d214b220f367a07ec06f530ac27aa22b77f2a4b0ab1b9af573f3265321413e6b

Analysis

max time kernel
149s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01/Privacy.html
Size 2KB
Sample260810-aftacaxgmf
SHA256 d214b220f367a07ec06f530ac27aa22b77f2a4b0ab1b9af573f3265321413e6b
MD5 300e1e21e725d0b4ae62327ac3d75689
SHA1 b343974f5f0e87ee1ac838344ec59b558b802f1f
SHA512 aa25504566d37063d5e5d4b6eabe1e7af0e7bf598080436abf04dcf93e40e5d2a167172f7a949b454d1be418d91f26c6ca707b90a2a953a8b5610a6c974f7251
TLSH
T1A25198D54B81440726B209183B22D768FB44A065F75F8DF97DF0522AF7DC6684973A4C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4292	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307942062925071"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{65866203-30E3-4399-A851-081533EB4C18}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 3644	4112	msedge.exe	89
PID 4112 wrote to memory of 4292	4112	msedge.exe	90
PID 4112 wrote to memory of 4336	4112	msedge.exe	92
PID 4112 wrote to memory of 4336	4112	msedge.exe	92
PID 4112 wrote to memory of 1276	4112	msedge.exe	91
PID 4112 wrote to memory of 1276	4112	msedge.exe	91
PID 4112 wrote to memory of 1276	4112	msedge.exe	91
PID 4112 wrote to memory of 1552	4112	msedge.exe	95
PID 4112 wrote to memory of 1640	4112	msedge.exe	94
PID 4112 wrote to memory of 1640	4112	msedge.exe	94
PID 4112 wrote to memory of 1640	4112	msedge.exe	94
PID 4112 wrote to memory of 1552	4112	msedge.exe	95
PID 4112 wrote to memory of 1552	4112	msedge.exe	95
PID 4112 wrote to memory of 4804	4112	msedge.exe	96
PID 4112 wrote to memory of 4804	4112	msedge.exe	96
PID 4112 wrote to memory of 4804	4112	msedge.exe	96
PID 4112 wrote to memory of 4476	4112	msedge.exe	97
PID 4112 wrote to memory of 4476	4112	msedge.exe	97
PID 4112 wrote to memory of 4476	4112	msedge.exe	97
PID 4112 wrote to memory of 1136	4112	msedge.exe	100
PID 4112 wrote to memory of 5080	4112	msedge.exe	99
PID 4112 wrote to memory of 5080	4112	msedge.exe	99
PID 4112 wrote to memory of 1136	4112	msedge.exe	100
PID 4112 wrote to memory of 5604	4112	msedge.exe	102
PID 4112 wrote to memory of 3284	4112	msedge.exe	106
PID 4112 wrote to memory of 1832	4112	msedge.exe	107
PID 4112 wrote to memory of 2284	4112	msedge.exe	108
PID 4112 wrote to memory of 5288	4112	msedge.exe	109
PID 4112 wrote to memory of 5288	4112	msedge.exe	109
PID 4112 wrote to memory of 1132	4112	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\01\Privacy.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffcccbec188,0x7ffcccbec194,0x7ffcccbec1a0
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,8691359049385667547,5490182906566594923,524288 --field-trial-handle=2408,i,9382741190499743374,5526352904802428617,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,4444974639685760006,1526126059002893030,262144 --field-trial-handle=2408,i,9382741190499743374,5526352904802428617,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,10887332226781124233,16482914773580056189,524288 --field-trial-handle=2408,i,9382741190499743374,5526352904802428617,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:13
