e3fa88f1d577a661413da4bef2b30b18de9f0143574fde85c614f747ff3f3a6a

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rlsbj.cq.gov.html
Size 797B
Sample260814-pp6pcsbl4t
SHA256 e3fa88f1d577a661413da4bef2b30b18de9f0143574fde85c614f747ff3f3a6a
MD5 71f7bffb09ee5d93f6f41aefd835beda
SHA1 35e2a1de44c09dfe7e9b098ae76dcebda2be07af
SHA512 dca46f1d449dcec0b8f433d162fdce0b476dc6af8f0634533cf5323d619cf7ec895f60c52b41715ce18c628c4ca871ec0dec77a7ab71a0095f24686740fc7dc9
TLSH
T19D01F46870F10D045573B1319EEFF37DD4AA10133646D650358D1703EF71521AA637CA
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2348	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311843996923977"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{D56EB9B0-CEDC-4391-9AD1-E244B2A5BC29}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 3672	4864	msedge.exe	88
PID 4864 wrote to memory of 2348	4864	msedge.exe	91
PID 4864 wrote to memory of 1596	4864	msedge.exe	92
PID 4864 wrote to memory of 1596	4864	msedge.exe	92
PID 4864 wrote to memory of 1596	4864	msedge.exe	92
PID 4864 wrote to memory of 4672	4864	msedge.exe	93
PID 4864 wrote to memory of 4672	4864	msedge.exe	93
PID 4864 wrote to memory of 4568	4864	msedge.exe	94
PID 4864 wrote to memory of 4568	4864	msedge.exe	94
PID 4864 wrote to memory of 4568	4864	msedge.exe	94
PID 4864 wrote to memory of 5016	4864	msedge.exe	95
PID 4864 wrote to memory of 5016	4864	msedge.exe	95
PID 4864 wrote to memory of 5016	4864	msedge.exe	95
PID 4864 wrote to memory of 3328	4864	msedge.exe	96
PID 4864 wrote to memory of 2208	4864	msedge.exe	97
PID 4864 wrote to memory of 3328	4864	msedge.exe	96
PID 4864 wrote to memory of 3328	4864	msedge.exe	96
PID 4864 wrote to memory of 2208	4864	msedge.exe	97
PID 4864 wrote to memory of 2208	4864	msedge.exe	97
PID 4864 wrote to memory of 468	4864	msedge.exe	99
PID 4864 wrote to memory of 468	4864	msedge.exe	99
PID 4864 wrote to memory of 468	4864	msedge.exe	99
PID 4864 wrote to memory of 1760	4864	msedge.exe	100
PID 4864 wrote to memory of 1760	4864	msedge.exe	100
PID 4864 wrote to memory of 5708	4864	msedge.exe	101
PID 4864 wrote to memory of 5708	4864	msedge.exe	101
PID 4864 wrote to memory of 712	4864	msedge.exe	103
PID 4864 wrote to memory of 3712	4864	msedge.exe	107
PID 4864 wrote to memory of 3464	4864	msedge.exe	108
PID 4864 wrote to memory of 4088	4864	msedge.exe	109
PID 4864 wrote to memory of 2832	4864	msedge.exe	110
PID 4864 wrote to memory of 2832	4864	msedge.exe	110
PID 4864 wrote to memory of 4452	4864	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\rlsbj.cq.gov.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffa962ec188,0x7ffa962ec194,0x7ffa962ec1a0
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,16704992532276793659,7059142687980628600,524288 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,11952859074050304019,18019946738588838497,262144 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:2
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,15525428684230311004,15324146033050612530,524288 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:13
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,16378618054260701715,6936124980536497034,2097152 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,3747375076296617408,17454245407105714535,2097152 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,4352520173106704676,12301112240409876902,2097152 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:9
