9278d16ed2fdcd5dc651615b0b8adc6b55fb667a9d106a9891b861d4561d9a24

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 20:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.html
Size 163B
Sample260803-zsys2abq4y
SHA256 9278d16ed2fdcd5dc651615b0b8adc6b55fb667a9d106a9891b861d4561d9a24
MD5 f1fb042c62910c34be16ad91cbbd71fa
SHA1 5bc7aceba9a8704ef4b1d427d7d08b140afcd866
SHA512 d4b2f435a14e915ec8c36364ef6be6dd810883b5c9c8e337573a114d36257186fae92ead623ac5ef7812b0ff2cc4973842e994f2f7fcd510d3c5a9c5c33a369b
TLSH
T171C08CD8009C383C7124B888DFC102C284669009A4A03EC154DBB62CC27CA27C88E2E4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3168	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302643845919711"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{AD53FA64-A6AE-4308-9F67-C46C5BB741F8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 1848	3584	msedge.exe	89
PID 3584 wrote to memory of 4580	3584	msedge.exe	90
PID 3584 wrote to memory of 3168	3584	msedge.exe	91
PID 3584 wrote to memory of 4580	3584	msedge.exe	90
PID 3584 wrote to memory of 4580	3584	msedge.exe	90
PID 3584 wrote to memory of 3828	3584	msedge.exe	93
PID 3584 wrote to memory of 3828	3584	msedge.exe	93
PID 3584 wrote to memory of 4512	3584	msedge.exe	94
PID 3584 wrote to memory of 4512	3584	msedge.exe	94
PID 3584 wrote to memory of 4512	3584	msedge.exe	94
PID 3584 wrote to memory of 1256	3584	msedge.exe	95
PID 3584 wrote to memory of 1256	3584	msedge.exe	95
PID 3584 wrote to memory of 1256	3584	msedge.exe	95
PID 3584 wrote to memory of 5816	3584	msedge.exe	96
PID 3584 wrote to memory of 5816	3584	msedge.exe	96
PID 3584 wrote to memory of 5816	3584	msedge.exe	96
PID 3584 wrote to memory of 6092	3584	msedge.exe	97
PID 3584 wrote to memory of 6092	3584	msedge.exe	97
PID 3584 wrote to memory of 6092	3584	msedge.exe	97
PID 3584 wrote to memory of 3852	3584	msedge.exe	98
PID 3584 wrote to memory of 3852	3584	msedge.exe	98
PID 3584 wrote to memory of 3852	3584	msedge.exe	98
PID 3584 wrote to memory of 5592	3584	msedge.exe	100
PID 3584 wrote to memory of 5592	3584	msedge.exe	100
PID 3584 wrote to memory of 6040	3584	msedge.exe	101
PID 3584 wrote to memory of 6040	3584	msedge.exe	101
PID 3584 wrote to memory of 2428	3584	msedge.exe	103
PID 3584 wrote to memory of 2376	3584	msedge.exe	107
PID 3584 wrote to memory of 2440	3584	msedge.exe	108
PID 3584 wrote to memory of 3380	3584	msedge.exe	109
PID 3584 wrote to memory of 3984	3584	msedge.exe	110
PID 3584 wrote to memory of 3984	3584	msedge.exe	110
PID 3584 wrote to memory of 4996	3584	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ff8be49c188,0x7ff8be49c194,0x7ff8be49c1a0
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,8199719110272284284,12747146087215431012,262144 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,2827196015322134979,9386543113818462599,524288 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,2943043506548473691,13550997931381973829,524288 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:13
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,17470933284687723374,16050627234466383548,2097152 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,6337997167653716385,1360717780008638526,2097152 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,4401418320026161111,3407712165659202980,2097152 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,7260968507183138658,5878870823871469728,2097152 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:9
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3816,i,16237357798187741688,7695718887603631745,2097152 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,6926514228342787655,14274184534409353993,524288 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:14
