4f5fe2ab9eaaac5359e1418f960dc10ebe5d6d35a3ef3e51b604c83e16463fd8

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
disclamair.html
Size 690B
Sample260730-w448eavena
SHA256 4f5fe2ab9eaaac5359e1418f960dc10ebe5d6d35a3ef3e51b604c83e16463fd8
MD5 bbf89adc7c88b9ab1ae52949da2fb1b0
SHA1 0dc1c2bd43d455ead78c8cb3a5c4a5755fb02a9d
SHA512 f43f29abbe0028ce4d131f5654ca0cf3fe06678b6455eccc6842e86a1c9373cf9fb53a87201e2292b3c523e5aa2ddcbf2817d4db4280cb9cca6c8dc028cea2f8
TLSH
T19C01FEDECE914A317122D57CCAAF7788AA3310DB8240E902C5510DDC43A435AD3E7B9B
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5628	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299097797473566"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{4F7C6558-70E8-4D90-B3E6-B07889CA34C1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 3428	4936	msedge.exe	88
PID 4936 wrote to memory of 5628	4936	msedge.exe	90
PID 4936 wrote to memory of 4776	4936	msedge.exe	91
PID 4936 wrote to memory of 4776	4936	msedge.exe	91
PID 4936 wrote to memory of 4776	4936	msedge.exe	91
PID 4936 wrote to memory of 6096	4936	msedge.exe	92
PID 4936 wrote to memory of 6096	4936	msedge.exe	92
PID 4936 wrote to memory of 5040	4936	msedge.exe	95
PID 4936 wrote to memory of 4368	4936	msedge.exe	94
PID 4936 wrote to memory of 5040	4936	msedge.exe	95
PID 4936 wrote to memory of 5040	4936	msedge.exe	95
PID 4936 wrote to memory of 4368	4936	msedge.exe	94
PID 4936 wrote to memory of 4368	4936	msedge.exe	94
PID 4936 wrote to memory of 3692	4936	msedge.exe	96
PID 4936 wrote to memory of 1148	4936	msedge.exe	97
PID 4936 wrote to memory of 3692	4936	msedge.exe	96
PID 4936 wrote to memory of 3692	4936	msedge.exe	96
PID 4936 wrote to memory of 1148	4936	msedge.exe	97
PID 4936 wrote to memory of 1148	4936	msedge.exe	97
PID 4936 wrote to memory of 3028	4936	msedge.exe	99
PID 4936 wrote to memory of 2468	4936	msedge.exe	100
PID 4936 wrote to memory of 3028	4936	msedge.exe	99
PID 4936 wrote to memory of 2468	4936	msedge.exe	100
PID 4936 wrote to memory of 5200	4936	msedge.exe	102
PID 4936 wrote to memory of 4512	4936	msedge.exe	106
PID 4936 wrote to memory of 416	4936	msedge.exe	107
PID 4936 wrote to memory of 4972	4936	msedge.exe	108
PID 4936 wrote to memory of 4960	4936	msedge.exe	109
PID 4936 wrote to memory of 4960	4936	msedge.exe	109
PID 4936 wrote to memory of 3532	4936	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\disclamair.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffd019cc188,0x7ffd019cc194,0x7ffd019cc1a0
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,14381572576247633107,2140400857561093661,524288 --field-trial-handle=2544,i,3540731701309704732,519209506930643736,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,11178202497166876155,5169239085261059379,262144 --field-trial-handle=2544,i,3540731701309704732,519209506930643736,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:2
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,2141142045599592229,16272347812498205097,524288 --field-trial-handle=2544,i,3540731701309704732,519209506930643736,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:13
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,13855463892260719294,7307617114907086632,2097152 --field-trial-handle=2544,i,3540731701309704732,519209506930643736,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,7522526465100620543,2353654565803811247,2097152 --field-trial-handle=2544,i,3540731701309704732,519209506930643736,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,15151245319639502551,15108852980625186616,2097152 --field-trial-handle=2544,i,3540731701309704732,519209506930643736,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,6899604361083409223,5777639508185264888,2097152 --field-trial-handle=2544,i,3540731701309704732,519209506930643736,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:9
