cf43bea373eb8017fc11f405617504c8ef16eb9aaf5915d00ee264d915a1edd6

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
public_html/siktir.html
Size 1KB
Sample260813-ftft3asdke
SHA256 cf43bea373eb8017fc11f405617504c8ef16eb9aaf5915d00ee264d915a1edd6
MD5 182620e5402cae65b78e0941f87f0b02
SHA1 6307d9b2e34d22f46e770ca5515bc30bdd227c18
SHA512 2d9b19b0db80302a2afde52d05854f87415023fefe6542b1c878cb538fdaa64b7296cefd26181676783cd01991cd489719cc2b431c31349f89c6abe68e3f5339
TLSH
T17F21545B9346220DB5DB94683EF2639A962CD826B203063C0DDDE435C0CD536D1F679D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2480	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310713869336629"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{9DD30BC8-7BE7-476C-9FCD-522AA7005C10}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5268 wrote to memory of 6076	5268	msedge.exe	88
PID 5268 wrote to memory of 2556	5268	msedge.exe	90
PID 5268 wrote to memory of 2480	5268	msedge.exe	91
PID 5268 wrote to memory of 2556	5268	msedge.exe	90
PID 5268 wrote to memory of 2556	5268	msedge.exe	90
PID 5268 wrote to memory of 2632	5268	msedge.exe	92
PID 5268 wrote to memory of 2632	5268	msedge.exe	92
PID 5268 wrote to memory of 2776	5268	msedge.exe	94
PID 5268 wrote to memory of 2776	5268	msedge.exe	94
PID 5268 wrote to memory of 2776	5268	msedge.exe	94
PID 5268 wrote to memory of 5088	5268	msedge.exe	95
PID 5268 wrote to memory of 5088	5268	msedge.exe	95
PID 5268 wrote to memory of 5088	5268	msedge.exe	95
PID 5268 wrote to memory of 5284	5268	msedge.exe	97
PID 5268 wrote to memory of 2712	5268	msedge.exe	96
PID 5268 wrote to memory of 5284	5268	msedge.exe	97
PID 5268 wrote to memory of 5284	5268	msedge.exe	97
PID 5268 wrote to memory of 2712	5268	msedge.exe	96
PID 5268 wrote to memory of 2712	5268	msedge.exe	96
PID 5268 wrote to memory of 2564	5268	msedge.exe	99
PID 5268 wrote to memory of 1868	5268	msedge.exe	100
PID 5268 wrote to memory of 2564	5268	msedge.exe	99
PID 5268 wrote to memory of 1868	5268	msedge.exe	100
PID 5268 wrote to memory of 5668	5268	msedge.exe	102
PID 5268 wrote to memory of 1184	5268	msedge.exe	106
PID 5268 wrote to memory of 1904	5268	msedge.exe	107
PID 5268 wrote to memory of 4828	5268	msedge.exe	108
PID 5268 wrote to memory of 4844	5268	msedge.exe	109
PID 5268 wrote to memory of 4844	5268	msedge.exe	109
PID 5268 wrote to memory of 4396	5268	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\public_html\siktir.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fff2822c188,0x7fff2822c194,0x7fff2822c1a0
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,5787230788902206196,11447493618125429193,262144 --field-trial-handle=2292,i,17950412308892478789,14497025731499725893,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,17927317893413467713,6026868039777553715,524288 --field-trial-handle=2292,i,17950412308892478789,14497025731499725893,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,8283785830477673966,557873687762386552,524288 --field-trial-handle=2292,i,17950412308892478789,14497025731499725893,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:13
