491ef4578defac49ddbd8a3df9fa8dfc61bb6d140a7532fd7948b259b07223e2

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
readme.html
Size 7KB
Sample260802-phyp6szsdv
SHA256 491ef4578defac49ddbd8a3df9fa8dfc61bb6d140a7532fd7948b259b07223e2
MD5 5ee8d4ed40e9db9f5f74dd6ae092f07f
SHA1 9c455e63e9f2dcb1444189eb1eea914d6b700222
SHA512 afc7716726ecb6a36d36139918c4bfed68e40b74629302a86116c8ba54d34f7423edf90206f04a4e072d6ef448b7581be76f7d7a342830f6a89a25812eee3af3
SSDEEP 96:CWUK8pz1E/4kF5kyJ0ifN8uueKQMdcwFdFPKuID9kKCZxjD+9+25tdLwGg1IZz67:98/SVPmuN3C/Da7d0JuCidI
TLSH
T191E1966BB5405376131143B16006217A733300BEB79D464654DBE62EBBA23B4AF7F4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4740	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301469098459397"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{C0A60DB4-1B34-4550-8D0A-BA16068401F5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 248	3988	msedge.exe	89
PID 3988 wrote to memory of 1768	3988	msedge.exe	90
PID 3988 wrote to memory of 4740	3988	msedge.exe	91
PID 3988 wrote to memory of 1768	3988	msedge.exe	90
PID 3988 wrote to memory of 1768	3988	msedge.exe	90
PID 3988 wrote to memory of 5428	3988	msedge.exe	93
PID 3988 wrote to memory of 5428	3988	msedge.exe	93
PID 3988 wrote to memory of 2740	3988	msedge.exe	94
PID 3988 wrote to memory of 2740	3988	msedge.exe	94
PID 3988 wrote to memory of 2740	3988	msedge.exe	94
PID 3988 wrote to memory of 2160	3988	msedge.exe	95
PID 3988 wrote to memory of 2160	3988	msedge.exe	95
PID 3988 wrote to memory of 2160	3988	msedge.exe	95
PID 3988 wrote to memory of 1376	3988	msedge.exe	96
PID 3988 wrote to memory of 2656	3988	msedge.exe	97
PID 3988 wrote to memory of 1376	3988	msedge.exe	96
PID 3988 wrote to memory of 1376	3988	msedge.exe	96
PID 3988 wrote to memory of 2656	3988	msedge.exe	97
PID 3988 wrote to memory of 2656	3988	msedge.exe	97
PID 3988 wrote to memory of 592	3988	msedge.exe	100
PID 3988 wrote to memory of 4748	3988	msedge.exe	99
PID 3988 wrote to memory of 592	3988	msedge.exe	100
PID 3988 wrote to memory of 4748	3988	msedge.exe	99
PID 3988 wrote to memory of 5056	3988	msedge.exe	102
PID 3988 wrote to memory of 1548	3988	msedge.exe	106
PID 3988 wrote to memory of 6060	3988	msedge.exe	107
PID 3988 wrote to memory of 3012	3988	msedge.exe	108
PID 3988 wrote to memory of 2388	3988	msedge.exe	109
PID 3988 wrote to memory of 2388	3988	msedge.exe	109
PID 3988 wrote to memory of 3008	3988	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\readme.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffb3641c188,0x7ffb3641c194,0x7ffb3641c1a0
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,2982900157244761806,14159373533347821454,262144 --field-trial-handle=2276,i,12023780055076704549,15890548646882929611,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,14422659467561758047,5762790470959163573,524288 --field-trial-handle=2276,i,12023780055076704549,15890548646882929611,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,539299458014730699,5084954599752120204,524288 --field-trial-handle=2276,i,12023780055076704549,15890548646882929611,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:13