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4056,i,13513461377897861901,8588988701604693134,524288 --field-trial-handle=2544,i,3540731701309704732,519209506930643736,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4044,i,10862448885249830425,8058442204678632919,524288 --field-trial-handle=2544,i,3540731701309704732,519209506930643736,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:14
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,5598277468118907097,9124824449590543832,524288 --field-trial-handle=2544,i,3540731701309704732,519209506930643736,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,5598277468118907097,9124824449590543832,524288 --field-trial-handle=2544,i,3540731701309704732,519209506930643736,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,16333851874509135960,4970142036284489819,524288 --field-trial-handle=2544,i,3540731701309704732,519209506930643736,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,7774410295892563497,758388871390883968,524288 --field-trial-handle=2544,i,3540731701309704732,519209506930643736,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,11546014923587139628,13702244682342133579,524288 --field-trial-handle=2544,i,3540731701309704732,519209506930643736,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2868,i,1212831697310334630,4514510504500438789,524288 --field-trial-handle=2544,i,3540731701309704732,519209506930643736,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5816,i,17643974782969001067,4877692432381705924,262144 --field-trial-handle=2544,i,3540731701309704732,519209506930643736,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8e3412dd-3447-47bc-91df-abb68a1e9d6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8e3412dd-3447-47bc-91df-abb68a1e9d6b.tmp
Size 35KB
SHA256 48d6b9a3ab051edeef398387a1245d53e48c391ffcd4504751e10d51ce4a54c5
MD5 1c8bfc8a76237f272c67654eee85bf88
SHA1 c2df6eacae130129514ae3eeeba660b16694f865
SHA512 c8a6ceff5b885fe0316648f0fc27b9230d8dfbe56fdc5e5e9eae82eadc534b4c2ec0972ab65c2e8c580b5769f1f56d253cde430d34ab0b339242193d369760e0
SSDEEP 768:mL3NHUg/TBOWRZReONXyer1IRCzni96b9Mw:mL3treSIqnJb+w
TLSH
T1F1F2CF32E8A49E374CE2D3D6B14637577FF95127D6C80B50A9EE6F0D069792D030B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 882c7235da24c4d87a0c7803605389c8607392cd1597ae6b33aafb0d819ebe9b
MD5 c5219b0217cb5443016d8367bd878b9f
SHA1 c10395d02542e0db3db56aac00ebce4c63156ce9
SHA512 6fba78c06c30378746254bcc129c242e9cec24e6997435817c8a3abe2bc35d78c5ef2a4acbb2b9e219b397314fec49f92585b9d8cbac80942b7096b7d5cd0da5
TLSH
T1B861B67203360AD3E76988BBB9F294A4B2FFC849068F1E1A01555DB7AC02F0350D5CD3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b174.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b174.TMP
Size 3KB
SHA256 a448eb3c307c4c1b5b048de31faa58678a29282d207091a9ae10ac9358ef3cc4
MD5 884271cc5c6c59d804d72d5824775c4f
SHA1 1dcce2ed65264a17f74bd6fff64e4949e65d4fb0
SHA512 a548a71772d949ad6a1e78a3de6ee95b0d90b2fa919f255675db9e8486e35d026676b63dd225a8a8eeb4e95bf653fc9099662fc2a336c87cf25344e2fa89aa2d
TLSH
T11A61A57603360AD3EB6989BBB9F298A4B2FFC849468F1E1A01555DB79C02F0750E5CD3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3eeb06a6b672f51f1d9f78ab89b27150bca55aef8590610550c4e5e4185ec795
MD5 3b60cc1aee315e5674369a029ffd7b2d
SHA1 8f4e476d6ab2f355ec22441c53978380c0d06f38
SHA512 df64a06433b14b6f7a2660a6805ba58fe3a871856dc3b104e74e98f0c72dca47b98efd69205772e1e9e18ad3ac997d6a33749d5822a0431fa928da0626ee5c8b
TLSH
T1B3419BF3C7E4866E890156F0AB186E2BCE1D0915832C3D6AC9E4EE1B97F3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 faaa5cee3d05ec37e65ef7a63aa0b0a56fe5efac344fb7574c9ef794c7447129
MD5 3410ddedf803d4082c5239c77453f39c
SHA1 1831de701df3e0ccbe960bd06586dade54ce353a
SHA512 c7580ebb18e7151764e9910db6cd07215a40e8704aa1be65082c96fb16861162dfc923c32fbc61c772065b52e11ffad930782320a0659203350d99169728a115