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,15822529487845702831,12181615720724448523,524288 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,8005806012340390977,15996223914641931091,524288 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,8005806012340390977,15996223914641931091,524288 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,6298783114014921853,7938281357073684320,524288 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,6460148101786061665,3715250830080270415,524288 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,7957083649914553805,14722063590590408559,524288 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3084,i,16774201039781632186,16807774677771843246,524288 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:14
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6712,i,1829170371133293507,15528151039967352649,262144 --field-trial-handle=2304,i,1498241065769120670,1302313156757022134,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f5c580231aec90f8632b68c36461e3dc681d09cfb586519c3f9da011b7ae84cc
MD5 3e4159f6495ccf7eff24051660ef23eb
SHA1 12b62a56177f75f2f68f398d5cb0e2569457b0e7
SHA512 70873d061b0536a42579dcf4f14e5b331f949c9e12519a87d7461a4e723f428aa327432dd811fdd301b25b56dc6a191650bf8143c2c4eae512ce561b1097fcf4
TLSH
T104613C18B31ADAF3FB25C9BA68E0D0D97BF064D0018B1A20F4703FB82816F6410E07A7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ab98.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ab98.TMP
Size 3KB
SHA256 ea8f1926deafb2cfe8b43ae80adfc0cda8ed4e14240c1a8d4c2ea6286f92867b
MD5 4f1b3b812623860587b9c3205536de5f
SHA1 6a3b8d72e8f6d310ea1141a3868d07b52f5cb27c
SHA512 da7404ba35844899cdb9f89e5b9a4220126e8a6d5805d52e5750b26ba4f69ccb974cfc650677c159c61bc75b5a0f29620e2e6665cc742f23d6f7147d1e0d7b00
TLSH
T1A7613C18B31AD9F3FB25C9BA68E0D0D97BF064D4058B1A20F4743FB82916F6410E07A7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a076b42-a502-47a9-ae40-489bc5f43645.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6a076b42-a502-47a9-ae40-489bc5f43645.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c94088a43d870b876d544869e10f2f12deefd8ce09c74eab6547ee6b1d6cf71c
MD5 80e189375b891335cdbdadb84b966e54
SHA1 e281edb90404f8cfc247fced1245c02866a9d609
SHA512 c91f92127bd9794c287745a9a7be40601ad707ab804500973c0ebbaa93340ef06ab1d33823fce7ea2cb0037dd29d293b8f2688a71147f8c60d2c5f157c96c389
TLSH
T110318DF7C3E4957D890192F4AA146E1BCE2D0915531C3D6AC5E4AE2BA3E2871E14099F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3d9150d6dbefb61a794ee116dcbfe48225b4e6ebac6da7f2905e5d7ee5ac96ef
MD5 aacc6cd2dab3d38b76d8430fea6792e5
SHA1 7569b6446359fd626e140ac426606c74cc9e5dbb
SHA512 d41cc07aebc58988cc2961f505479c40a2102a5ed0dd60d55525b8afed57ad5b97db56cd47b318eacddc9f787bc19d89355b80650a72261072ece1550e8fb479
SSDEEP 192:sxRYrbg/f5s0d8Hm2Sm7aWozoD8p4S/g6+WNIY3BLkGNbIgIJ:sxRYPg/f5s0d825X/5IAhzs
TLSH
T17532C7166968AD3B9CCBD21DFB267F53D2F9503261D12E58B7FC860C04E6ADD120790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 dc2704a5eacfb4f37731eba9c8a23860bdc5414e44832402dc2ec5bd40dd55d0
MD5 a74483dc5535da7d59cb637120c28e2a
SHA1 b9923624c724228a8cf54c47b82d541628222711
SHA512 e18a428e5ef7fee94953c501f5e91b1c717738151c78703f7b01026129b5ca790e651f7191b4ff5b1492e0d75ddf133f18f33eb7bd8e1c08882bbc74a4cba514
SSDEEP 192:sxR3rbg/f5sddEHm2Sm7aWozoD8p4S/g6+WNIY3hkGNbIgD8J:sxR3Pg/f5sddE25X/5I6zU
TLSH
T1CB32D716A9686D3B9CCBE21DFB667F53D2F9503260D12E58B7FC860C00E6ADD120390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b28ea89de8142a439c1c80bcce2986604139ef7a4bc687f6ad52a63db6d89df6
MD5 e0bfba9df4f3b606f17d39b7b56995ff
SHA1 f32fddb64f523f80d7852eb5046027ef88c39719
SHA512 a670782a02484f16fd7fcb7bb7e1c8b2ef3ea58fe593fc4f11234e52cf0954f7d3b043da2add3a410648d1cd44e4232f32117ba3dc2c0f0987f6beddb29ce50a
SSDEEP 192:sxR3rbg/f5sdd8Hm2Sm7aWozoD8p4S/g6+WNIY3BLkGNbIgDmJ:sxR3Pg/f5sdd825X/5IAhzG
TLSH
T19132D816A968AD3B8CCBD21DFB667F53D2F9503260D12E58B7FC860C04E6ADD120390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e82bfc0a27b0bf1bb1dbe1263b7a7a786bc0b69c3362bf9823ab8fad2eae6dda
MD5 eeec01f8dd5532061fb44f80c7922a20