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,15058603043501256710,12163713255576465767,2097152 --field-trial-handle=2408,i,9382741190499743374,5526352904802428617,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,960979955999808408,17468374286632187116,2097152 --field-trial-handle=2408,i,9382741190499743374,5526352904802428617,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,3921055594506555916,17500412979726982871,2097152 --field-trial-handle=2408,i,9382741190499743374,5526352904802428617,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,2594971320230675691,18389589189886209683,2097152 --field-trial-handle=2408,i,9382741190499743374,5526352904802428617,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:9
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,4416091852779073756,8283584595050140350,524288 --field-trial-handle=2408,i,9382741190499743374,5526352904802428617,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,3645293853062536157,1992516834962011379,524288 --field-trial-handle=2408,i,9382741190499743374,5526352904802428617,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,5356439135201548080,14526102841383666465,524288 --field-trial-handle=2408,i,9382741190499743374,5526352904802428617,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,5356439135201548080,14526102841383666465,524288 --field-trial-handle=2408,i,9382741190499743374,5526352904802428617,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,15585960094157824354,6157492612104383114,524288 --field-trial-handle=2408,i,9382741190499743374,5526352904802428617,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,6730484162454969846,1355022877800147356,524288 --field-trial-handle=2408,i,9382741190499743374,5526352904802428617,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,1058591972312359155,7392480290944717934,524288 --field-trial-handle=2408,i,9382741190499743374,5526352904802428617,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,8639960789713937041,7036624436677095689,524288 --field-trial-handle=2408,i,9382741190499743374,5526352904802428617,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3692,i,13326403561391874677,1387455842810939423,262144 --field-trial-handle=2408,i,9382741190499743374,5526352904802428617,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5445f630689071fc28f9b00645837e0362ea21a49c3378846e247569a4b9c31c
MD5 827fcb96b55affd585153bfdda12e1ed
SHA1 9950f13a5990437dc5eb5650991341ea416210e6
SHA512 fd6a4ca59548404fec120eab33853f8278d2f8387243b11da2bac0192af667ad972e17f6060ef417168add467152669a8d8e132f668521890b3c07b278999fa2
TLSH
T1F6613B51032C16D3EB649831D3F042CA2A77A85D09076E96AB73FE74DC973D8A7003A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593fed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593fed.TMP
Size 3KB
SHA256 074b5c02415e58affd1c28e01813186d048e49b20a09fc2a520953601703069c
MD5 bcdcb83a0a618271dd3372e27f041b27
SHA1 f3137669a36933b1492fa0889e15c61d595f452a
SHA512 04f585bd1772d6df299f7eb31c3852269c39f1404e03d1c112bca8aa819d45146dfbe2752eb2d400a8aa60599fde01d15cf270a32e2d98f633f22a4e43471ffe
