89de0d0bfd09bae6221a0639d04c61d15daf0db9c5415ace4fb6913f28096425

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
application/views/admin/view_header.html
Size 13KB
Sample260730-pg1hdaxcjc
SHA256 89de0d0bfd09bae6221a0639d04c61d15daf0db9c5415ace4fb6913f28096425
MD5 c7ff7f9f037d7820dd2bcb69c9be4019
SHA1 b21a09e5d056eae66f06f592541c1fa8fece7f9d
SHA512 67c2d4f7aa6d46ca6a37239e5bc4fbf89d9cb86927b6f27fc81150a83acb84ab9c994a423c74cdebad76cdb86de5bdf64853c8140521765ef0ec87b5621599df
SSDEEP 384:hZ5K2Ls3WoTLCfELdf1LBfILHfYLLfELEfWLFfi:fE
TLSH
T18C529B04375EA12741CA96D74439B6A4B5FFDE3FA2222841707F12F72B82AD53C0E967
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5264	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298875773360974"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{997AF79A-3885-4834-874B-AE6C120C4D8A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 4740	4100	msedge.exe	89
PID 4100 wrote to memory of 5264	4100	msedge.exe	90
PID 4100 wrote to memory of 2760	4100	msedge.exe	92
PID 4100 wrote to memory of 2916	4100	msedge.exe	91
PID 4100 wrote to memory of 2760	4100	msedge.exe	92
PID 4100 wrote to memory of 2916	4100	msedge.exe	91
PID 4100 wrote to memory of 2916	4100	msedge.exe	91
PID 4100 wrote to memory of 2288	4100	msedge.exe	94
PID 4100 wrote to memory of 2288	4100	msedge.exe	94
PID 4100 wrote to memory of 2288	4100	msedge.exe	94
PID 4100 wrote to memory of 3768	4100	msedge.exe	95
PID 4100 wrote to memory of 3768	4100	msedge.exe	95
PID 4100 wrote to memory of 3768	4100	msedge.exe	95
PID 4100 wrote to memory of 5956	4100	msedge.exe	96
PID 4100 wrote to memory of 5956	4100	msedge.exe	96
PID 4100 wrote to memory of 5956	4100	msedge.exe	96
PID 4100 wrote to memory of 4852	4100	msedge.exe	97
PID 4100 wrote to memory of 4852	4100	msedge.exe	97
PID 4100 wrote to memory of 4852	4100	msedge.exe	97
PID 4100 wrote to memory of 1436	4100	msedge.exe	99
PID 4100 wrote to memory of 1772	4100	msedge.exe	100
PID 4100 wrote to memory of 1436	4100	msedge.exe	99
PID 4100 wrote to memory of 1772	4100	msedge.exe	100
PID 4100 wrote to memory of 2820	4100	msedge.exe	102
PID 4100 wrote to memory of 6136	4100	msedge.exe	106
PID 4100 wrote to memory of 1924	4100	msedge.exe	107
PID 4100 wrote to memory of 708	4100	msedge.exe	108
PID 4100 wrote to memory of 5556	4100	msedge.exe	109
PID 4100 wrote to memory of 5556	4100	msedge.exe	109
PID 4100 wrote to memory of 1844	4100	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\application\views\admin\view_header.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff80678c188,0x7ff80678c194,0x7ff80678c1a0
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,8109427596633416166,6802106881416772166,524288 --field-trial-handle=2316,i,11350322959997194487,11081171609344423864,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,3417267762988655823,17388065164625695089,262144 --field-trial-handle=2316,i,11350322959997194487,11081171609344423864,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,1410220643898411441,2532929173445494351,524288 --field-trial-handle=2316,i,11350322959997194487,11081171609344423864,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:13
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,596670557895540661,2333766681779524274,2097152 --field-trial-handle=2316,i,11350322959997194487,11081171609344423864,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,14359565121302131003,3975358460006726381,2097152 --field-trial-handle=2316,i,11350322959997194487,11081171609344423864,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,14678883993734468443,3921889682918230333,2097152 --field-trial-handle=2316,i,11350322959997194487,11081171609344423864,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,766405922511751227,9782195207298250721,2097152 --field-trial-handle=2316,i,11350322959997194487,11081171609344423864,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:9
