a2a4cf1f4927be3bab7e31e96795141bb2d75f0db354c69885a03cd8c76d0979

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.html
Size 103KB
Sample260731-pmdwkashja
SHA256 a2a4cf1f4927be3bab7e31e96795141bb2d75f0db354c69885a03cd8c76d0979
MD5 875ea8043212ddca6d7a91c4aed635e8
SHA1 d5bf4da61acab5acffb3d0fb5d797ba9b9b634d9
SHA512 06d22bbf0a9e17ca02682145a9d70ecfef6af0c560322acfaca53d25e927678df6cf3a687c039bae50f196ec2f19b0e6fc1095d97b44259fdbc8e4544f1f2ecb
SSDEEP 3072:/Z6gVaf4uMyUVWIDHg4axj6c/mfLcGwT6paf3aAhEB:RhsOpVWIr7azmfZEG43aUA
TLSH
T174A312B399B93AF643F449575A23650C7DF00D074378948AF8F9D086A8FAE48C5FD5A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2176	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299744160430874"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{681F3FD7-5878-4585-B234-2EA5C623B6F0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5876	msedge.exe
5876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 4928	2272	msedge.exe	89
PID 2272 wrote to memory of 3400	2272	msedge.exe	91
PID 2272 wrote to memory of 2176	2272	msedge.exe	92
PID 2272 wrote to memory of 3400	2272	msedge.exe	91
PID 2272 wrote to memory of 3400	2272	msedge.exe	91
PID 2272 wrote to memory of 5820	2272	msedge.exe	94
PID 2272 wrote to memory of 556	2272	msedge.exe	93
PID 2272 wrote to memory of 5820	2272	msedge.exe	94
PID 2272 wrote to memory of 5820	2272	msedge.exe	94
PID 2272 wrote to memory of 556	2272	msedge.exe	93
PID 2272 wrote to memory of 556	2272	msedge.exe	93
PID 2272 wrote to memory of 4452	2272	msedge.exe	95
PID 2272 wrote to memory of 4452	2272	msedge.exe	95
PID 2272 wrote to memory of 3260	2272	msedge.exe	96
PID 2272 wrote to memory of 5044	2272	msedge.exe	97
PID 2272 wrote to memory of 3260	2272	msedge.exe	96
PID 2272 wrote to memory of 3260	2272	msedge.exe	96
PID 2272 wrote to memory of 5044	2272	msedge.exe	97
PID 2272 wrote to memory of 5044	2272	msedge.exe	97
PID 2272 wrote to memory of 5048	2272	msedge.exe	99
PID 2272 wrote to memory of 1284	2272	msedge.exe	100
PID 2272 wrote to memory of 5048	2272	msedge.exe	99
PID 2272 wrote to memory of 1284	2272	msedge.exe	100
PID 2272 wrote to memory of 4536	2272	msedge.exe	102
PID 2272 wrote to memory of 2896	2272	msedge.exe	106
PID 2272 wrote to memory of 3552	2272	msedge.exe	107
PID 2272 wrote to memory of 2752	2272	msedge.exe	108
PID 2272 wrote to memory of 2596	2272	msedge.exe	109
PID 2272 wrote to memory of 2596	2272	msedge.exe	109
PID 2272 wrote to memory of 5876	2272	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff865eec188,0x7ff865eec194,0x7ff865eec1a0
