ab768623070128ccef048c88def86155dbe776c3d8db423cc8fa89432673d8a8

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FileZilla_3.70.6_win64_sponsored2-setup.html
Size 239B
Sample260812-pls9vstycy
SHA256 ab768623070128ccef048c88def86155dbe776c3d8db423cc8fa89432673d8a8
MD5 5290b8512262fffca20df1dbf2a674a4
SHA1 9c1add44d731073281ae82abbbb2b7687a93b1bb
SHA512 c9e1331164ac3e50e576bae5470a5f575e1f3c47016a68d8639e54bbcf3448803294005cec80a7c4d06d04b109bfc21bbbb6eb857ac789ddf59dec9f31276b1c
TLSH
T151D0979FE1AE82084253B3C07ED127C0B402937A78C206CC9B86E043D0042FDC00904C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2508	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310111334101039"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{C216E7B6-6AE1-40DA-813C-12BF6AE248FD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 4524	4624	msedge.exe	88
PID 4624 wrote to memory of 4752	4624	msedge.exe	89
PID 4624 wrote to memory of 2508	4624	msedge.exe	90
PID 4624 wrote to memory of 4752	4624	msedge.exe	89
PID 4624 wrote to memory of 4752	4624	msedge.exe	89
PID 4624 wrote to memory of 3212	4624	msedge.exe	92
PID 4624 wrote to memory of 3212	4624	msedge.exe	92
PID 4624 wrote to memory of 4152	4624	msedge.exe	93
PID 4624 wrote to memory of 4152	4624	msedge.exe	93
PID 4624 wrote to memory of 4152	4624	msedge.exe	93
PID 4624 wrote to memory of 2836	4624	msedge.exe	94
PID 4624 wrote to memory of 2836	4624	msedge.exe	94
PID 4624 wrote to memory of 2836	4624	msedge.exe	94
PID 4624 wrote to memory of 6112	4624	msedge.exe	96
PID 4624 wrote to memory of 1876	4624	msedge.exe	97
PID 4624 wrote to memory of 6112	4624	msedge.exe	96
PID 4624 wrote to memory of 6112	4624	msedge.exe	96
PID 4624 wrote to memory of 1876	4624	msedge.exe	97
PID 4624 wrote to memory of 1876	4624	msedge.exe	97
PID 4624 wrote to memory of 2000	4624	msedge.exe	99
PID 4624 wrote to memory of 2000	4624	msedge.exe	99
PID 4624 wrote to memory of 6080	4624	msedge.exe	100
PID 4624 wrote to memory of 6080	4624	msedge.exe	100
PID 4624 wrote to memory of 2720	4624	msedge.exe	102
PID 4624 wrote to memory of 792	4624	msedge.exe	106
PID 4624 wrote to memory of 3800	4624	msedge.exe	107
PID 4624 wrote to memory of 708	4624	msedge.exe	108
PID 4624 wrote to memory of 2436	4624	msedge.exe	109
PID 4624 wrote to memory of 2436	4624	msedge.exe	109
PID 4624 wrote to memory of 1452	4624	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\FileZilla_3.70.6_win64_sponsored2-setup.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffb1129c188,0x7ffb1129c194,0x7ffb1129c1a0
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,8134362850732372168,16411104494889078258,262144 --field-trial-handle=2324,i,9114595359755746335,11028117651034614265,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,7112179615925263123,17713459600410865974,524288 --field-trial-handle=2324,i,9114595359755746335,11028117651034614265,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,3954873566364532252,13007172639766972433,524288 --field-trial-handle=2324,i,9114595359755746335,11028117651034614265,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:13
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,3870535155216425082,18158727380340956557,2097152 --field-trial-handle=2324,i,9114595359755746335,11028117651034614265,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,6232142712537689615,17277717297887146987,2097152 --field-trial-handle=2324,i,9114595359755746335,11028117651034614265,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=2468,i,13070091135441634494,16724357072183439488,2097152 --field-trial-handle=2324,i,9114595359755746335,11028117651034614265,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,8421554278649690175,7482061265927669270,2097152 --field-trial-handle=2324,i,9114595359755746335,11028117651034614265,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:9