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3336,i,2873077426970156231,6580187670741791587,2097152 --field-trial-handle=2276,i,12023780055076704549,15890548646882929611,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3340,i,11314674659361333394,10230097430923258662,2097152 --field-trial-handle=2276,i,12023780055076704549,15890548646882929611,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,3025504768403743354,3361515825835531249,2097152 --field-trial-handle=2276,i,12023780055076704549,15890548646882929611,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,9211408833535605139,16393975960185478288,2097152 --field-trial-handle=2276,i,12023780055076704549,15890548646882929611,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:9
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,11968750706740440378,13287096641508192139,524288 --field-trial-handle=2276,i,12023780055076704549,15890548646882929611,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,6222551739410014153,7996958886893514458,524288 --field-trial-handle=2276,i,12023780055076704549,15890548646882929611,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,12720932971476568217,17943825771547662833,524288 --field-trial-handle=2276,i,12023780055076704549,15890548646882929611,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,12720932971476568217,17943825771547662833,524288 --field-trial-handle=2276,i,12023780055076704549,15890548646882929611,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,17101234131800871575,10343969843634752594,524288 --field-trial-handle=2276,i,12023780055076704549,15890548646882929611,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,4776000928181236323,1135005077786758802,524288 --field-trial-handle=2276,i,12023780055076704549,15890548646882929611,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,8062818037784565700,13862692010208958238,524288 --field-trial-handle=2276,i,12023780055076704549,15890548646882929611,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2836,i,17050581131022642303,9575241108124115217,524288 --field-trial-handle=2276,i,12023780055076704549,15890548646882929611,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5896,i,14950034389290332663,11382474013957402804,262144 --field-trial-handle=2276,i,12023780055076704549,15890548646882929611,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 170dba82c3c1d375809e04168f3ebcd24865503047beaae16ac5acd42a07e369
MD5 3c9aded40c22ce6c2d048535ace0e977
SHA1 c74250e15a13c5f5ac83039050878df1298c44c9
SHA512 2e57432b8359c45e46f3d05d9c6a57eae6ada11c95810c76be1c532993d0a00b71e958c5a942913acd811290e76a78a313f0d89e6f1b2d2cfed07734a97e03a6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1E6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 89d04493a8e83bf278745e2f23f18a6e41656460ea8718cd27046b4b002d096c
MD5 f753b0922f5fedc2591b5a0b88753408
SHA1 1f9379148ed9289528d526cd68b220f1bb19ae05
SHA512 900bcd365785f0d1ec3c7999e1ab964134aec86e7a2a7eb3a94b2d8dddf382ef04a2f26787ad61b864320c3bdc25eaf618d929977c49e0ee3c816abde18c052f
