4998c1dec1f577d7116a3dc553fef0432898238fd5aed203dbc8c60df8233211

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 3KB
Sample260812-akemravdpf
SHA256 4998c1dec1f577d7116a3dc553fef0432898238fd5aed203dbc8c60df8233211
MD5 80a1e8d3aef0fa08271060c0c84f9d74
SHA1 90c0b8c74276e96538295c785289aee8038c867b
SHA512 4f3414947dfdc7efcb9e2428fe8415d15f6345589ddd2d5865e9a9a9a64e40a7388a54beeaf4fc36abfde37b61877102272fd205d0afc7b55ec5e409469f3f5f
TLSH
T1B4610F1FA5E345427527E4D41FFB07266695C803C44ECC693EBC6388DF5EAA4D58234E
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4640	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309673660621206"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{7597F10E-8145-4A1C-B98D-9BF3FB4F03F5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4996	2420	msedge.exe	89
PID 2420 wrote to memory of 2576	2420	msedge.exe	91
PID 2420 wrote to memory of 4640	2420	msedge.exe	92
PID 2420 wrote to memory of 2576	2420	msedge.exe	91
PID 2420 wrote to memory of 2576	2420	msedge.exe	91
PID 2420 wrote to memory of 4516	2420	msedge.exe	93
PID 2420 wrote to memory of 4608	2420	msedge.exe	95
PID 2420 wrote to memory of 4516	2420	msedge.exe	93
PID 2420 wrote to memory of 5764	2420	msedge.exe	94
PID 2420 wrote to memory of 4516	2420	msedge.exe	93
PID 2420 wrote to memory of 4608	2420	msedge.exe	95
PID 2420 wrote to memory of 5764	2420	msedge.exe	94
PID 2420 wrote to memory of 5764	2420	msedge.exe	94
PID 2420 wrote to memory of 2124	2420	msedge.exe	96
PID 2420 wrote to memory of 2124	2420	msedge.exe	96
PID 2420 wrote to memory of 2124	2420	msedge.exe	96
PID 2420 wrote to memory of 980	2420	msedge.exe	97
PID 2420 wrote to memory of 980	2420	msedge.exe	97
PID 2420 wrote to memory of 980	2420	msedge.exe	97
PID 2420 wrote to memory of 4956	2420	msedge.exe	99
PID 2420 wrote to memory of 4776	2420	msedge.exe	100
PID 2420 wrote to memory of 4956	2420	msedge.exe	99
PID 2420 wrote to memory of 4776	2420	msedge.exe	100
PID 2420 wrote to memory of 5508	2420	msedge.exe	102
PID 2420 wrote to memory of 1720	2420	msedge.exe	106
PID 2420 wrote to memory of 1112	2420	msedge.exe	107
PID 2420 wrote to memory of 2584	2420	msedge.exe	108
PID 2420 wrote to memory of 2336	2420	msedge.exe	109
PID 2420 wrote to memory of 2336	2420	msedge.exe	109
PID 2420 wrote to memory of 4804	2420	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff84538c188,0x7ff84538c194,0x7ff84538c1a0
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1924,i,6138956140003501429,12614064751794731498,262144 --field-trial-handle=2976,i,7672878951932403372,12250188750282149608,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:2
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,1824762838321900015,5847165459526256617,524288 --field-trial-handle=2976,i,7672878951932403372,12250188750282149608,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,7118875204970916300,9535086444333463608,2097152 --field-trial-handle=2976,i,7672878951932403372,12250188750282149608,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,16240096929667615211,15593477234042039079,2097152 --field-trial-handle=2976,i,7672878951932403372,12250188750282149608,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,15498157813015149074,17370903530797767577,524288 --field-trial-handle=2976,i,7672878951932403372,12250188750282149608,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:13
