 1672 wrote to memory of 5960	1672	msedge.exe	102
PID 1672 wrote to memory of 3796	1672	msedge.exe	106
PID 1672 wrote to memory of 3212	1672	msedge.exe	107
PID 1672 wrote to memory of 3216	1672	msedge.exe	108
PID 1672 wrote to memory of 4272	1672	msedge.exe	109
PID 1672 wrote to memory of 4272	1672	msedge.exe	109
PID 1672 wrote to memory of 5832	1672	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\forshellAttachBCC\FILE\PHPMailer\docs\faq.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x234,0x7fffc098c188,0x7fffc098c194,0x7fffc098c1a0
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,16806657859614167586,113887507786141209,524288 --field-trial-handle=2196,i,14908291595897472173,1154949201954271617,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,3883005304721806335,1748488204168616864,262144 --field-trial-handle=2196,i,14908291595897472173,1154949201954271617,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,6804276794310039000,14722253845709420300,524288 --field-trial-handle=2196,i,14908291595897472173,1154949201954271617,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:13
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,4532027843255224010,57652858657903768,2097152 --field-trial-handle=2196,i,14908291595897472173,1154949201954271617,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,701971505729926156,18420286731660946624,2097152 --field-trial-handle=2196,i,14908291595897472173,1154949201954271617,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,16588920819529299641,12466591582769699219,2097152 --field-trial-handle=2196,i,14908291595897472173,1154949201954271617,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,11876793393705277830,10983132973963112487,2097152 --field-trial-handle=2196,i,14908291595897472173,1154949201954271617,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:9
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,921930237563818388,15725761346729044159,524288 --field-trial-handle=2196,i,14908291595897472173,1154949201954271617,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,6753321832025185980,14503690799428094116,524288 --field-trial-handle=2196,i,14908291595897472173,1154949201954271617,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,16930684144107896958,3496950768004154067,524288 --field-trial-handle=2196,i,14908291595897472173,1154949201954271617,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,16930684144107896958,3496950768004154067,524288 --field-trial-handle=2196,i,14908291595897472173,1154949201954271617,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,16115806338368751919,14340859436329780600,524288 --field-trial-handle=2196,i,14908291595897472173,1154949201954271617,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,18020965092267742686,9025942232551100206,524288 --field-trial-handle=2196,i,14908291595897472173,1154949201954271617,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,2763609475060074176,2848305715854789465,524288 --field-trial-handle=2196,i,14908291595897472173,1154949201954271617,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,7453735309191264389,8568130023458400622,524288 --field-trial-handle=2196,i,14908291595897472173,1154949201954271617,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5360,i,5642237431873914709,17873139492438236083,262144 --field-trial-handle=2196,i,14908291595897472173,1154949201954271617,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