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,13171012287274556592,11969705812654983451,2097152 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5372,i,11895880044802017957,607667851381744407,2097152 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,3905429451533514499,15904009104855049596,524288 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,16189004971859844611,13480117926524940734,524288 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:14
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,16474476009575307105,18264232486645126693,524288 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,16474476009575307105,18264232486645126693,524288 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,7389050140526499343,14662886431756107591,524288 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,14789149833397584540,3833589321528928383,524288 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,6310515316161349066,12915918729012079087,524288 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,4253128032210513101,4614940652424077425,524288 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=816,i,16454482254490434940,11186732122816193553,262144 --field-trial-handle=2648,i,3831444012868851816,9184284357052627897,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c55024b5553345d2e98cc0e5474d987a84df5bc0b1d5f7dd4de667da51d67203
MD5 f846598a3ec5161f2ce7d0033215be69
SHA1 ad6d45391880686aa7f32ae36509fab4dc19ce5d
SHA512 12a8759ba6e670c537b460899857cf3c86e49344fc6d218b6e3b55e3855e089963a428659bf69849e0ae31090601c1d70e53fa4a72e88ec4c6e0975fef7a3e7e
TLSH
T1CA61D55623674DD1DFB744BD52E96898FAF4A895093B2EC06054BEBC48C6F4BC0C32A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599e98.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599e98.TMP
Size 3KB
SHA256 1f6efb75ba165290e21175c31e03a7f8f09de6e72743305ef6d44a236cd3aa42
MD5 2578b7122120cc948f89c992d6662801
SHA1 b1075c1357527432db45534b3886efc6714ad03f
SHA512 b31947117967f03689ff85e03c7651669480130725ccea07b678cff3770fe95317e009b872f2472429d9d08233fb8dfdaae1594ca565b335d1171d71a2ceae50
TLSH
T1F661C55623634DD1DF7744BD52E96898FAF4A495493B2EC06054BEBC48C6F0BC0C32A3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 26fdf588ed10fb715993d71e98962eb99adadbd172b9abd872461d8242fc6256
MD5 09408183a13a557fceca9d3cfc44317d
SHA1 c5b411885bf6a642c29a973a1a3b9633f528a796
SHA512 298a78e54b8f9385aa60e891d89b5d9a335ef45059a9d16cda171ecd90e30d1a41a26ba1f0eaf2758f95f7d6c805f1d10f66d59cfa4520255e8ecbcda3646911
TLSH
T174319CF783F4957E8A0596F0AA14AE2FCF2C0511431C7C6AC9E4AE2793F3462E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6016fe790c8dfc2588ea4f9ee087d74a514ffc341bba8c37751adfdcae0a6528
MD5 649d6045467b157e9a0aa1e794f0088d
SHA1 e842ae53a105538fec5f726905b9ee7f8a000a66
SHA512 346c1cdd64c15140f0046bdf7da9c3f97d4c321a9a74247f636191e7b1bde61f3639efa6d013cc9e65edb65b8d0818aaf55f04aa42a6752163d21036175ae770
SSDEEP 192:sxRPRnbU/fPsDn6mprQ5ezoA8p4v/g6+WNIYn8UbhtGkIgDoJ:sxRPRU/fPsDn3WK/5ITg34
TLSH
T18F32B8166A68A93B5CC7E21DFB55BF53D6F96072A1D02E44BAFC8A1C04EB6CD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2d7997933225987178303571f81efc87e2f53632cc6a5899bf32a88746045a4c
MD5 a5e7275c5c7c3bece93e72ebd97fc060
SHA1 52252d09cb7a3746e90dac5d415ccf6e0cc630f8
SHA512 1a0e4f464d5594ff1d8b32f960c5b223ba4d5973ab99b0387cf4ca11b97a29ab47d1ab2e35f00e3e6218db5a0e026d6b44a55a5709c2a2abb9bc010f599af9a2
SSDEEP 192:sxRPRnbU/fPsDn6nprQ5ezoA8p4v/g6+WNIYn8mvhtGkIgD6J:sxRPRU/fPsDn6WK/5ITw3y
TLSH
T1D632B8156A68A93B9CC7E21DFB55BF53D7F9607260D42E44BAFC8A1C04EB6CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b77ddb2c0e9a234cee61b476a389b901b5abf349d71e5e72cff4521bea487a72
MD5 79cdb13f2219d8dcdc20657dffd5e536
SHA1 29f76bf9c9c523d9e1113e26d0f8a06fc6562c7b