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,7738590334170091125,14960107145419318276,2097152 --field-trial-handle=2976,i,7672878951932403372,12250188750282149608,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,16191664948849963382,11041442073703982351,2097152 --field-trial-handle=2976,i,7672878951932403372,12250188750282149608,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,11698433465622552307,4143596718418074499,524288 --field-trial-handle=2976,i,7672878951932403372,12250188750282149608,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,11339344930514997282,13030569714755922382,524288 --field-trial-handle=2976,i,7672878951932403372,12250188750282149608,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,12265778574855656826,7234017000668658465,524288 --field-trial-handle=2976,i,7672878951932403372,12250188750282149608,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,12265778574855656826,7234017000668658465,524288 --field-trial-handle=2976,i,7672878951932403372,12250188750282149608,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,295716949198453058,16698619608993344045,524288 --field-trial-handle=2976,i,7672878951932403372,12250188750282149608,262144 --variations-seed-version --mojo-platform-channel-handle=1248 /prefetch:14
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,4842491068516803707,3242076071520590087,524288 --field-trial-handle=2976,i,7672878951932403372,12250188750282149608,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,7186446423753461492,9297833819468839154,524288 --field-trial-handle=2976,i,7672878951932403372,12250188750282149608,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,2754921421756186138,8854615205875248616,524288 --field-trial-handle=2976,i,7672878951932403372,12250188750282149608,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6444,i,5045285272221269825,15786055203887762242,262144 --field-trial-handle=2976,i,7672878951932403372,12250188750282149608,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b64a67477c62251a451d302c18778f1b3568a2f94cfd8253a90eca1d19a68cdb
MD5 af06d3861e6a0e5a8135ae2321341fcf
SHA1 b8544c7cef4d67c521108bf32a7f8beb1781d542
SHA512 ada6809b4afb5b448dede684531ecdb7fd6cc150cd625913b25dd3b89d458811e10f1c31c55331e4da099ee5abc9cdd28073cda426ee8b649d0ef3c826b3ad46
TLSH
T1C7419382532417D1D7A14EB261E1B65832FCD4BD8607AEC97A002D7CAF05F289AD1463
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595162.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595162.TMP
Size 2KB
SHA256 084e2264d11dad870774758e76a57d9c905a2300796f5c930a151a85d8c50db5
MD5 054a152616ee4cca8f929a88f3319a6b
SHA1 99469bd1e034ea6f51f2c45e9ac355ab847141a1
SHA512 32448b32b945d62588bcfc831d276ef613b664499b5ec2a0f2dc8989d6969a751b8ad3c5d2353aa7fdf65739af9a49b09f624f6a8f0d5be3183be870110d7ce1
TLSH
T16541A482532417D1D7A14EB365E1B65832FCD4BD8607AECA7A002D7CAF05F389BD1463
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4c08b24b0c12252967b680785fbe54ffabaa5fa50fe4bb89fd9df700a6bbc1e8
MD5 fb3678ff91dda9eedb7db9b11fa3aa95
SHA1 be7767147e1198b6bd40abbf958709c6b74e7349
SHA512 0c67beb36ab3faa3415a8306d7002807be9151ff34272994254e5d19fefa9b5f6ed2e7995c46a2fd6b3c661b8188c2ad6c2b43bacb7a4c339fb2e5965e483b37
TLSH
T1C431A0F787B4857E9A1196F0EA14AE1FCE2D0515432C7C6585E0AE2BD3F3472E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6e9b43cffad33639389374fb494a95cc757cdd6ac009cc7e4296065463ae60da
MD5 3655cef41146dee956bfcd312ccd9bdc
SHA1 36afeba83720067b5c46972a852639050dc26652
SHA512 aef4759b5381707acac8d66cff83d10a49884d34156e98c3e9f71848ab70b2f42af1f4235ab1ce2b5c2100b4b22222f51255156c524b7a1fb3f49d376843792b
SSDEEP 192:sxR2RZbS/fssdPxDde5lSxzoD8p4L/g6+WNIYCNWuOcG/IgIJ:sxR2rS/fssFxc5l0u/5Iuns
TLSH
T1D432D7156E28AD3B9CCBE21DBF55BF53D6F95032A1902E58B7FC861C04E6ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ae8043baa4fe4391e20b96a857b9d2df1047f90a89e21ea5fad77b13e4cecba6
MD5 8bafed6a0f248e8d5ff3a978d76ade3e
SHA1 a15d57cc7f9660c1fc57ddeb8ffb8b64c2b7d280
SHA512 203d6c7741aa0104242a3456fff46749e36d6e22b41bf53a1f82e37d169affa3377919d4dd253c6439733a57b77f4db6d64ea073d24be940861e4a9fb718782b
SSDEEP 192:sxRhRZbS/fssiPUDde5lSxzoD8p4L/g6+WNIYCXCuOcG/IgDCJ:sxRhrS/fssqUc5l0u/5Ionq
TLSH
T16042C7156A28AD3B9CCBE21DBF55BF53D2F9503261902E58B7FC961C04E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 aa37c1d31f5db218b0e5865469d5c5b08f241cb7f2f8256aecb6d36e5b308f71
MD5 a7ccf108570a59c1f9f1d3294ce2cf17
SHA1 a1c019995d1580ce229f99bd793fb63df65841d5