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,17630686645526902321,15928164590889209373,524288 --field-trial-handle=2316,i,11350322959997194487,11081171609344423864,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,704532469469572336,13692438497597785182,524288 --field-trial-handle=2316,i,11350322959997194487,11081171609344423864,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,765581564414296806,10860578036565217731,524288 --field-trial-handle=2316,i,11350322959997194487,11081171609344423864,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,765581564414296806,10860578036565217731,524288 --field-trial-handle=2316,i,11350322959997194487,11081171609344423864,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,7295398093134882661,13269353962770438906,524288 --field-trial-handle=2316,i,11350322959997194487,11081171609344423864,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,2348038573985106207,5091763283530687645,524288 --field-trial-handle=2316,i,11350322959997194487,11081171609344423864,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,3814832055988638238,4236909261938878181,524288 --field-trial-handle=2316,i,11350322959997194487,11081171609344423864,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,14225031300023975928,2327436252397447054,524288 --field-trial-handle=2316,i,11350322959997194487,11081171609344423864,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3844,i,18196508045667267605,1129078617995338439,262144 --field-trial-handle=2316,i,11350322959997194487,11081171609344423864,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 671688d8d6ce542033b054565bd0a9c3e3e82c9e3232b0811728c268776a96f1
MD5 e73243750f19d1522befa6ff2cb0dedc
SHA1 ca9f68e47a60598c7954e04329bb82639fadc9ba
SHA512 44033b02079b44a4557e5a81e74597a823f4b05e8212e4564f8163ba46739eb4950e1d4d4ecc260536c97cfab118a195ced5471e346064f2463b2961f677c676
TLSH
T13351080423E718F1E72D517250F0559832F482798D07BB81D05F6F3CCAA2F3491E82A7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bced.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bced.TMP
Size 2KB
SHA256 bd122b42d4c4e308c5787374b97d6067625d244d92d8b28d7ffac037eee84074
MD5 a8ee6e4299e667ddbfa0bf77ce18d0e4
SHA1 a39dd6f2d9d20397a68711651ce67bb06aa32066
SHA512 b6e16a046bd4eda597a6fdfb656613a2aa5d65edacc0ce178ae29c7c85dbaf0e8a4cf2c1217fa542da5a4a81178aee237181c6aa84810f8e0bc2ccc09a69fe13
TLSH
T1A151E71463E718F1E72DA17254F0599832F486798D07BB81D05F6F3CCAA2F3491E82A7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

516e8960-1cee-4d0b-b6ec-bb26a99eea94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\516e8960-1cee-4d0b-b6ec-bb26a99eea94.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 db0664edb370445f4dd570df16331b2c830e6cca51c6a50b14187dade09b5ab4
MD5 ce948ba49f68f07d7b2101fbb3e0a99b
SHA1 22ecbea2b036cb11f7026d6a732ff5e29a908edc
SHA512 d2195b21cd060afdc9c3203a0400653635c7dbcacf08d08302df9045212fe93b65da667656f9db230bdb6a4d4cf5fefc4568cf414738b4852fd67b2778abd74c
TLSH
T12541CCF3C3E4966E890146F0AB186E1BCE1C0915832C3D5AC9E4AF1BA3E34B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ec5361887996e8dbba33a174c99893b4d11297a349494b4ebcbd6f2327f0e394
MD5 34a9a1f59d8741d60b9d2addb7567729
SHA1 db5916bbdc5be3cadf1cb47a9dd1910f5d0b2ca7
SHA512 16049bc1819dfc16519d754af9c000ede49ded9409884036743e0e241cb07b5328f8e69d2b4be2f66d1583ad057d5b0da81cf81d32e2b04dc1642b9dc9fb2018
SSDEEP 192:sxRCRUbz/f2sbKKCA94/+KzoA8p4M/g6+WNIYD986SkG/DIgIJ:sxRCsz/f2sbKZ8FHV/5ISSDs
TLSH
T19132A7166A28AD3B9CCBE21DBB55BF53D6F95032A1D01E48A7FC960C04EA6DD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cab0410e672209f18d76085a5519ce7fd9a1ad3c20c064f30b8a76bee602bc25
MD5 0f2b8de82928a7cb184e6f815d522a56
SHA1 f7593746ccc16617be7527b0fe435a5bbff3e31f
SHA512 440791ce55f8e1ca233024968d34d5446cc35903676cc8b3e68c533d77205cd8451dc7ca3910ca965288040dcf131d2a559851037d883d8d1bbcb9152804c621