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,15522437587533700480,6663006783922531376,524288 --field-trial-handle=2324,i,9114595359755746335,11028117651034614265,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,18396149117041635471,10325361069419492360,524288 --field-trial-handle=2324,i,9114595359755746335,11028117651034614265,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,12105729832888887840,18139227203654849683,524288 --field-trial-handle=2324,i,9114595359755746335,11028117651034614265,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,12105729832888887840,18139227203654849683,524288 --field-trial-handle=2324,i,9114595359755746335,11028117651034614265,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,15295759304361501523,350322411723508653,524288 --field-trial-handle=2324,i,9114595359755746335,11028117651034614265,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,326911711641043455,452560547370549456,524288 --field-trial-handle=2324,i,9114595359755746335,11028117651034614265,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,9314683325019087937,8415246864586135262,524288 --field-trial-handle=2324,i,9114595359755746335,11028117651034614265,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,14642520286901526635,666222871003646509,524288 --field-trial-handle=2324,i,9114595359755746335,11028117651034614265,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,6604212903822457624,16028535512502349795,262144 --field-trial-handle=2324,i,9114595359755746335,11028117651034614265,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b6c46550cfcba02707393dd1ca3025827a617aa2584e64c4b0f8fe41992bdc42
MD5 af4a29e35c2645a8268d1f05922737da
SHA1 aa756a047c3c6d09ef73e754ce12cd33b6a657c0
SHA512 aa9a3f892cc5425770c889d0907f3b2248c8de6a6e5fb8cbf99e88bf02b4464f8cdb0dd98b5a5a5f4acdbd5f9b104a86816983e1c6aec78baea34544d4afc882
TLSH
T117613F6513210591EB286FBBB1A294B433FA849B792B7A2151419F7A4CC7FF151E0363
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c356.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c356.TMP
Size 3KB
SHA256 65aeb5ffaf136e15601c1cae9a9b55639ed8859832c8c3b0d868cfe8c4ef7993
MD5 9e96565580ce24f270e65a3fe9b55b4f
SHA1 f60cbdcd0ef06ba0d1393593dabd37bf97cb1615
SHA512 f825cc785584a27b1ea6afe1c54179cc420ecdf2fce77108c39037488bc9100be14a4ae777f41f37356f2c7f00c21d76ca413a1195916d88f019d52658e54173
TLSH
T1A1612065132105D1EB286FBBB1A294B833FA849B792B7E2150419F7A4CC7FF561E0363
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bece2062262ecc262dc84aa775d0e5e378ec73f1dc52ad1a9386e88a4c2c591d
MD5 231a0bdad32c3277f24cd1adcf1e792b
SHA1 3bbf7b84d13b6c6183242ac28ebdf4fbeb870876
SHA512 95109babb2f1ddb7248952873e8a76371f7bf60821c4956870ba888148428bb85bb81064d9020c0ed3246671d0f9950e123767a79dd1fd27fe9c0d43ecedf8d8
TLSH
T116319CF783B5956E8A1196F0AA14AE2FCE2C0515431C7C6AC9E4AE2793F3462E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 eb331e61d1d930824cbdabeb59d37b302dd4ee02740a4b58accd7a34663147a2
MD5 5dd1fe9a6a25e6d441fff8967a30c7b8
SHA1 28be7faa1d77f769123f575ea5d6431f5bf657df
SHA512 5435726774614ff183432e0811651e2939c90dacff5f0ae002110b7744b395c1a4b2ae2c62e52d28ff53bdf81937c2d8f518b989d73f82111399e8539de32131
SSDEEP 192:sxRHRLEb//fPsDdSJprQ54zoA8p4V/g6+WNIYn8UIhmG2IgDEJ:sxRH9C//fPsD80g/5ITb4k
TLSH
T15032A7196A28A97B5CCBE21DFB55BF53D7F9503261D01E48AAFC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e265b4dbb4cedc6be78fa1c75566cc05174fa49fcebff31d696f53b09ce59b25
MD5 02769a626e02015db1d2dfdfbf15a884
SHA1 9b9e1dc793c6cb31e0b48138e19a82da13f78a55
SHA512 497f3053e4a2f1389ab4e4095a2946f7e6417655935598d701e3da4c397f13e66b8b4c30d51530c68b9bfa91aa6ec427d2a5788d13071dacf8a2fa79440d6077
SSDEEP 192:sxRoRLEb//fPsRdSJprQ54zoA8p4V/g6+WNIYn8UIhmG2IgIJ:sxRo9C//fPsR80g/5ITb4s
TLSH
T15332A7156A28A93B9CCBE21DFB55BF53D7F9603271D01E48AAFC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 01d2b444c43da1b445c9ce5d06478716612e00fe3cd781df278c99dd6953017c
MD5 7103829d0bae8af6d7e05293c262858f
SHA1 ddb6f6878ec61f39439fcd0489520c50c08c8261