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3656,i,6069667445842694761,13850346203913704075,2097152 --field-trial-handle=2292,i,17950412308892478789,14497025731499725893,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,5063276732126186690,16296617362697733844,2097152 --field-trial-handle=2292,i,17950412308892478789,14497025731499725893,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,16094520841614001215,18258283713567639720,2097152 --field-trial-handle=2292,i,17950412308892478789,14497025731499725893,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,13354625124023534012,9559917733025852918,2097152 --field-trial-handle=2292,i,17950412308892478789,14497025731499725893,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:9
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,5061532593918348040,5045118472557295280,524288 --field-trial-handle=2292,i,17950412308892478789,14497025731499725893,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,12050518171140808255,6571631081215189615,524288 --field-trial-handle=2292,i,17950412308892478789,14497025731499725893,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,17733318693167122190,6827374672202122475,524288 --field-trial-handle=2292,i,17950412308892478789,14497025731499725893,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,17733318693167122190,6827374672202122475,524288 --field-trial-handle=2292,i,17950412308892478789,14497025731499725893,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,16948690215400312838,793334783250622329,524288 --field-trial-handle=2292,i,17950412308892478789,14497025731499725893,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,9171245730715641970,15900649343390618970,524288 --field-trial-handle=2292,i,17950412308892478789,14497025731499725893,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,5097195695198449999,2311113204085750281,524288 --field-trial-handle=2292,i,17950412308892478789,14497025731499725893,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,2156774195659165676,4017108082910103941,524288 --field-trial-handle=2292,i,17950412308892478789,14497025731499725893,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:14
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6084,i,11828412649575170085,11294912085049104690,262144 --field-trial-handle=2292,i,17950412308892478789,14497025731499725893,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

97a9d4c1-5b2f-4dba-a0be-7729083cd5fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\97a9d4c1-5b2f-4dba-a0be-7729083cd5fd.tmp
Size 14KB
SHA256 bf62d5044b6c55cf0a32d4c5dec7744ceb7f937a85ae1f436a2ac4b3ca7ea8d9
MD5 769e4aabee8a91ea0233bccaebb7ed04
SHA1 0c5a2a5508cc55a9ee49fcbf5443ea4b1ab6842a
SHA512 0a79f06c81f8f67fa3d5251968bb344d993ab930237371c139c839156d4f76e3c6d69879c7feebf7c53cd4f1dc40c10d668a12e7ad8af322c5c8d8d299615867
SSDEEP 192:sxRHxhRsyM/jK1Ml8UQ/btZ/f5Lsh1CDde5lSeGzoD8pe2OS/g6+WNIYC5BuOEGP:sxRH7GqjL/fNsh1Cc5l46S/5InUs
TLSH
T15462C8159A289D77CCDBE20DFA41BF53D7F81573A2901E44AAFC8A1C40E6BDD121782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7a95807d4d8da7d51bcc0645128598836eaad0cfdcecf92cc2474eeed56f5bee
MD5 d9e678ffe1a74183659d73679d8d8cd7
SHA1 edcc1dfaf7b50a8c464e9f3ee334dbc2d9ee67bd
SHA512 28488e58033f794826a65a2e97b7427e049b722cb4b2cef43ae38a1b1e7d2e78223a48d40163fd87d3efede82bc7a758d4b071d4967291eafc55b67c784315e1
TLSH