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,942094632369808746,10157026101446950425,262144 --field-trial-handle=2304,i,1007840769095551834,9560132736901126846,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,13139046273088012245,13411285607365360250,524288 --field-trial-handle=2304,i,1007840769095551834,9560132736901126846,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3380,i,8335481310434821443,9812236407525179393,2097152 --field-trial-handle=2304,i,1007840769095551834,9560132736901126846,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,17408556385740519387,4032911573277474408,2097152 --field-trial-handle=2304,i,1007840769095551834,9560132736901126846,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,728638160508943877,13803531650430721666,524288 --field-trial-handle=2304,i,1007840769095551834,9560132736901126846,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:13
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,9625457600079352491,16408396386283160925,2097152 --field-trial-handle=2304,i,1007840769095551834,9560132736901126846,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,3099370990274558703,10194119148964421055,2097152 --field-trial-handle=2304,i,1007840769095551834,9560132736901126846,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:9
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,16009732693976243016,13441631034219653667,524288 --field-trial-handle=2304,i,1007840769095551834,9560132736901126846,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,11803224584742186090,956719331841750615,524288 --field-trial-handle=2304,i,1007840769095551834,9560132736901126846,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,4460468961564979137,3748763400723834807,524288 --field-trial-handle=2304,i,1007840769095551834,9560132736901126846,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,4460468961564979137,3748763400723834807,524288 --field-trial-handle=2304,i,1007840769095551834,9560132736901126846,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,12197309636755252663,6914899406787795994,524288 --field-trial-handle=2304,i,1007840769095551834,9560132736901126846,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,3058427193739769725,1674313817638331705,524288 --field-trial-handle=2304,i,1007840769095551834,9560132736901126846,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,12586973907499346236,4637144191969401439,524288 --field-trial-handle=2304,i,1007840769095551834,9560132736901126846,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,12692631313033196444,7673232612346085593,524288 --field-trial-handle=2304,i,1007840769095551834,9560132736901126846,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6464,i,7271148440324616816,12794736220303477615,262144 --field-trial-handle=2304,i,1007840769095551834,9560132736901126846,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4d01271e-067b-459c-b2bc-8f31cc002962.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4d01271e-067b-459c-b2bc-8f31cc002962.tmp
Size 39KB
SHA256 760db9ea9fcf7e18a69f0d7db8921fd7471b48a6499711d4abcf4457ebe40d00
MD5 18a194c74ae543b3b1a07a06e038aded
SHA1 b68a6f557124e1d1870230f1a925e8854f5d7d54
SHA512 d282112c3b61e8c45b3cbe7e0bfeed8358d9d85a0874d9dbdacd15d3a20fc00d3e38c1e58afbf20903504428792cd14500f9c088877d46bd09675585340543de
SSDEEP 768:xGrv+4UNbdS3wXlYyyS7Hucys6BRvi82oP4/z6himofx2bwn+h:xGbsbw3X3imOz6ImoJ0w+
TLSH
