68f75ad8ef9ca73435ded81d9cfb241fb9ad97ba557a026886dd0efb2f0afe48

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rbUQofKzjJ3AV9jgFrwU.html
Size 10KB
Sample260730-pss8fa11gz
SHA256 68f75ad8ef9ca73435ded81d9cfb241fb9ad97ba557a026886dd0efb2f0afe48
MD5 18329496e0fd5a53cad217121e8ac581
SHA1 d160e1867f0a00f7119caeccfa8690a07c3f7b46
SHA512 aac2ca8badf64056dd6a4a78fcbc2bf5635e58febc5d7b1a934547dc870986d83b064b8b31a09c812d3ef268eb461986ecf1de7a029b71889b86f0cc477e8c49
SSDEEP 192:vr3IGkJTCEbGkWt11qH7tHwAD+oZk6UQMkc9CBMfj/w85w+Rw9iDUI+aa8Ta0lcj:vr3I34lr4sT8bOJtE+nx/a
TLSH
T19622306B56A30110AA63A5983BFB530D2272C007D50BCD4C3BDD6748CF96DDA99D3BE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4128	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298889073368780"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{7183D1DB-60A6-47F0-97F1-E94CEDCBD2A3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5188	msedge.exe
5188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 4988	1836	msedge.exe	88
PID 1836 wrote to memory of 4128	1836	msedge.exe	90
PID 1836 wrote to memory of 3000	1836	msedge.exe	91
PID 1836 wrote to memory of 3000	1836	msedge.exe	91
PID 1836 wrote to memory of 5832	1836	msedge.exe	92
PID 1836 wrote to memory of 5832	1836	msedge.exe	92
PID 1836 wrote to memory of 5832	1836	msedge.exe	92
PID 1836 wrote to memory of 4408	1836	msedge.exe	93
PID 1836 wrote to memory of 3192	1836	msedge.exe	94
PID 1836 wrote to memory of 4408	1836	msedge.exe	93
PID 1836 wrote to memory of 4408	1836	msedge.exe	93
PID 1836 wrote to memory of 3192	1836	msedge.exe	94
PID 1836 wrote to memory of 3192	1836	msedge.exe	94
PID 1836 wrote to memory of 3548	1836	msedge.exe	95
PID 1836 wrote to memory of 3548	1836	msedge.exe	95
PID 1836 wrote to memory of 3548	1836	msedge.exe	95
PID 1836 wrote to memory of 840	1836	msedge.exe	96
PID 1836 wrote to memory of 840	1836	msedge.exe	96
PID 1836 wrote to memory of 840	1836	msedge.exe	96
PID 1836 wrote to memory of 4608	1836	msedge.exe	97
PID 1836 wrote to memory of 4608	1836	msedge.exe	97
PID 1836 wrote to memory of 4608	1836	msedge.exe	97
PID 1836 wrote to memory of 5392	1836	msedge.exe	100
PID 1836 wrote to memory of 6040	1836	msedge.exe	99
PID 1836 wrote to memory of 5392	1836	msedge.exe	100
PID 1836 wrote to memory of 6040	1836	msedge.exe	99
PID 1836 wrote to memory of 1936	1836	msedge.exe	102
PID 1836 wrote to memory of 1256	1836	msedge.exe	106
PID 1836 wrote to memory of 236	1836	msedge.exe	107
PID 1836 wrote to memory of 6076	1836	msedge.exe	108
PID 1836 wrote to memory of 1140	1836	msedge.exe	109
PID 1836 wrote to memory of 1140	1836	msedge.exe	109
PID 1836 wrote to memory of 5188	1836	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\rbUQofKzjJ3AV9jgFrwU.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x288,0x7ffc2642c188,0x7ffc2642c194,0x7ffc2642c1a0
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,5864036083138433689,5625066835964940655,524288 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,3110736254222196913,92900632958721126,524288 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:13
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,8452561783081532940,9939431467346564125,262144 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,17914891518892132415,5591490214358590788,2097152 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,8092543769574793164,15596811205672991167,2097152 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,11993789136730135419,8150432177155367563,2097152 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:9