SHA1 e7c75166287dfe892a878827c75e33d922170e4d
SHA512 31175919f9f44f7bd18bca61c76e2c27bfaa1166a95d9ae211158b10f1455999cf1fd415bf0c8bf61dd4f05c750f53ad231ab1e47f4211c77e2756c63cee1084
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsH3gPr31lpWRekgJpK4ggHpcvHG5FaHzc52:C1i7PF/DWrwfX9mgpct1o7zsH3gPr31y
TLSH
T1DF913247313B0240393DAD4D96B9D85AC6C2B8633059B42F7BE845A21F66E039DFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dc9d9f5e-eac5-4b0f-8566-f242b5e0256e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc9d9f5e-eac5-4b0f-8566-f242b5e0256e.tmp
Size 23KB
SHA256 aa2c777b231ed0398eaec988e2f2dac07312df95deeead3fb24d04df9052f11f
MD5 916b4f875e142d1a90447eaec7a0a042
SHA1 1fd54a9ce7a07ea459cc4097362c2b23bcc47721
SHA512 9e6b95f1412a18657c2b23c30305c77c694d98b285a7a57445e324b45c42f99fb58b23c55b283794717f8a77192581e18f62469e06ebdf0e754d0b85f125eef5
SSDEEP 384:GMgEbt2fCtg0+FfKsKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVKO9W+RTproOLe:GTEbtkWg0CfKs8F1+UoAYDCx9Tuqh0Vl
TLSH
T1BCB2DA2F600DCB7E9F804AADAC59AFD76D5802C79B588D4047FE990C02C77FA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c12b0379-72a8-433b-bc53-541fff6dc183.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c12b0379-72a8-433b-bc53-541fff6dc183.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 21d32aa8497eb1b91d6473c491afd0f38b530b53c18a954a253e099209c4b541
MD5 fec7db80faf61c27a6d1b38a3b265af8
SHA1 2ea95855e069cea258910f7f53897bd11cb995cb
SHA512 793a18cf60a1a182199ef445297ab7b28c7e7814b5e285e775c8cd1b6234cc8a2e89199b3cb03ea657ac19fad02a9a06f354fcf27b721d21e60c21b48a823baf
SSDEEP 384:zZcIv38N2UBFbhfcHGfd+UJfRXOVyS5cffX8tgffXT+5P9vShCiDBTayppFJlmq8:rv3kkc+wfZOOfffffqvShCQR/ahy6DqY
TLSH
T152F2BF70D8B16D339DE6A244B64A3B12BEE55133D9C85B58DADD9F0C01837AF170F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4779ac6427f26dabaea73a445a41c6971e68535e30b4477e8e52681ace895a3d
MD5 c6942b1ed480cb53cd641627abccc61c
SHA1 15eb4c8fd4989050953532ee55b98333b9a24804
SHA512 22dc19e6bdd95ee05a9165846ca953c2fcfed09fa1ce2610fc3dbf30c9a1756ed7de7788b89897d041d3a30fef3d10dee43a43875a2ebae7ff39444af4bcd32d
SSDEEP 768:mrv+4UNbdw34kc+wfZOOfffffcvShCQR/aj:mbsbG3Vwf9fnfEvSDaj
TLSH
T14203BF71E878AD339DE29244B24A7B53BEA86133D8C55B58D9DC5B0D02836DF270FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f0b15f2fd666d06538fec9dee4e71d878601a762eb92580d370173b0d9b9fcf1
MD5 83cfa5273ffc49481ce76627820c318b
SHA1 d43865bcd888b0c38373e082c8dd6bb4fb8a9d18
SHA512 2767df8dcbed88794ca12bd786c072e3e489ca1a75c69d51372939bf17c16fdbaa5af0fb748a4feeedf1c890f87badee34cd8441cf9ef2965bba66713bb3fd5b
SSDEEP 384:/ZcIv38N2UBFbhfcHGfd+UJfRXOVyS5cffX8tgffXT+5P9vShCiDBTayppFJlmq8:Xv3kkc+wfZOOfffffqvShCQR/ahy6DqY
TLSH
T128F2BF70D8B16D339DE6A244B64A3B12BEE55133D9C85B58DADD9F0C01837AF170F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 ec3fc928ca996b92efa6bffdbb432371e664aac2efc813b73ec3dca0ecf6fad5
MD5 d90acb88106d744433c3925eda77e445
SHA1 2897469c0b152d116771d8a34bdb89b642ebe9c8
SHA512 aeb888d00fffbeadcf1e6709401d7bc88d0c58072c47fee38ef89a90bc3dc0c9ff8a4d21ea7dd2cff98894ea2945a38e5b0ad99d273e6179bbb2efc464b9e234
SSDEEP 768:WFQc3lwgykc+wfZOOfffffdvShCQR/ahy6DqY:dc3Hwf9fnf1vSDaTD
TLSH
T1E403BF7188A49A37EDFA9744F64A3712EEE55133D8C49B58E7DD9E0C01836EE130BC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ff64052d25da5188e19233561f20af7fbf801959bda0e8207baeebfe240c5604
MD5 b581107cab08d4da1cd81f81b0df10a8
SHA1 aaf5447d122e40811ae5299a61240aaa21eb832a
SHA512 8b68406990038ff5e2b5da27d6f3a7371b7edd086b2f23592f190d55840321e45a1670691fd6071ccd2fde122dcd5829634918042c96e7b1a0a20257cdc71c7e
SSDEEP 768:Rrv+4UNbd43c1kc+wfZOOffgvShCQtF2bwWV:RbsbO3cswf9fIvSZ0wO
TLSH
T17F03CF32E86899339DE79248764ABB637EB86173C8C54744DACD4B0D029369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c6bc5ef-cecc-431e-88b6-4332a4ba0bdb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8c6bc5ef-cecc-431e-88b6-4332a4ba0bdb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download