T1C551528203263AC1E77955F297E944C8B7F9B3A9080B5FFA120C1C7A5E4EF4480C912F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599b0d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599b0d.TMP
Size 2KB
SHA256 8668baa746d8e1c6eed7e24dab37f19691292750d766865ab69402014b05f090
MD5 feb206a1bcce128c7c126fcf4cab46dd
SHA1 4b23c045b79860f89843b1e9c61b3c0d7cc5a3b4
SHA512 27e8f80814083535cf009ec27b8fded2015ed2fa8ee08b8c4b9b5ddb76dd46d92784c3c47e4067f1fb6386abf205c95c539f890abc79d201f20508729359de28
TLSH
T13751638203263AC1E77954F29BE844C8B7F9B3A90C0B5EFA120C1C7A5E4EF4494C812F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ed0c1791452423f2449f5d8c98fa948f590ea36dc7d5afcd7488d79a3f9949ee
MD5 32eeb3458593be3c8594954962b0c150
SHA1 ba3f57fc59d4b3854ef809cdff1ea9ac70a38881
SHA512 d9c4ebf5b415a927e2c51d5b2c9c2e34ef901937d10c9f4c336997aab357d2049ec8f2f5f1920d159c28e9ebf5c5389eb995bb61f1c390b72075a868ec1976c3
TLSH
T11231C0F387B4957E9A0196F0AA086E2FCE1D0511432C7C65C9E0AE2793F3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e0cc70b09a0eee1fe4ff14634058d3312926cb3f0d1b0b8479644f73f7306432
MD5 3a6a7fdb65debf640bd540de940a2a28
SHA1 c2b870853861d4620cd2fc850f71626fe326afb4
SHA512 63cd3c5dce68991f938bb4ee272578a327c3d10935e5804e0f7e6ce1e47aa3c7ad04fe4a6c05e8b925a341e33a8730ed11ba03d916f6ec26895a14ed08b89bb6
SSDEEP 192:sxRHxhRsyM/jK1Ml8wbtZ/f5Lsh1TDde5lSeGzoD8p42OS/g6+WNIYCNzuOEG4IR:sxRH7GlL/fNsh1Tc5l4MS/5INUu
TLSH
T1EC62D9155A289D7BCCDBD20DFA417F53D6F81533A2901E44AAFC8A1C40E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fc84b5a8ea7482da199931f7f1eba3e86d6e4ac58ef3dc77c01a429bac52f2e4
MD5 284f7505f0633fa40cdcb332bf900409
SHA1 2dc7274559fbdd0647ee712e6b8b4f112e74402f
SHA512 d69d979918b28d0eebf37b0a1f718963005346b6d8c73a4a678d5b8b1162bcaf66602d321b5f71f1d62ca51ad0e1f84feaf5fab0d948e8ebabbfa1c3dd907385
SSDEEP 192:sxRH+hRsyM/jK1Ml8wbtZ/f5LsS1TDde5lSeGzoD8p42OS/g6+WNIYCNzuOEG4IJ:sxRHIGlL/fNsS1Tc5l4MS/5INUs
TLSH
T16052E9155A289D7BCCDBD20DFA517F53D6F81533A2901E44AAFC8A1C40E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 98fcdbb00d1767dadfee5656e17bfd7fb11c0e0d005c0c6f2169697ca0366faf
MD5 0ea92b725822a8de01f4305f9f4f8b90
SHA1 f9e2af506cbf780817c4dba3eeefab82cd6f3cc6
SHA512 b62b70810705823dc6b9427382ba7d8ec3ce27aee1a195d218e460a03f3ec73bd4c1969a3a73ce3d064344a0683f3987f17391c8d75c15b64ca4acd8f763baac
SSDEEP 768:j/8vrQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCQqqYrova:j/8vrQWgQ+fB+u1ja3VqjS
TLSH
T1A0C2FC3B640CCB7E4F844EADEC29BED66DD801CF5B588D5447EA890C03C67EB521A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 86ece15cd0415cf78cde9f935d5b6d20fec3ecbfa6a9b9c70351c603a2333509
MD5 5d4e2b4618e4b3c54baf200d0b99f9ef
SHA1 5958d7d501b3a490abb7a18b9cb50124575fcb17
SHA512 bb6d9bcb854d4d95b98a57c4f1a26764575562577db1c25a4f57accb7e4770b4c0643b6f0f7e9ae6a99f1b581b677a466dbbdf1e877b0e948e0ca5bf89e22c27
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHuDSOowg2Ww19gO2K4TgM2cmut8unqwAK/:CbEBVj5JAdSp9/EgTK7j6dJOHuDSOoww
TLSH
T13F9165017ABB02413C3E754C807D893A86817473341EBAAB7BA805764F67F429EFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 8e35ae1158232f0a41b2d48eeb21440647fc8530b1446bddf634bf5eefdc7109
MD5 af8c1ea5ec2508f7d79688eb0689b5b5
SHA1 a7a987c6bf69982191dbbf48ffe3c9158324d763
SHA512 0910d446d4d53093c04bdb398899b292f29f8b579cf8a690c9307fc531afded8b161f77d1da28bce9bfb35b14ab947d905e8ef1fc08c258a410de649902e53e0