4bbadfeb-0787-4245-8d24-9e33fbacb7d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4bbadfeb-0787-4245-8d24-9e33fbacb7d9.tmp
Size 13KB
SHA256 a9a368175b19e806226e18fa9cb00aa57f03bc00e9f86472e8b05c7f23cd87e3
MD5 988d23b5acf0a981a9370cbbd92cccc6
SHA1 619f8150532941369dfbe0532e580af1b3cf9429
SHA512 01cee4a8236fae503b7b8ca1ed43fe275b301ceb8fe80cfde30c0561254d31de90d1a72d24aec014c3e6576b8071dd2cea3fc6ecad3ec08c1afa074ece961ba2
SSDEEP 192:sxRpRayM/jK1Ml8wbH/fOs0OqtHm2Sm7a65zoD8p4s/g6+WNIY3BLCG4IgIJ:sxRpElH/fOs0vt2I1/5IAys
TLSH
T11552D9156624997BCCDBD20DFA517F53D6F95573A2901E48AAFCCA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9ec222456e94991030ae6e817092d7bb12503f290eb540f876d285852eb7bcb2
MD5 66a3a54d213bff657771b185211191f0
SHA1 121196e30236266e552c56bd1e1e5c5afeced713
SHA512 ca655aa68218b339960699560a22c8de4af0dcb663aed79e5da802729ff97dcdd9adfb3fcbd0234874415ee70b0c14b1e2eae403a23c4661e22c2b4c78b2f516
TLSH
T1F3510B6947A32BD2EB249B72B2D094A937FDBDA80A0B1F6054D27F38480FF2821C1113
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5989d7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5989d7.TMP
Size 2KB
SHA256 310322aef7aefce75e35d7b78bb133393abb6501adabbbd301bb0f62fa054cd4
MD5 9f179ba467a0ad9f940a58fb94eb3dba
SHA1 9741fd4001e8b4232847ad0aa9c5ac09155c96da
SHA512 b5bb62694ef4b2e1ab912bc974ce8421a25defe5fe0fb07eb0dbfe9fb5db6324756a0ca3b9a37691a8bbe243bbebab505f37128af3438ee9eb89af088c441f51
TLSH
T1AE511C6847A32BD2E7245B72B6D084EA37FDBDA80A0B1F6044D27F38480FF2861C1013
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2b4fcca634d19c847ec98b31446d05ee7858120e70ddf99295875b8458290c8c
MD5 bbadf9a4c2ec014e26b84aa3513a7a1a
SHA1 603ca1df88048208dbf40cec36df38cfaa7c979d
SHA512 c29a285be611ba03f9e96432ef9a1dd15153eaed10ccdf37e6ccdcaf7737a9001d4cef8c8cc58504b86f61824ae471b786b319313922105e332f3cc1b9deaf0e
TLSH
T122419EF7C3E4856E890156F0AB146E1BCE1D0915832C7D5AC9D4EF1BA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dad8b62b57407f41704109a607c1d1ee0fbd6452323058feed2842e339a4da3e
MD5 33cf50f3a5cdef19ab7b5a50010d1066
SHA1 fc3f68f5cf18a91bba679ebf34bc2af0f5ffd29f
SHA512 e7fe58d1d2ed5367f67cd5d5fa8adffc2620966f0a671e305d5c6ebf0cdf1d0ee860c1575a00cb656bb6d30891ef2de4be84c57a3abe32b74717839b177709e3
SSDEEP 192:sxRSRayM/jK1Ml8UQKbH/fOshOqkHm2Sm7a65zoD8pes/g6+WNIY31CG4IgDsJ:sxRSEq8H/fOshvk2I//5IJk
TLSH
T13862EA16A624997BCCDBD209FA517F53D6F95573A2901E48AAFCCB0C00E6BED121381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2d00fcaf1906b9f250c80d868ff0fce5d4e564668943a45225ed5a03f28b07ac
MD5 bf6741d78d0dc52b8f5e3e3d5cafa3ca
SHA1 0326d1a735100c8ca745c68b31c377f2859977a7
SHA512 f4a6b70a8ee5e9d9ab6d65f11fae697b9a46a4082d86d05066ba12bac66105db17c4658b86b449b84d2591dfb2fc7d7b22d89de33506ea21a4572ae18a3a1ca8
SSDEEP 192:sxRSRayM/jK1Ml8wbH/fOshOqtHm2Sm7a65zoD8p4s/g6+WNIY3BLCG4IgDWJ:sxRSElH/fOshvt2I1/5IAyW
TLSH
T10752EA15A624997BCCDBD209FA517F53D6F91573A2901E48AAFC8B0C00E6BED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9867a18203b9af57576d16a75f72ddac8e564286b48c9ed67915a8c438ad026a
MD5 05ac59205dc5712e1594337db72afa6e
SHA1 d1a8b600d7996cdb142d4a4aefbcfe1993dac2eb
SHA512 de6e30c27f1cef1112b9b961ce7d3f22e9a770af8da397350849b85a276be69d8f010c1d05a65d7772e8f2fe1033b652c026fb17b733bec7a76dbaa5a1b4372b