TLSH
T13C611A8C432699B2EF79A1B267E15F583DF9807D46032E95E056FF708846F806CED283
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a02e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a02e.TMP
Size 3KB
SHA256 95d7594b97277672fbe184a447401664019b1acad3395c933e1b9da18eb46fed
MD5 f1d63cf36a2b0c54b5445a27dbe7af91
SHA1 1ba494a12e88453eee6094d20b5692115cb269dd
SHA512 b141123391be3390ef10f1e1f45abcd2f5785b5b7a95c7f0aaabffdb9b3327885413439dfa9e4eaac70a3caa6a25a4b72ab68d3c97acb10253b777909e904002
TLSH
T1A6611A8C432699B2EF7961B2A7E55F583DF9807D46032E95E056FF708846F806CEC283
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a2adf4c8ac9ff95a02e099fe4de13384e7cc7178c1539d7f784bb85772992db7
MD5 db4c1613a0ec81acbfcdccd6de663a6e
SHA1 3bcb89dd876e615ceb5fddf5e3276793b1c078d9
SHA512 7e3861ffb0d4be3ca4232df14d1c14f7bd79b7169bc93bf86ba0a311e1da8d19695880f244e5c46a98f5c1ffbbcb0e14387a97bbc158a0e00c90d3fde59b54be
TLSH
T1B341ADF3C3E8866D8A0156F0AA14AE1BCE1E0915432C3C5AC9D4EF2BD7E34B1E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 515ebb77c94c3ea5d9af961f860d6900f061f0a1633bf69d56e7c92ce1b2798d
MD5 1deada1ce899cfc4e5f137907fc3fbf9
SHA1 2b385e53242370d2ede67afe9b740396cb83afdd
SHA512 392ae4cb47a11f9affa624a7500ce6451a88dda05d95d2f97971d2aeb0b8a31fbde44f4a63d76554142caa629525804459df7c62ad4f03911f9902ffe201c6ab
SSDEEP 192:sxRuRayM/jK1Ml8wbV/fGsFAHm2Sm7afFzoD8p4q/g6+WNIY3BLiGsIgDNJ:sxRuwlV/fGsFA2/X/5IA+T
TLSH
T17062F915AA34697BCCCBD20CFA517F53D6F91573A1901E44AAFC9A0C00E6BEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f4588fcddbca50aac2fb52fe1342ebc266fa7b7673187dd0165f6f9ce18e15a8
MD5 88ec6f4b83f12ce38c2e0c6ef9f7e707
SHA1 90a5088a80e2a8caede2ebc092588157b8635fa2
SHA512 40297c2b6514677bf6837b92a0af629ff6e400454ef1c288124e0ed806cdafb8b3c27483f205c2b3bd58877aace6a7d8e7d2fd051ae2541c3bf12407451ae437
SSDEEP 192:sxRtRayM/jK1Ml8wbV/fGsHAHm2Sm7afFzoD8p4q/g6+WNIY3BLiGsIgIJ:sxRtwlV/fGsHA2/X/5IA+s
TLSH
T1A352D815AA34A97BCCCBD209FA517F53D6F95573A1901E44AAFCDA0C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f8a3d71d280f1f0955897052c42d13aef323d2d844f70a4d3334671a5f04a996
MD5 8347ea29d03ef605e9a79be031d641f9
SHA1 5c09353eb27dd204317e6a66ec8287147542e642
SHA512 8913b2925f00050a165c219603cd23602cb92bc6c30fc788a5bb469b490dc25731edc4bfb085ea1e67600419216c68f524ec5c181b16a4234343581b7306d05a
SSDEEP 192:sxRuRayM/jK1Ml8UQdbV/fGsFlHm2Sm7afFzoD8peq/g6+WNIY35iGsIgDjJ:sxRuwqFV/fGsFl2/t/5ITR
TLSH
T1EC62E815AA34A97BCCCBD209FA517F53D6F95473A5901E44AAFCDA0C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6d820992113f61de8a75c78cc73f674e49d211eb1aa33808a89401ef12f8f240
MD5 9b4a34aa84c83f6fdb7c6a74df11582b
SHA1 1e8dcf51d6a5acd825f082099d9a740632902737
SHA512 b21aa0392da36b8f559d04ffefaf250e93d6d677d188d54728346c0a48ac931fce1e1bcefd09830e8b45c488aa9c04185ffed044ae4315e6f96117e9ea4f7649
SSDEEP 768:GiqbvkWg0CfDs8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+MW65roZDi7:GiqbvkWg0CfDsu1jaDF6yZO7
TLSH
T1F2C20B3B640CC77E4F804EADEC26AED76D9801CB9B988D5447EA890C03C67FB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 82834d7519618dd0fb1b6c5eaa8bc901320903429162ee055f17414a2ca8b4ef