SSDEEP 192:sxRwRdbN/f6s7f5wGPzoA8p4h/g6+WNIYo4CYXGnIgDJJ:sxRwvN/f6s7xpmc/5I/9H
TLSH
T10332A61A6928993B9CC7E21DFB65BF53E6F95032A1D42E48A7FC870C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f62d943b679969d808f103c014532a1fc40f9e3ff418e4ea8b3585d21f5ee6b3
MD5 d481575ce01d406f1ba74f3c707cbec2
SHA1 8e53dfc4d4966bd15dae1e6186c1bf6635f29414
SHA512 c48906aa4faf85edcd0f534b806c5e9105164b238afd786b11254af0276acc9305919fcee716d1af09fa0bc6f68808630c123b2c29966e6ff211af3352509043
SSDEEP 192:sxRwRdbN/f6s7fwwGPzoA8p4h/g6+WNIYoXCYXGnIgD3J:sxRwvN/f6s7opmc/5Iy99
TLSH
T14432961A6928993B9CC7D21DFB65BF93D6F95132A1D42E48A7FC870C04E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 19b50a8ff09ed1b8826f3a8833807d71cd89740974fb71986e243d6a688aca61
MD5 c0e1dfc54153de1715e553b9b138c2fd
SHA1 b7a1e5d97f8698985f908c6db2c66d76eb18918f
SHA512 fa0e13e21a779c2c72d56b0028deaaf9e8b511926fca2ed06cfd4ba5beae0ffc0e0ee3b0d0d1f14a26b6396afca50aa503243a357ad2b7fcf9e4b81ddb540206
SSDEEP 192:sxRzRdbN/f6s3fwwGPzoA8p4h/g6+WNIYoXCYXGnIgIJ:sxRzvN/f6s3opmc/5Iy9s
TLSH
T1743297166928A93B9CC7D21DFB65BF53D6F95132B1D42A48A7FC870C04E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 5c6d3dbb3c6e0c822e95d832c52a4049d64ea7dfd70ff512277b15df48d31eaf
MD5 ce030533e322d8a1c721105f749e7b9e
SHA1 ac1e04d591e80abf2a8967e985ad04f3ec949ff8
SHA512 502aa08ac4d3560119611206d3a33dd37e94ffdb3a254d33a2b4c8e06f5ed64d9f279838f9575774bf5c1ddf5af3fba3601c5f5349c0dca910266f6439edf746
SSDEEP 384:jzK6H0dfCtgsqFf02KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRXQro98e:j26H0RWgs2f028F1+UoAYDCx9Tuqh0Vy
TLSH
T166B2DC2B640DCBBE5F800A9DDC196FDB6D9802C79B588D4047FE994C03C77EA911A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 8e86b38e6c21f989548871729c6a19512939dffdd0723fc6d454dc77866467fa
MD5 3aed99a36281bd2f8f86ec446abb4c51
SHA1 3598881ccd55740af22d09eba4f874eedd154aa6
SHA512 07f9b512800fd085026a0658c06a7995100651501da33e2d9aa1d621b5ecb50363e61a8bd4ecbe95207083d1a87cbecfa82a034870a94291e55fe1ee4917c670
SSDEEP 768:Crv+4UNbd83OzUg/TBOWRZRNONXyer1IRCzni96eVH1SK3:CbsbW3KrNSIqnJEH1R
TLSH
T1CF13CF32E4A8AE374DE2A3D6B00776437FB85057D6840B90DDDA2F4E069B99E130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c20b3a09f8c6144a2d16e98aa17c0618c4a4ace1c44e8fc5066fd351882a46b6
MD5 3aff143ce332d772ddade0ec6af73741
SHA1 5140e4f0307c9712d2577c13666ee7572454c5bf
SHA512 a154914ec546c59891768a352efd4cda1db61463b57787b08bd25a8e8cd4b7cd655faccfb133c703925982e5c9f2e50a5e5bb830ae3a154cd943fb5695c0ef6a
SSDEEP 768:WL3OHUg/TBOWRZReONXyer1IRCzni96b9Mw:WL3YreSIqnJb+w
TLSH
T1BFF2BF32E8549E374CE2E3D6B14637577FF95127D6C80B50A9EE6F0E069792D030B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 12fadf87669fb5a31b294aab80cc7e5f1d8739a765d65aad2acffe3b56b76df9
MD5 7b5ba03fe90656508edd673d39ff8383
SHA1 546f7345c4c977004ae7aaf4b34dbc2a9b6d4dd5
SHA512 40cbb731cbb35015886f9743b6ccd8b2614eb2b7462e3c05323cd4436d1fc592b98d66ae35f1b99359dcc61fc1cfe7b20004eb3dd86c0fad42c7016afb8971cb
SSDEEP 768:wFQM3xwg4HUg/TBOWRZRZONXyer1IRCzni96b9Mw:jM3irZSIqnJb+w
TLSH
T17E03BF33D8948E3B8DE6D7D6F10A3353AEF55067DAC85690AADEAF0D019746D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7d423ea956861af33d89ea4fe1535eaddb6bd149289e3074bb215bb08a363073
MD5 50cf4224fabe5c63cac731c7a0775b8c
SHA1 5c999020dacb4921aa85ae5178f4033c4dd978c1
SHA512 27abdad3e3a43f91f628c0414b2a12835bd071977f1ff44e95079122c09c520dd7c3d54e9cac9b7cac72d747c167a84591c394d493466ea3feb22aacf3c229a3
SSDEEP 768:hrv+4UNbdz3Z2/TBOWRZYONXyer1IRCzniBneVH1SK7:hbsbV3kmSIqnQEH1l
TLSH
T12803BF36E4A89E338DE2A3C5B14777437FB86057C6800B90EDEA2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87b73426-0849-4aa2-8581-c1cc9cf1687d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\87b73426-0849-4aa2-8581-c1cc9cf1687d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download