SSDEEP 768:GiqbvkWg0CfDs8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+MW63roZniO:GiqbvkWg0CfDsu1jaDF6kZiO
TLSH
T1AEC20B3B240CC77E4F804EADEC2AAED76D9801CB9B588D5447EA890C03C67FB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 063d3f4f210bd632534c12e81297e13f9be48e9033502c152c04bdd20fef4e77
MD5 7017c1583fe7d221a6f9066b192e919a
SHA1 3a5e0a53e30a9e1fddfac7ff14615668e00846ca
SHA512 55f6c00f40d537474f5690806e7bd8b1ab11a911dcb1b8588b0be9d2d9ad7a65e32072902609920af9a5cc6582f822aab94d1073b6f06e0a33e516db147b80c3
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHT8ZNbRRtWFKAg1tK4MgbtcjbylxWHYp8V:C1i7PF/DWrwfX9mgpct1o7zsHT8ZNbRo
TLSH
T1CB912455303B0340393EAA1CD4F9982ED6C2B8A3305CB56B7BA915A60F67E038DFD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 59fa486aa3a1398d6429d8aeb5661d532fb2c3293bb76a6aa6e4d47f2584f6c2
MD5 ecc77ac03c558f8f24b4f0600d0836e5
SHA1 cd23f5f17abe1b1def656db189203f7d182d9c4b
SHA512 b0cdaeba7ec87d91863a7aa99af339a05ae6478666be654165f9fd7c36bcea73d0785c595693a3d53fdef52dda6d02799341d1d52b99609b918b2619ccf9d6ad
SSDEEP 768:Hk3HIdc+wfZOifr66Sf766OvShCQRGU9b9MGM:Hk3Qwfhf+6Sfu6OvSSU9b+GM
TLSH
T1B1F2CF71DC744E739DD6935476463B12BEE56233CAC89B88E5DD8B0C01C37AE2B1B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 25393a3494878a4346078aa1c3274bdb092aa82c8736f11bff3a7b423daf35e0
MD5 911668e06d707f1299d16edcc06afd68
SHA1 9ef2ae2c70f084c926d816a6278a867ea9823e8e
SHA512 ee80a0c63bf784ff40acc1407faa5835a105dab64fd9294b443c463fa1f2b6a1982b91b4b026e291e2dd50ab25390d43bb04e2d7a16a16ad8f365f072c7eaca0
SSDEEP 768:EFQm3xwgtIdc+wfZOifr66Sf766GvShCQRGU9b9MGM:nm3Kwfhf+6Sfu6GvSSU9b+GM
TLSH
T1C003BF72DCA48A73EDE68754B74A3712FEE55273C9C8D688E6DD9A0C01832DE170BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f8ebbeb3aa2cf0364b009501a3c736e9017e58c1f41053907dd363199888e4cd
MD5 991771ffc816b65d8d879d49c58ddcfd
SHA1 26deebe4569cd84c270f232e19979865de324603
SHA512 e60d61a3251288176ed14b8b948762ebd35e919f508abb6439871c0c51cbbe404ed0df5e896ba2023a1e3e52baa92e7b2fa639fa35923b76a9a89297ecead658
SSDEEP 768:Drv+4UNbdv3cIdc+wfZOifr66Sf766OvShCQRGU9b9MGn:Dbsb93Lwfhf+6Sfu6OvSSU9b+Gn
TLSH
T1DF13C071EC789E739DE3825472477A23BEE56263C9C84B88D6DD5B0C01C36EE271B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f2b065eb7daebaf6690bc41bd803c1d18a006ac4d5b14157a0620cddeba1b641
MD5 f7f86e768f4c889fc59924052bac8ed6
SHA1 ada34f8441d7a9983429db0dd4c5beae3720e265
SHA512 7cc70a56c7e261252cbc23050f0318a934f65fd1e250819c7ded995721ee4cbd5945ba8605d54f0efac1e2e52df0061ab69144305d17b126f06443617ed9e19e
SSDEEP 768:5k3+Idc+wfZOifr66Sf766OvShCQRGU9b9MGM:5k3xwfhf+6Sfu6OvSSU9b+GM
TLSH
T14BF2CF71DC744E739DD6835476463B12BEE56233CAC89B88D5DD8B0C01C37AE2B1B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d32c93060a3f4b2e77053ecf1e50c2cb2c8ee3f010df91c290c433070aec7a96
MD5 1feaaeffb2fe837785e13fa5f4c79047
SHA1 0189b228b9d3c4d40c58585c34cd247f28383dd4
SHA512 cb62e7b997029d338e6c09087e07bf082a6cde04ee494fdbbf6262f0e824d38123c0bcccf2a3fe4be4096f578db9c4cade2666b177c4810351d039476a84a23b
SSDEEP 768:Rrv+4UNbd43dIkc+wfZOifr66tvShCQtZ2bwWV:RbsbO3dNwfhf+6tvSl0wO
TLSH
T16303CF72E9689A339EE782487646BB63BEB85173C8C54784D6CD0B0D018369F371BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c57d563-d742-4b08-8fce-9757ad7cf76c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6c57d563-d742-4b08-8fce-9757ad7cf76c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download