MD5 758d56241396ee36fe2bcd1007d0d7f5
SHA1 c3016cf92175b6fa0c6023e03be7ebad1711f733
SHA512 dcafe633ef15c0ef01f28bce861f6e5be44aa796425f097ebe2ddb79c2cdd2809a0a2bca272d6bfd539a92eae66a8cd16474a0a8d55e4f1d708770c3f00aace5
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHMxMOMfM7MJMrMvMbWMfM8MqgMjMbK4Mi2:C1i7PF/DWrwfX9mgpct1o7zsH8dIsGK7
TLSH
T13F910555323A0280383E6D8C90F9AC1EC5C578537058E52F7BEA15A60F66E139DFE4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6637585c4a5d0fe23fc9a59a17a6728a2e5ef57fb71b00a08e458f74f6fbbe55
MD5 014b0af319d671551f5acb370e445545
SHA1 240f61ab23078c49bfe70777cef95f3a3f57c7da
SHA512 f7e1919e4f6493907d0d5b4ae469f49f2276a3d0415243a22244b9f15207abe9b0cfdfee2e1f072baf2815b5601fb3881a9aec85f2f70d05093e55a947fe6234
SSDEEP 768:irv+4UNbd135V3c+wfZOOf3xf3NvShCQRjoa:ibsbr35Hwftfhf9vSXoa
TLSH
T1EC03BF71E878AD735DF29248B2067B53BFA46173D8C94B54DAD94B0D02836AE270FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d0dce97a7d6c4af7311e907f93ff27aeabb4daa3fde60bc53a1652fa1eeff6f3
MD5 b3dadfee2f4136bd8ae638650ab43ecc
SHA1 61ebcfc674848f7b03beba8ad5e254ea4b832219
SHA512 1ca366f28dfbfaec33ba248b0db70318a6ee209c146d0770c2ad89382a5f5643968d335fe33f4dc3b96eaec81e2378dbd583e17af44628232d8c7dca040d89f0
SSDEEP 768:Gi35i3c+wfZOOf3xf3NvShCQRj2ewBKZOeT:Gi35owftfhf9vSX2evZfT
TLSH
T1F9F2CFB0DC759D738DE6A248B6067712BEE46173E8C85B18DADD5B0C01937AE270FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2d96efddbdf465d410f02df4878f1c71090a1c50be381a755dd2c1a51d9cb470
MD5 46b49da011b4fefe0c2cfab7ba0de406
SHA1 cb72b93885083de9f38f0e821f618a6022dc6de1
SHA512 884a3752b7594115aace1e6be6f5d6001952c187e721b68e54930e0fe4e0baf80930df243829fc71bcde01fb078879c3d6d549f9fdeb76eafc15a3305b2c4044
SSDEEP 768:hi3Ei3c+wfZOOf3xf3NvShCQRj2ewBKZOeT:hi3Eowftfhf9vSX2evZfT
TLSH
T173F2BFB0DC759D738DE6A248B6067712BEE46173E8C85B18DADD5B0C01937AE270FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 000d34918396f235c3d6b95843d5d399cd51f011c5a554ffc09f9cd0edbec961
MD5 deeac2dfcd10750ae93ca6abf20b0bca
SHA1 cc574c2975ca67ab370d90cda9d835ca4d7f22fa
SHA512 ccee24b83cf7ee4b128cdfc6f6d62a58317e3cd258487ac986165a7e851e285ed0529ce0ce8d96ed80bc003f4e2c62f405efb101294d26b897684a9492b9630f
SSDEEP 768:n73Ei3c+wfZOOf3xf3XvShCQRj2ewBKZOeT:n73EowftfhfHvSX2evZfT
TLSH
T19EF2BEB0DC759D738DE6A248B6067712BEE46173E8C85B18DADD5B0C019376E270FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7ef8b5b3d716dec150104ce3bbc4c31920534e185b48e788dffc9929a597edb0
MD5 0926fa667461be5c24a44428a0d89f02
SHA1 59648d90bc63f6281ff9d3a7f35023bc8f21001a
SHA512 0ac413235921022151664e7ac66398192bfd66f47b94f5d7723b0a6a135dfcbf9cfba6d609f6972e079881088b0d1f6d9485b99d5eb49a555ea3ea476cbb3652
SSDEEP 768:Rrv+4UNbd439dkc+wfZOOf3+vShCQtC2bwWV:RbsbO39EwftfuvS20wO
TLSH
T11003CF32E96899339DE79248B646BB63BEB46173C8C54744D6CC4B0D029369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d999db2f-8ccb-4e70-89a5-3ea94c037aab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d999db2f-8ccb-4e70-89a5-3ea94c037aab.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download