T14E03CF35E4548932EDE7C284B04A7A937FF4526385C91AC0E5DE6F4E028BA9E531FC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a0731e7937d2f59e1c0c1941b7978e3fb7afc355503cf3281d5c11c9dc04cd91
MD5 18a10c485131a5590624d5fda54ff6d0
SHA1 7406057ccf3c26d19030d1250087ebb23d067fe8
SHA512 915b4a01aa8853464b9cd0cacfacf0ceae7c2aadba6b6537ffb92b1b74120ef630e6fbd0f95d0921ae949f42f34f92542e57f9c5696efe632751ef90c0834091
TLSH
T1516139438FEA29A1DB27C8B09C9D725932F4A4B4C50B6E0720CC5E748B02FCAE0D1473
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596047.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596047.TMP
Size 3KB
SHA256 d0e94325c6e9e34e7862b6dbbe390c5f5b5919690e5805b43cc814166b19e08c
MD5 68274bea13d7288429097eb0cef13063
SHA1 4a48a993c50bc28bd1a4f240efed20104ef01c9f
SHA512 b318689967387f29984dda24e00c26edd5e62b6081d74cf5adb4819efc0d82b7738f93756feb4c03f5c31adf0a23bffd43575f43cb609e4d46eabb2685063509
TLSH
T14A612B478FEA29A1DB27C8B19C9D765932F5A4B4C40B6E1720CD5E748B02FDAE0D1473
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f5e77ce98b6c059e5ac691a598ff5984b093381582d536a7e1e99e43daf16aef
MD5 9c71e89da42598f7a304908bf92c3c74
SHA1 b0623ed186fba15cc74dce4b8cd23c6b2e79ed26
SHA512 32a52c417b516a3bc60b0b7cebf39b10fe19146b91e5c54efb74b369efc9624e461f483c56723ce01df57e9de9a3a3f2529e8cc9379ceedf14d6fb5cd5f37d73
TLSH
T158418BF3C3E4866E891556F0AA14AE2BCE2D0915432C3D5AC9D4AE1BD3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 391b1e90b7437d0e464dd6101a9a64cfbf65f6afeb84a9c8c9adbeedeaf48800
MD5 0607356a0d86ba724603d097593f9256
SHA1 f14a77c1aed93bf123c18bd8d8899419a199ef69
SHA512 0b2998a58caa0b56c4c54e51b20c99583c9e112137eb3f975af92b56d048e159ba415bfe09be18527d4eb877acf3068c91bcd321ac373597a2628c1796ea5b22
SSDEEP 192:sxRpRAbJ/f2sTb0pq1z5xzoD8p4ry/g6+WNIYGlkkm+GLIgIJ:sxRpcJ/f2s304tVWy/5ItmBs
TLSH
T1F732C8166968993B8CCBE20DFB557F53E6FD5032A1952E58A7FCC60C04EB6DE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7fcb5350a4b209e7b0181c3442cfd8eddb67d51d8652a33926d4d8455d02ba26
MD5 86d1de1f2f77cfff0b5e1b3bf95144fd
SHA1 97890066f5b245196dec7558eb88826382b7315a
SHA512 93edb7cdd1b82aff6485abc9d85b486b8447d35ebfb2cfb0c133c7910f821b60f1450031e4a2405dd301978dc51a59dbf80303b28b9eb1d4f282e87ddb6c0ea1
SSDEEP 192:sxRaRAbJ/f2sR4bIpq1z5xzoD8p4ry/g6+WNIYGGkm+GLIgDvJ:sxRacJ/f2sRWI4tVWy/5IpmB1
TLSH
T1FF32D856696899379CCBE20DBB557F53E6FD5032A1911E18A7FCC70C05EB6DE120340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 64edc5107f8384e9a8868912fc0c7f862917588184df6f60008da753dcf703f0
MD5 3d1da2c6f965255282da34a9f4f4c2ea
SHA1 c2e785ee728800cf72a688b08d5f34c51b1e1697
SHA512 d4f807c20ea0e8c6c244a8ee90da6782a7a17028add9f6b0bf86b49d2af572233d552af782fa76beb236676b8c1f6e6e92518def2ff52f43d0674eface9d5afe
SSDEEP 192:sxRaRAbJ/f2sR4b0pq1z5xzoD8p4ry/g6+WNIYGlkkm+GLIgDJJ:sxRacJ/f2sRW04tVWy/5ItmB3
TLSH
T13132C8166968993B8CCBD20DFB557F53E6FD5032A1912E58A7FC870C05EB6DE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 85eda10b73f29be98f06aa342a2531d7c470b595ca29ef57407386174164585c
MD5 327812c2e7a075852deb64404ff1acd4
SHA1 52a7ef8e023db7f7eb0baf8584c40a04d7e5e4c4