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,4184306675006466670,2913242561818565123,2097152 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3636,i,5859853261470458943,17992055126075643033,2097152 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,9154532747929194281,11701871535267600009,524288 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,395870466620691821,15410532074225315202,524288 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,13125624505675003044,6518657718650624425,524288 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,13125624505675003044,6518657718650624425,524288 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,9814072600401723188,6856930388851958159,524288 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,18087661671901488010,7330181017284968502,524288 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,17710697982925352604,12093129729144124530,524288 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,6941386705673431474,1308811443972832823,524288 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=816,i,2721315881922742901,1986869183631103704,262144 --field-trial-handle=2328,i,15889121153648911115,10765043539877522362,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 955d51b4d9e7fdfa756c8f7f345880185cc3d70c0a0f49ca3942d06c96eab4e7
MD5 c52c0de3c64ce406bd43d4d720572500
SHA1 e376b303076a6e7966f6bbb3d3fca390ad075942
SHA512 13f8429af818b6e1c44c6305ba1abd0adc82d9f22bfe66b9558283467924d6ecc62f1919e9b4830682eed4db484a8e4708fe5f3f1057f1fe6aa8c21a9fb71e37
TLSH
T13F41A956B37395C1DF244F71E0E1D0A97FB58469CE13EEBC5A91A178C982734A0E1A30
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a226e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a226e.TMP
Size 2KB
SHA256 6462573dec7b4f47bfd186fe8b9e1eb4d42166af754d19226216d4081f89d57b
MD5 ea28c8ca4255418835bf725c6ee68c14
SHA1 80a5916c3f6a286a0cc0b99e2893d0be34dde645
SHA512 a75c8f6a9618d8af8660c4e1b273fe138dad2986db75662764d680facf12f077d0e56e7e0e121887803260d66447f65a9ffe0e039ab7240ff5f6527de34e29ce
TLSH
T16C41A756B77395C1DF244E72E0E1D0A97FB58469CE03EEBC5A91A178C882734A0E1B30
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 91eb3e505ead23130fa262c8def3330f9c10e160022e351c3deec8a178bd5c8e
MD5 fdbb3d7d828b768605266344a1c4042d
SHA1 d9080bd789f0d7b6e14be27cfa202aba7ddd4e5a
SHA512 49092d7beceb28b18e756bd8bdf5aa61336abcd075fcddf908f20d08fa5dcab2922c07b52a200d66bc149c2ea91ff6072b15f97594a6d3382c8cf66642543169
TLSH
T10B31C0F7C3E4957D890156F4AB146F1BCE2C0915831C3D5AC9E4AE1BA3E28B1E14095F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f5a5b72f4601040189ea611ff02b96e2c65dfb6a0108040da10be991f635b3a3
MD5 9ca9a7ca24508e1a8e5d8484773a4276
SHA1 72e0f5db46ed2b63ca74c5924f16076e429fe9af
SHA512 d242c5e9abbe09b0972ea1f5c3c9ad70d24148a2326af8228a3174eea231e15599796db159e62cc08a6dd10498e53f4f42ebc2895adfdf2b6d8524c5d8679d60
SSDEEP 192:sxRKRpbL/flsYvKCA94/LzoA8p4z/g6+WNIYD986S9G63IgIJ:sxRKXL/flsYvZ8D2/5ISSps
TLSH
T14D32B6166A28AD3B8CCBE21DFA55BF53D2F95032A1D05E48A7FC970C04EA6DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fef954cd806d9450e9197fec313ae250d9c11a871648b6dd6944367af1147c34
MD5 7d3ca75ee80e32ae5c90ed18c5241872
SHA1 d187be0ee97210e978280eb54a3f3cdd0673361f
SHA512 b7a7c9581e4ca36a45a692bc8016620f763bf3c941f3c91830dddd497b77ed01a972424303a4bb179b90abbec8e778d479adb44947f571e34ddd62f9177e8073
SSDEEP 192:sxR9RpbL/fls3vKCA94/LzoA8p4z/g6+WNIYD986S9G63IgDIJ:sxR9XL/fls3vZ8D2/5ISSpg
TLSH
T16432A5166A68AD3B8CCBE21DBA55BF53D2F95032A1D05E48A7FC970C04EA6DD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 7ff7aedb410f398d48a837fb101f1feba0ae64b48bbdc0a04b840fca5ea36b0d
MD5 6b44639fd1fdbc9e867749ab7b258ecc
SHA1 a984167226d345d59c53c927266c264bae71f214
SHA512 d760b2070e58984353940fb1961f63e0819949eb9de24dc83bd2a60e6127ee4ba74de3d85d7ec3ec3945493804b294a6ca47019d3f18cff177036d90c2af08d3