SHA512 57c3c1b736022c269970968fe5467da94098836570799d8e2807904aafee8c751091590e2d3780c71e743c86dde32e5eec5f89f8b3ee69b2252ac6c8c4aece18
SSDEEP 192:sxRhRZbS/fssiPxDde5lSxzoD8p4L/g6+WNIYCNWuOcG/IgDgJ:sxRhrS/fssqxc5l0u/5Iung
TLSH
T11B32D7156E28AD3B9CCBD21DBF55BF53D2F95032A1902E58B7FC961C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 cef8f6c9d414690f9bd463f96888e3c902c890083370892cde8950170618cba0
MD5 2b16fb4c8612a6b41e74eb60539186e4
SHA1 26845c82db1256829a34079f571210942483b431
SHA512 d7a318f98325e32ac2b4aa34948bb63b06d621fd2953e5efd6f1a47e725f03015bb19fee4fc62ed3f145f8accd8273fd774da19a8e853824b7c3e715de9e3329
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvdroZSP:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0VS
TLSH
T16AB2EA2B600DCB7F5F800AADAC197FD76DA802CB96589D4047FED94C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 01284f3a9ecd0bcb14437f9f3709fb2fbee7decf3c1b6582c08cc042e292c792
MD5 2a2e0a33f2ff5bd15c20a9e2557f7c11
SHA1 63c5de5f43e655d9168ee351f9e3a8aa748f0ecd
SHA512 abf8dd8b4c1008c467a4b5258b134f479224d4cba31cbfe77b604efb8ddc167d86cf9c3eae7fc2ac7c75e778e0a9114e549cfc42595006cd539df8c08a7768b8
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHyX+SkE0SWcJhgCSK4Xg4ScCqRwSbHYp8U:CbEBVj5JAdSp9/EgTK7j6dJOHyX+SkEt
TLSH
T133913310313B02C0383DB95CC1BC9C6E86C27472741AE56B3BA945AA4F67E479EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

46585567-03c3-4618-a8eb-362f5f658b4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\46585567-03c3-4618-a8eb-362f5f658b4d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 49eb7326ffbb46670bd9e2b29e66d2f6d4a504d048930509287f689f7ed1e440
MD5 21ae7bedc0c825f48a1e4a8417f5119b
SHA1 14ebff228ddb3910e615437ff9100eb100942ef8
SHA512 eb68fd648a1e38c9735274cf5e191c1345c38f5d252eefe27f62391b7eeae55f86c7bae4eb08edc9c19fcf6e9b8d07cf9fc8b3d5363c3b15cda504257fdfe22c
SSDEEP 768:Arv+4UNbdD3184jNp8+p3bd66j+4BRv86aLITTY2bwCl1:Absbp3rL8+p3Z6n4yUY0ww
TLSH
T1B303BE73E86899339DF6C644B2467B437FF8925396C10AD0D8CD2B4E419B1AE630BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0333da8dafdb5d06568e8c3a021bb1f4353ae7f75b6aabf6ae914f997216918e
MD5 9b9fe913391be608454f258e587891a3
SHA1 13fa68f13ae2f7ecb909834c0263550e72c38a24
SHA512 93eea7b6e50e1a45eeb81eb3f60dbb994d786a96017cc0ee135ea65f4249abc1521ccfc6dc1951f9969e258898f09a13694d4d937b2e2d20916366da5cde93e7
SSDEEP 768:2d3cu4jbp8+p3bd66j+4BRv86aLIWTYUn2N:2d3m98+p3Z6n4yVYU2N
TLSH
T19CF2BF72ECA49D779CF6C785B68637436EF49163A6C01E9498DCAB0D00971AE530BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 9f65bf51fc75a341672b83ef00db8a9b6ca31b56ecc660f519b318969a5460af
MD5 5ff56ae970e5a66429706230fdb428f1
SHA1 49baa53a3ca2a1c91827d1f3ae406e3ee44ad29a
SHA512 bd3b43efcd965c06d6eac7cea5478c14b40c9c9a7998642adf2fa7a8073706644e5e25385119d56891875fc04aca2897e657722490e423f09813ba66f3029794
SSDEEP 768:dNFQt3+wgdu4vp8+p3bd66j+4BRv86aLIWTYUn2N:dct3a8+p3Z6n4yVYU2N
TLSH
T1C6039F73DC94DA7BACFACB85B64637039EF09163D5C06EA4A5CCAA0D10971AD530BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c0b7f41227cc1bbd18d6ad7978b1ff3dc9511651a678d47501e491858d2e241b
MD5 fb19faac8939ab00186c2a6818a52822
SHA1 50d3c8f4c2ba9e8b653e65d4e48dfe828fb62c29
SHA512 5cf75d51c4211deeaed8f5672b1f41c65e71f32ffaf4065f4364b882de6df85d71737c61a267c3b05565aeea279d44dc614e7c04b56e6fe7e920b10aa27e28e7
SSDEEP 768:Dd33u4jbp8+p3bd66j+4BRv86aLIWTYUn2N:Dd3H98+p3Z6n4yVYU2N
TLSH
T15BF2AF72ECA49D779CF6C785B68637436EF49123A6C01E9498DCAB0D00971AE530BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 176fde74a830c604f7304f490698d180724ec8a963087e62bd670d00fd262be3
MD5 76ca30412c185da5dbd33ce7112568ec
SHA1 a74ae24056118f318871aac2dfaf321170d8c611
SHA512 d8eaa789bda7ec6f1a41ef0590124913df52279087b2e2c66b24f295b3c9a7486a284d3cf8d30cc19b2d6cefb390262a42b409e8381bafefae9a5ba2e1033f4a
SSDEEP 768:Irv+4UNbdD3/cONp8+p3bd66j+4BRv86aLIis2bwCl1:Ibsbp3vL8+p3Z6n4yS0ww
TLSH
T1DA03BE73F9A899339CF6C644B24A7B437FF851A396C10AC4D4CD2B4E419A19E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download