TLSH
T1A5613C51036C16D3EB249831D3F042C92A77B85D08076E966B73FE74DC973D8A7013A9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 e1c685e22e488ee0a7caa8b5cabfa332730ba75f90723be014a9df76a9604f55
MD5 49b7d039656d6bc4bacfceaa534bce10
SHA1 165135b3bcf012133ad9d45a59b3a5a1e7193a60
SHA512 42874fca63c343320706e4aefc119051cac5ccb446187ac0846a98af5d91c666fac9cfc98fe1fe87b3aa3326ab7a213ba5dbf1b42392ae50a832a6982a0b4ac3
TLSH
T15F119BB3C3D5856E891116F05A24AE2BCE2D061683183C1589D4FF2B93E3475E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4ae81a12a8271bec326c0032673ec9c6ef007d1f77a29e7f94725c983be1219a
MD5 7c348fa03a1091c47d0d13501554feb7
SHA1 2459eaca793bcf369b0dfea4f0dc9de740ddd588
SHA512 142c5228ab5728ce3dcdd62513518d9ff00e16fd318dbf7b6904069751ff0567b3bb2e25e1073d1b5a7c1d6182689bb07baf294948815f9b906748e3bb1d10aa
SSDEEP 192:sxR+RCbz/f1sCaDsmZ5zoA8p4dY/g6+WNIYx9l1JIGLIgDsJ:sxR+yz/f1sCaDy8Y/5IG3k
TLSH
T11D42D816A928A93B8CCAD31DBB55BF53E6FA5032A0D01E54BBFC971C04E76DD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 684304105d19a4770e9072ef23f4225c655ffad17b5ced1aafa396fa4a46b1e5
MD5 c52be69a898bd02210ed6b9e390be719
SHA1 9662fad7a0ff222b9a156ea3bcd1155d0a6ac643
SHA512 b252f398ac5e490f6cc852a68860399e5f89449da94cd635c53c186dc818cbdfc0864485387407e991040d7094189feb54abbad91e0c4b72e07766445f7b892b
SSDEEP 192:sxRtRCbz/f1s1wDsmZ5zoA8p4dY/g6+WNIYx/lDJIGLIgIJ:sxRtyz/f1s1wDy8Y/5Io3s
TLSH
T19032B7166928A93B8CCAD31DFB55BF53E6FA5032A0D01E58BBFC961C04E76DD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2cc19b8b721d567d3252a4601542838373f05470aee4d04fae3e9bf19b5cde31
MD5 bda3a1e39c88bc959f73f2b2214e8dac
SHA1 84ba4276dc9e6c2464db116dadb1a2af60d2820b
SHA512 14512b2e97f0a1d7d070c579a4ceb40faeaa55f41862434ba8848189c2382e11348613a25d200fe01645f4fd4bbb6a64e8b3b5df59d9e39e949abc2d8093bbf5
SSDEEP 192:sxR+RCbz/f1sCwDsmZ5zoA8p4dY/g6+WNIYx/lDJIGLIgDWJ:sxR+yz/f1sCwDy8Y/5Io3W
TLSH
T16432B8166928A93B8CCAD31DFB55BF53E6FA5032A0D01E54BBFC961C04E76DD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 8d6702ce101bc5c8369c267ce539ea4e0e2cc6ab8c848822d9b562d7ba335177
MD5 0430dd57ed789df4c618e93263d23f33
SHA1 35ed536977d0c4e3e53f27570768efce2b7a5924
SHA512 b655e3e8478a7bda582214b19cc3e78d3f193849747c253019da9b904a6fac4fdd4c257f0b60df2e3605d987db15cf0e9717eb09c88355f4eca58e6225a24205
SSDEEP 384:0OxEyGzfCtgbpFfp1KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVht9V3RkProrus:0YEyGjWgbrfp18F1+UoAYDCx9Tuqh0VO
TLSH
T113B2DB3B604CCB7E9F800AADAC596FD77D9802C796988D4447FE990C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 df032633d61b53643cdb77348405b9de67df6bd32bdfa7faac28c9c1164e24a9
MD5 968836c6b815f5c4e6f48a0102743651
SHA1 3e0804325acc7f0bc8d2b4a0d6f4a83a4dc20b23
SHA512 92221b70586bb23e2bb12e81a972d1571c6fea3e575947a284297903f0d5f7575ae64c702247dcffcb160ac66e7b4542d4f64d54434c566b80ad2aa828776c03
SSDEEP 96:KwzeKEguclIhFH//+FPql3l+KfL3D+r9lyzZoN5P33+5HWl/Z+KXL/D+7BZuzpfe:I1clIhFH//uPqVllL3Da9lyzZoN5P33W
TLSH
T1A8912791747A42403CBE690D8198D967EA82F0733559A86B3BE940B20F67F419EFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