SHA512 fa1f7b34d56370b66e6ad12aed9d74a060814147a85024c0cbcb179bc696d069d3612a85105150c95f9edae9d5b6a8b43b11a759d7e0925230452eed80411a10
SSDEEP 384:US5Yi0hfCtgvZFfxJKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVDT9NHRI3row1p:UQYi0NWgv7fxJ8F1+UoAYDCx9Tuqh0VJ
TLSH
T19EB2EC3B604DCB7E9F800AAD9C197FDB6D9802C796589D4047FE990C02C77FA911A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 58841798b3234b9a1cb490df4dfd400ae3c8ea873d95a513355e8c9d80369014
MD5 12573d587501938cf1d58d237b64067e
SHA1 4b945e2803421be2c19260bc089ad4f700db659d
SHA512 925e6e40989ecff85961eac7912688cec72afd6ff5aa2ba4066d3c5475bb93b1b179dc4efcb8ff66da5b27fad2bae41103f18d14d72ebc5c9729709dc118b4d7
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlkinOiU0kiWs5RgSiK4HgIicy6hAiLWheKqAIO:Cm7KmgIIJ4tWGm7g09OGlkinOiU0kdsL
TLSH
T1B8913159713F0690397DA90885B6981FC6C2B0F33119E56B7FAA11A74F66E038CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 254a0d904e3e5cc62acf18e9fe912c0b7cc6cecb26061ad8594bad3f7445552d
MD5 30a4b893074d298e6d5f1211d1020922
SHA1 259667f5c77fadbdb26a5d15665fa39ba7ca74ef
SHA512 a275840154af635ad1083214f912f362b87f0f2b720d98d2c1de7823d4a954d8133735facb710886e3f18a2b82724d6f9f4bed037ac1aa1c286d2f675b800092
TLSH
T18C710149713F0690397DA90885BA982FD6D2B0B33119E56B7FA911B34F66E038CFD4C9
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 71a25f392acb0537a7b0ac9aff1b424536101fcdf608a931a4775b2cfbf48acb
MD5 2b50cd9e5b98e00bd01f4318ed601929
SHA1 78b0420613abb2ee0f620343daed02bfef66b191
SHA512 5301e3cb58263a86f9373b673d8901e8b203d05c61cc92f9949ae1e3dbc6ea99f862c86e67ac4992e3c2c9d2d6a1cf87db00fc03ce9d9ece4ca2f23d70e215aa
SSDEEP 768:pAp3ARlYyyX7Hucys6BRvi82oP4/z6himo6xb9Mbg:pAp3I3imOz6Imoyb+bg
TLSH
T1DBF2BF35EC508E72DCA7C286B5863A527FF5923392CC5984E5EEAF0D0687A6D4317C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 654dc6ff321a92d9ab2c4f2281f28f71b2c3c7bdfc21d3b863fe8df582820f5a
MD5 40c5c4eb64794f3b0ec424fa6493dcbc
SHA1 f3548b15203ed3e7c68fef38eab6b71e75e5dbd1
SHA512 9f44e2bada6bc233adf746832e9d0903a104908ca3e345e8bc3f7d9bec519cbb6d3f205304dd96e7ccdbbe5668c716652bb17ef9f12fa322266d67086b0df937
SSDEEP 768:tAp3LRlYyyX7Hucys6BRvi82oP4/z6himo6xb9Mbg:tAp3l3imOz6Imoyb+bg
TLSH
T15EF2BF35EC508D72DCA7C286B5863A527FF5923392CC5984E5EEAF0D0687A6D4317823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 c10a6283989fccba9b453641c97833aa320ac0f531db189d31cde6711e0b1e8a
MD5 16ce7666b2c53d7dc48c98a41c8c7caf
SHA1 8e28b51f80eb06e2a1b49bc60934444b962e28c4
SHA512 3ab8e83d7759f32aacffcbd1567416531d234fa3dc43be201dfc7cd66981b4003e64c4bd0589846dd975c0b616073b240bf7ab1c96e4995262e3aec042830e85
SSDEEP 768:hDFQ/3UwgjRlYyyy7Hucys6BRvi82oP4/z6himo6xb9Mbg:hm/3H3imOz6Imoyb+bg
TLSH
T18703BF36D840CA76EDA78786F54A3A527FF15273C6CCA984E6DD9F0D02875AD430BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6fcf2552-4d54-43c6-9f28-7c68002adac7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6fcf2552-4d54-43c6-9f28-7c68002adac7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download