SSDEEP 192:sxRpRUbz/f2sOKKCA94/+KzoA8p4M/g6+WNIYD986SkG/DIgDsJ:sxRpsz/f2sOKZ8FHV/5ISSDU
TLSH
T1AC32A8166A289D3B5CCBD21DBB55BF53E6F95032A1D01E48A7FC960C04EA7DD130741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8bb39432103444402d61b23f5879657d9a4f1fdd064b29a788b274c8f50f7c36
MD5 1b6bd0adb687f08cfd4727a1daa2b013
SHA1 b9e4accf61b62f3bc45e3d66aa0311a7a61f1164
SHA512 05e914a23fe228a759ffd9a91e22f44ed032ce57d7ebcc955fda0d34d0680e658d0a667343b4287c125dee82fc8aa6e45412bb611feedb4dee76f5c5fb5efa1c
SSDEEP 192:sxRpRUbz/f2sO/KCA94/+KzoA8p4M/g6+WNIYD9s6SkG/DIgDOJ:sxRpsz/f2sO/Z8FHV/5IcSDu
TLSH
T17B32A7166A289D3B9CCBE21DBB55BF53E6F95032A1901E48A7FC960C04E67DE230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 244fbd92666039e40ec6b8e5076ea4a0e2b6aafa07e069328874aaadc2758bd2
MD5 256b4c5cc2ad06c6bc7851f2ae3f5c0d
SHA1 dca32ea8a9e4b7863336af65298fc62dcd54812f
SHA512 37cdb912066013c8ba5bd825ad75303d3dc6bdccd260cc61fbdf8a44af805db9be6441d6a727d9739502f4e56b11c6b73f1d29ccde1d32bbf3c62776a668bbdf
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRcIropDZ:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0Vf
TLSH
T10FB2EA2F200DCB7F5F800AADAD196FD76D9802C79B588D5047FE990C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 fec4b47b1a3419a97700274f35b5f454cf4cf6c5ee0c60cf68ebb08e3158fab6
MD5 dd70d414fd71c4463f0cf2d5fa3322de
SHA1 c63e24308d1ad34af9e24dec6bfc9b9470cd52e8
SHA512 6389c4a0a965bab2e60c49d21cc65d87df02962df3c7e748b659a13d0ef68813667b02085a7d7af22ba362c30b7eafe8b1d5eb8012b7bff6917ecc619f8f784e
TLSH
T1EB513E02743E074138BD690D84668D6ED6D2B0A2316DA42B7BA811B31B6BE125EFC9D9
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a569d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a569d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 866dedb5a1aa1b3a0eeb3e522c53a4c2f56c0758f9b164268bd0f2d643478bce
MD5 f2a7f890d255d2cde4b6eaba21d4db93
SHA1 89183e0b1098ad2322bbf9fa4db98f8b488e0436
SHA512 bc14c50230eb034bc005d480d17ad201c286fe3415c1abba5d0a3bc953a1f40e062cea5b2fe8e5620db98c177e9ff014927d1a7e0d690c4e6b7b1e73f928ad5d
SSDEEP 384:WZcI438NkZQgYdHutl84WZlf8hyEGoH77jaF3y2rEoajo4cdR8eHhVODjYPNDUMV:E43cgYdw8Zi0KqrEnjN3Gac1F2b9MN
TLSH
T147F2BF356D648EB38CEBE382B1473B02AEF55663C6D80BD495DDBB0C05979AC430B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 304e9d42f21db085fd4fe5af526992bc9ba4b78539c339de4a26388477066dbd
MD5 91a440b702a4d2fb78ef5164806c088a
SHA1 a17fe7a2eba89518b7e227427bd0c432a36e692c
SHA512 7563aa95efa478cb17dbc09d727ad7b4d45f6e553c3a1f2e6e713e773e402bfe85ddaf8f4ec3817a9f3e9b4d82c2b181efc912376bc741ed02561f17b58f6780
SSDEEP 768:Frv+4UNbdn3/gYdg8Zi0K8rEnjN3Gac1F2R:FbsbF3/g231QnjMaFR
TLSH
T14703BE31A9A88EB38DE7D281B1477A037FB4565386C50BA4CAC97B0C169B5EC130BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 92d12d083c8996e33337d180665940cd9be9e8323f53ae5164f501f481d0e283
MD5 4977a342887f791a7a50dc8516d0bba9
SHA1 f93fc7b734b2ccaa9fa52878f0793183f3e03845
SHA512 dd6fd89eaecb65e5cc5757788e4659b4886ff5fd0a969ec1f2805cd28d84d33f750cb0a686b8af3541922a088a8ee72c582913b84cb7c4fbb30a64d942cc1324
SSDEEP 768:dFQA3jwgAgYdw8Zi0K7rEnjN3Gac1F2b9MN:sA3ag2H0QnjMaFb+N
TLSH
T1F603AF726D94CEB79DFBD782B5463602AEF142A3C5D48AE4D6CCBA0C15975EC030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e8afb4768bb9b41c2df8869c90695e084e655f928c18c1cb32d8934182ca5a4c
MD5 47b1404b8796c2d5653f2356150c9b89
SHA1 606718ddad566bc92b0ea302ef5b9e9b061c4481
SHA512 0d839b9904c90b01d930d3020e6ba6be9a776f7492755f3be47d49807dbf7a349e2e955a0d7002ba20d0b018a03b3c6b139957d4bc56ddfeb2c283668506b8d6
SSDEEP 768:rrv+4UNbdS3zmi0KUrEnjN3Gac1ZmeVH1SCz:rbsbg3Y/QnjMapEH1V
TLSH
T18E03CF3669A88EB39CE7E385714776037FB4125385940BE0C6DD7B0D129B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b692d47d-3d1a-4593-90f6-0c64e3652260.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b692d47d-3d1a-4593-90f6-0c64e3652260.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download