7117619a-d3cf-4d04-a676-fe3fd123e5ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7117619a-d3cf-4d04-a676-fe3fd123e5ec.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 5176c5abdaf456a9213dc3512f18bad5ccd865f0b0c7f38c72449a13474b53a8
MD5 73beb721838dc3ec74062f30067b2116
SHA1 227f0edc3a2ea0cbaf7d4235d6ea8346051d7c98
SHA512 4d75a2459897b7c814a3aabd87a5d60b85aae4620af25d74354f4037205540a2b4749833c819df1ba128140f9f9aeff964a974b4aeb2815908de493275c63140
SSDEEP 768:Xrv+4UNbdB3YwkKL2S5jF669yrqUjWiIwwxMtPhy6Dqn:Xbsbn3YujF66INWZTMpTU
TLSH
T1B513BF70B8A856B3CDF6DB85B1077683BFB4004386C50ED8DACD6B0D458B4E9234B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f8f301d8d91535bfadac3a1393c6042975e145c8c28e977046d3bb2ee0e4890c
MD5 93adeb676687e6782e66c8c046416e56
SHA1 3c7af328cae239fc1e33858d5e51e48efd91ac41
SHA512 42f8437a3ab596390440b1aa5fb6942d7f5b25bfdf370c654bee7e82811b9bbc3b5a6e6875bab2bcf30fb42d3b4f995ea663e875c0d2ff5ebfcd2dcbb5941d25
SSDEEP 768:la3RwkKL2SwjF669yrqUjWiIwwxMtPhy6DqF:la3BZjF66INWZTMpTy
TLSH
T1F7F2C070A8A45AB7CDF6DB41B2123783EFB44153D2D80ED89ADCAB1D058B4ED1347839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 9bab119b5fb8fb26723d7b20be2046d306831de854393b9faebc5a467cdd77ce
MD5 c05d611e1c4da86b1c6d98f70aff4343
SHA1 b1d492ecb0312e83ba39f797c98939bb97fb3a6c
SHA512 f226419ea9cdab0b1319f3ddff9363275fca90b413d5f852c65cdbdf0380d5fc76d635cde808683ed742f34575cbd2eac028e2cf8ff9900f652b10b27564cf2b
SSDEEP 768:5rv+4UNbdl35akKL2SgjF669yrqUjWiIwwxMAPUiler:5bsbX3jljF66INWZTMqUsQ
TLSH
T1F603CF30A8689AB7CDF2C78672537783BF74509382C50F98CACD674D4A9B0D9274792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8c4a45f25bef21c349f24a4d4aa4ae8b8fec326074761cd2dc05e03994e3ad0e
MD5 eaf869c06f1e5707bb0abf0c425858ca
SHA1 e5ab3d109ef6acf7ac663e1207a60c67e5637295
SHA512 3466e8b31e2dd1462f7d3e993e956a981a53133b661bd2becca24a77f408dfa18bd78f49e59c32ebd8ee5213c5ab373b64b8e669d398ee3fcbb551b5730c7b46
SSDEEP 768:ta34wkKL2SwjF669yrqUjWiIwwxMtPhy6DqF:ta34ZjF66INWZTMpTy
TLSH
T12AF2CF70A8A45AB7CDF6DB41B2123783EFB44153D2D80ED89ADCAB1D058B4E9134783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 5f8fec163a77e4d7dff383ff003001b85aca1f0c06d3ff3e253366c03b42ed0d
MD5 26cb5d0b96bdc0d7d93baf101dc3ea71
SHA1 28efdac26ae361752fc73215b6153388126278d8
SHA512 81e99c31423d8f921932a5922aaefe3adf935be79b2f3a5dc2cde4b18ceaebae60791bc2ffbfb2207788a9e85b36500b55f49781bd334cd3e90250bb21f94534
SSDEEP 768:5FQe3lwgzwkKL2SrnF669yrqUjWiIwwxMtPhy6DqF:4e3n+nF66INWZTMpTy
TLSH
T15603AF71A89496BBCDFADF85B2163743EFB14163C6D44EA8A7CCAA1D014B0ED1347C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6d20187cb4973e6c520deb2e3512c8736dca1ef790f8393717001fb91905ffcb
MD5 905708dee806232e22cc1ae04370eb70
SHA1 99a0e5708e22052c1406390536b1a5f84f01bd4e
SHA512 2e049093fcb843d348f903f3c23fee866afd23555f1422fc062cdd9f80b13fec52ab41ca1c083646b810e2c19d7dd53a79b54c71cd0b261f8a2c1aabd352d69b
SSDEEP 768:arv+4UNbdl3jPkKL2rpjF669yrqUjWiIwwxMRGUiler:absbX3YTpjF66INWZTMoUsQ
TLSH
T18003CE34AC589AB7CDF2D28672537783BFB4509396C50B88CADC270D469B0DD2747A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download