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRc+ropDz:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0Vb
TLSH
T15AB2EA2F600DCB7E5F800AADAD196FD77D9802C79B588D5047FE990C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a7dae2c5-d984-482a-b90a-96e4bbc7a7bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a7dae2c5-d984-482a-b90a-96e4bbc7a7bf.tmp
Size 11KB
SHA256 7d773f3c8e33751683ce29fd8949fede245c2692f566c8a87249fcec77e28d6f
MD5 86c47bc8ae6a3943221f5b59a67a907f
SHA1 635634230b648161559f647784347d34b7b7251c
SHA512 c1e70aa7d0332270b13fcadc821a0e1a5da7d3cc861fab3861ab449a2e46073cffdae43f5c20910f03e0217ddb2e9724ea735367b8660c4efe968003445c0dfe
SSDEEP 192:sxR9RpbL/fls32KCA94/LzoA8p4z/g6+WNIYD9s6S9G63IgDaJ:sxR9XL/fls32Z8D2/5IcSpq
TLSH
T1C332B6166A286D3B8CCBE21DBA55BF53E2F95032A1D05E48A7FC9B0C04E76DD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

830a8964-b84c-4a0c-8df0-b2b5710dbd12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\830a8964-b84c-4a0c-8df0-b2b5710dbd12.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2f63a3e72fabc96806c07b187800bb317a2ad2639650f2c21996f26f7f8e3044
MD5 97d14ae20f91739695394f56714d62d1
SHA1 51390acca1f7d7e5bf82228fbaa53c506afa423a
SHA512 193ec4c01876b2b8b2ee8e47b2fae9b806ec09a8599b041a24b8f534006eb2afa9adad5546f63573bc0b79826de86aadea694c8cf8460fcbebac0daebc05f2b4
SSDEEP 384:zZcI+38N+CeNOM09hWZlf8hyEGGzUCt3Dy2rEoajo4cdR8eHhVODjYPNDUMzkhOq:r+3bi2i0ct31rEnjN3Gac1FAb9Ma
TLSH
T1FEF2C0356D654DB38CEBE396B5833A037EE18363C7C80A9456DEB60D0597AAC5307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 76535fdc0e0d6aa73fd5faf17f089c2d4c04f54df0cba63a02baa6de5cec96f5
MD5 978eb58ba09abccf00f9a2495f197ae7
SHA1 785ec6f91c21f8cb51ca2d57c873c0a12f0581c0
SHA512 74d65d6eb823da9fbb78089fba23061dcc21e1eb42d4ba573cb0569af44b257fb0f17614deda77e335272135231e49f4c301dcb1063a08196510ff85605f3228
SSDEEP 768:Lrv+4UNbdB3sx2i0ct3hrEnjN3Gac1FAM:Lbsbv3s+WQnjMaDM
TLSH
T10903C03679688EB38CF7E286B5437A037EB45253C6C506A489DE6B0C45DB5ED230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b6bae1cacc15366ff0b51d7361e97876b50a6871a10223f9c67f1232845ffeaf
MD5 868c5b1c5146137051b493a5005a2254
SHA1 c42354f6980021371bb0790acd415ae738fa33e4
SHA512 95d5d16896a066957837aaff7fe9a0287094930ce96f9c5370ef9e1efdfadac6162ddc8ac133e9a44c92791038a32048189fe1d2923c6a513c3c18fef6e5e25d
SSDEEP 384:pZcI+38N+TeNOM09hWZlf8hyEGGzUCt3Dy2rEoajo4cdR8eHhVODjYPNDUMzkhOq:h+3si2i0ct31rEnjN3Gac1FAb9Ma
TLSH
T191F2C0357D654DB38CE7E396B5833A037EE18363C7C80A9456DEB60D0597AAC5307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 006b81cf7c218b95ee4598fb892b5d42e1ce73922b56224e4d7dfe3a82515bdb
MD5 65963c736830c5cd2de82d4fb416cb5a
SHA1 c03eb6d03834b5b0027c1287afde7abe63a1504f
SHA512 fea88c84d0aa1057cc4286ffdf441af97ee8f11af7dda447e967244284a27d00f8a0bf45af9dfc55234faa9c540f58fe75d1879bb601102d5a2337c0613f4d89
SSDEEP 768:BFQC35wgpi2i0ct3ArEnjN3Gac1FAb9Ma:QC3BJ5QnjMaDb+a
TLSH
T12B03BF326D948EB7DDFBD786F5463A03AEF14263C6D88694A7DDA90C05975EC030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a5f57f164da97e7388ff7377c8f3728332493aa08ee894a30aa6d1deda0e8386
MD5 112ba45072d3c022fcdb1270e8815118
SHA1 117e5b3cb4abcff14849dce749be728441a50652
SHA512 02fe069074e480799991df07e5e55766c2fcc31efbd0c364e4a4373484d6009d04436fd6070297ab2f49e16e1a42da7106fd5105cea380f1ad063d23ad89c780
SSDEEP 768:rrv+4UNbdS3bmi0lrEnjN3Gac1Z0eVH1SCz:rbsbg3glQnjMajEH1V
TLSH
T16F03CF3269A88E738CEBE38571877A037EF4525386C40BA0C9DD2B0D46DB5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d83249ce-e2be-4455-a0ff-65e122fa48bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d83249ce-e2be-4455-a0ff-65e122fa48bd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download