TLSH
T17C8135017ABB02413C3E754C8079893A86817473741AA9AB7B6845764F67F439EFD8C9
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a7b02580a97eb0c085cdd234664d293105b39ec43823a438814d22f12b5d92e5
MD5 5de98e80497a2657baf63d0c9a990d74
SHA1 d1cfc9ff44e504378ce25828ce81b7db04c1a8d6
SHA512 970190f3a6cbefe3ec783d78df2b48ae602f88282f761ddef86736d14b097604423f5c17a9e9337c2efe5b4cbbf92d0121a4fc725575800c787b7b4b488ff42f
SSDEEP 768:5rv+4UNbdb38jQXLzp8+p3bd66j+4BRv86aLIW4ilI:5bsb93hLF8+p3Z6n4yCB
TLSH
T1B203BE72F8A8A9738CF6C744B1477A037FB8109396C01DE4E9DD6B5E419A19E230B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 931acb1df3b05fc5864201d75bdb3b49270514e13baa6494053dc470dcf4a9fe
MD5 cb25e9c792d9053f11d4deef73f00b42
SHA1 88f3fa60953dd7fb91a6840ba70ae6c4b4b190b4
SHA512 6c8463eb2f6f5fbca66dc71da0036abbf70268f5a5ce414798cfc1fd4d692b45b4bfa3a8559bfbe2ad438fb7992368fdb3687f64367bfccff6344d05b4e7328b
SSDEEP 768:VI3ZOQXLip8+p3bd66j+4BRv86aLIW4Pi9P+ys:VI3PL88+p3Z6n4yCP/ys
TLSH
T1F0F2BFB1F8A8A9738CF5D784B2567703AFF81153E6C01DD8A5DCAB0E118B25E170B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c34d19ca77ef56a7c25072ab76cc9aee46a37ade194712301255d68aed6c3155
MD5 14efdd1ce53d37a2be4d19be182b3510
SHA1 ef754ef44730d1f559418da3ad5d07d1290904d5
SHA512 055edd5fa890bc4ee415f8689ec36e74dbc86495eaedc1f42af02d88060a094d1555549251f8e373204f759d89672cde78ead052f6017f19683faf78b9e047da
SSDEEP 768:vI38OQXLip8+p3bd66j+4BRv86aLIW4Pi9P+ys:vI3gL88+p3Z6n4yCP/ys
TLSH
T15BF2BFB1F8A8A9739CF5D784B2567703AFF81153E6C01DD8A5DCAB0E118B25E170B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d9ffdae2b03b9ae7bc2ee596ec79f48f3828974bdbc6e81caf63431d7d9aa392
MD5 a95154c7a44a7610b6c3b2123b56e650
SHA1 26a55371db1f4dff4d7be4cd0bb472ec5e5edc42
SHA512 6c3ffe5a44cc82861fda77e090882c028e316b0f0653af1bb7de21fba6acba4663c01dbaaaff115404b449a76843ddac505ea9fc86b38a3af677e0a733fdb7b5
SSDEEP 768:0u3ZOQXxp8+p3bd66j+4BRv86aLIW4Pi9P+ys:0u3Pv8+p3Z6n4yCP/ys
TLSH
T176F2BFB1F8A8A9738CF5D785B2967703AFF81153E6C01DD8A5DCAB0D118B25E170B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7e09f45a3a6587cbf6654fd0ece31e701e39e72a2f99ff20cfda173817a406b9
MD5 63a18c8b96b4ba35f3ca86c907ae82f3
SHA1 b689f2d2a946e923585a25de129c0eb38cecfc1e
SHA512 3d962984e60758889b2f142c4dfdb5e0a6c49b6083067d43607322e6aa47abfa8e03f1ceff63d8cde65d616324651c2a164f991c0cc0a6e63aab964d92114df5
SSDEEP 768:Irv+4UNbdD33ccNp8+p3bd66j+4BRv86aLIiE2bwCl1:Ibsbp3VL8+p3Z6n4ym0ww
TLSH
T17B03CE73F8A899739CE6C644B2467A433FF811A396C00EC4E5DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 132b5e620954b54b64fa0c85c0f806ecc7fed266366597f4dac1fad8b68dd8a3
MD5 483c3e1b82e42d3a071e6b5931cb1453
SHA1 3fa13961835b72bfc9a6b964d380752dc4d6df62
SHA512 51f12d37d818ef04b670162363a64532a4c4530dfb9613406ca9533fb6cfd9ad5264b370b81ec478073526e5536f7f738aa2468e454abd1ee212dd2aea2bc683
SSDEEP 768:yrv+4UNbdD3+uXLNp8+p3bd66j+4BRv86aLIT42bwCl1:ybsbp3rLL8+p3Z6n4yR0ww
TLSH
T12503CE72F8A8A9739CE6C644B146BA437FF8119396C00EC4D9DD6B4E019E19E630BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0bf4457-e3aa-4409-beb3-d97105e0a9e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a0bf4457-e3aa-4409-beb3-d97105e0a9e1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download