SHA512 596fd93a7cfd2382c3e4f9e961740b35bdaf7d39fae263ef77404d590a5488596dcc20a82f2bce58153d55b38d6af0974cf65212865e8a0b9701551b81c5c299
SSDEEP 192:sxRHRLEb//fPsDRSJprQ54zoA8p4V/g6+WNIYn8jShmG2IgD2J:sxRH9C//fPsDA0g/5ITM4+
TLSH
T18D32A7196A28A97B9CCBE21DFB55BF53D7F9503261D01E48ABFC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 fac612f2fcac415489883769bde6e91d010c4079f8b40b5d45634adecd255c4b
MD5 f75658af0b327fc121c17c790a529565
SHA1 0f8c02510e4bbd80ed08f1d593b601462a8be8c3
SHA512 da6626170bec152b417bc72edcfbd711f307fd963e2e2c3541aeef243ac610af9d1e4da4ff0832898b14f8ea62439d4bd788789caf49fb28736058f95891bd83
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPlrohMr:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0Ve
TLSH
T1BDB2EC3B604DCB7E5F800AADEC19AFDB7D9802C79A988D4447FE950C02C77EA51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 3563df6e266c121382ab9b779e71a02b2566e4ec89174de352521da1d763f6ad
MD5 72364c75649d437c5d1a39a818fa2f6b
SHA1 b513c8d544c3443030882e0831681164e57eacb5
SHA512 42277a7a23cdbeec7d547ddfcfa5352b0c54411ede17135a3045637e5e5af2da9f025284ed03d75ff5cbd8f60dc55a0519713089e08438ba3406777dec9ac060
SSDEEP 768:orv+4UNbdo30ISDZIO0mRNzc4ReyIsPLeVH1S5F:obsb63gtc44bszEH1W
TLSH
T12C13CF32E8689973ACF6A686F04776537EF8911BC2C81A94C9DE5F0C0A4B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 23fed5dd12a7b9c24a51ef64e80c7b8cc2e6a1600a0b5c24630645462137fe59
MD5 8d7ea713ce52fef64bda5f2f5a819651
SHA1 f3ae5883c6b7f7f21dd3eb2efd104840a5cd7a57
SHA512 f448d0cd4b9c49d080cc192050e73e0e6103b29f881d7bc689ed5e8d1eb7eb36e214b63acee1475e179e589898c4df570b94de3689c455f982381ad465d5e3f0
SSDEEP 384:KZcID38NW0dMizfHsJDZNfNoXOVSUU/MXZXnU3ETRzcoXfK86sfxEZxxsIj4lBLv:oD3xCSDZIO0mRNzc4ReyIsPLUn22+
TLSH
T1D8F2CF32EC659963ACFAA683F5463652BEF5912BC1CC2E9499DD9F0C05472DE031B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 a129d5a9de848e57b9d274eab251432212ab3aa678e286be1644f5cf71c4b4cb
MD5 1b78c9f3cebefe175a0bb5bd49ffb74a
SHA1 6fdd9087bb1579e0495e42ea0515b74b86effe0c
SHA512 81e285369b9313b936c2519a35aa504411a8bb2c15c9ccffe4af9cf89ee274284ff1ea6b730c44476b5e6c2def65a42eaf995cb42de60b88f1efcaaf50e4b132
SSDEEP 768:yFQF3VwgtCSDZIO0m8/Nzc4ReyIsPLUn22+:JF3A/tc44bszU22+
TLSH
T1A503AF33DD648977BCFAAB83F5463252AEF5916BC1C8A994A6DD9F0C05472DD030BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d5020070070bcf84a5a77746579d35a2dbfbd3fbdc6917f46013d1aba000b071
MD5 09aabe2e577932eefd43145d4944b5b6
SHA1 6038519bf00fb6fbe0065b4c1ec4384f9646396e
SHA512 200b7faabd0727642724132a73cd59b9c50294f043386b8ce043f4d9e50c336bb0078ead3154f2e27383804e5d6da00949536fc8b55320d612d8a9de762bff20
SSDEEP 384:nZcIF38NWSdMizfHsJDZNfNoXOVSUU/MXZXnU0ETRzcoXfK86sfxEZxxsIj4lBLv:PF3PCSDZIO0mYNzc4ReyIsPLUn22+
TLSH
T12BF2CF32EC659D63ACFAA643F5423652BEF5912BC1CC6E8499ED9B0C05476DE031B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 07994c3b1e793df7c98af506a76eaff3125d9f1778de4052b768b72bc184008f
MD5 05d5a1554c019eb3ae9257c39142e590
SHA1 efe2475a66b11cf514e21e9f66c35337f65d480f
SHA512 c86052fecd5996aa73d69ab45867fb5ed9923b16033501aacb6743089cfe948f656ceddcd6d63e79a737989cee8605c624219dca399f3862c032d9f73e8df75d
SSDEEP 768:Yrv+4UNbds3H8DZIO0m5Nzc4ReyIs2LeVH1S5D:YbsbS3Wtc44bsgEH1Y
TLSH
T12203BE32A8689973ACF66686F04776537EF8911BC2C81E94C9DE5F4C0A4B1DD031B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9523dd3e28704e03ba9bc0f4168d4420252779814524f16984c9651e75d3529b
MD5 d502db6772538bcb98c26cd0cfaa5d34
SHA1 73c15b14757bd09e2550cce7c585a2df39e11686
SHA512 b0c693cc56bad0aec0de4611b7eef865b66ae5277880278ca93bdcfd7059d8433e23636a82b7d08fffe81b435c3631d238eb246499f98a6a9f8e66f5bdfdbe60
SSDEEP 768:6rv+4UNbds3CtDZIO0ENzc4ReyIsXUeVH1S5D:6bsbS36tc44bskEH1Y
TLSH
T17803DF32E8788A73ACF66686B04776533EF8912BC2D81E94C5DE2F0C464B1DC130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af27a857-1d33-44d1-a52e-7c52797f1666.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\af27a857-1d33-44d1-a52e-7c52797f1666.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download