SHA512 8cdafe4c1143214131a42e79cd8c4e9536414c161f8aec3d01c82967874b82dc2a7bd5bc48d88c6a278b3cf99c51619613b971788dba5d63dd00466b5f0efa7a
SSDEEP 192:sxR0RnbU/fPsJn6mprQ5ezoA8p4v/g6+WNIYn8UbhtGkIgIJ:sxR0RU/fPsJn3WK/5ITg3s
TLSH
T19D32B8166A68A93B4CC7E21DFB15BF53D6F96072A1D02E44BAFC8A1C04EB6DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 525f897274679a2b475536b6879b3a7c515c527edf04c346af60db19bf8c61b5
MD5 bc8c9297aea5371d443cb535a848572c
SHA1 6d4a160a426d15c53a9d6bfd0c08d16c8f8a6762
SHA512 364a1f9cfdf4533b5b5fa696d437582b884b7270aa3ed0a9f58f49f91c9ac1115238bc8505894bb7747de9a77540107c1ade124d12f286bd6e5d79c3071d26f7
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPYrohM7:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0VZ
TLSH
T10DB2EB3B604DCB7E4F800AADDC19AFDB6D9802C79A988D4447FE950C03C77EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 abd08fab76ad17aa576cd090328368ffc89871dd7f21b2d9cdbda398ba262794
MD5 668c769cd5feb3888c38ea1377e508c8
SHA1 7b9712ba15b01fb1d1014fed7d5b2f77a3794fc3
SHA512 a94a46498cf6a35af56b00258348c4f784eff821fdc1de7d541b13a48c772feae45419561c9aa056ed06ceeb87074b60a6fb420a80633c95e2b26627d0de7892
SSDEEP 96:KRklQUuSW0Wyf/gc0K4xgW0cUUfO0pH7kh1DZpVW9yogdVK4kgzVcbD9ukK/6i+A:CklQUuSWLyfocIxgWbUUfO0pH7kh1DZJ
TLSH
T195912642B67602503D7FA71C84E99A1B86917873312CA52F77AC96B60F6BE024CFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a39fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a39fd.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 af7fd618fd3c0320488f77369b2f3c71d5bad7ae42344489876d0ca1e99dfc43
MD5 b674e51f2028258b678ba557279746e2
SHA1 8613e4ff38ed6e177a51a746442165c2c6177297
SHA512 3746b24b80754a6f9751534f7de177e20d560853467c91e8d09720fcdcb7151510e5a9bc05f2985930a9c2b16533e1d4440e55f45d5f9cd412826ce06b27b5ac
SSDEEP 768:fo3ZeDZIO0ZQRIWs8Nzc4ReyIsPoPi9PGC:fo3QIWs8tc44bsgPw
TLSH
T10EF2BF71BC68ADA3BCFAE782F6463602BEF45167D2C82D5495DD9F0C068B59D031B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0755c49907e8c61bca771cd27d59251c24dcce9a7e7f015c0db2a9343c8027d4
MD5 071deabc7e8be320d493d4e06c52b403
SHA1 786be18416ad52576c6333caa748c35666fe40d2
SHA512 ce0e947401063250c72b86ec97896d482e292e40db5429e90fcd03627a20e3a487dacb70213cbd0c4a2cb1fea56486aead4dd1c054bb8a8bbdc30148def5474c
SSDEEP 768:bo3OeDZIO0ZQRIWscNzc4ReyIsPoPi9PGC:bo3TIWsctc44bsgPw
TLSH
T1F7F2CF71BC68ADA3BCFAA782F6463602BEF45167D2C42D8495DD9F0C068B5AD031B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 aed759cb38cf5e0cdb2102a2d9fd54fde36b530dff7459827f143c429b24b8f3
MD5 6b4fcac7ed47debeb52adef3f8ae5e68
SHA1 f41c26fcd9c7ecd5252894d33f27551ed9d6cff0
SHA512 8b1e6809504a12befc38a70185451ee7aa4bd801b46b7456a487a03720714341e30dd73a8ad51debf168c756c306533bd7a697374e5a3233c668d9ee94a6e9dd
SSDEEP 768:qFQM3IwgieDZIO0ZQRIWskNzc4ReyIsPoPi9PGC:RM3CIWsktc44bsgPw
TLSH
T1E403BF72ACA8D967FCFAAB81F6463202FEF15167C1D46994E6CD9E0C058B5DD034BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6b8ca7d4b81ec4448e09f72c3630bf97b0f95bc82b9f7081f490b3483ab189eb
MD5 3287cac150055a86d68b8ff99b612c3a
SHA1 efb6814fe004a044af33eb5bdcf153dd5aca9720
SHA512 93cf24908ca7cb2138cbb8324f8aaef93c6ff087bb0046a693009b0a36976c14f9fc73c3aa6c4950bc13ae23b02a2fc0515bfc29bfa7965ec460245a23141d92
SSDEEP 768:qrv+4UNbds30IDZIO0ZQRIWsONzc4ReyIs2oeVH1S5D:qbsbS37IWsOtc44bsfEH1Y
TLSH
T1AE03CF32A8689973BCF6A686F14736437FF4911B82D81E94C8DE5F4C464B4DD031B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6e073cfb43d55890057ae1a0c0be7cf09579ed2a42b8462550cba33e22cbeb0c
MD5 a2074356848ef951faea4893a8dab39b
SHA1 7af3f1cad7e791b7fa606fb52dd5cfaf880bdd22
SHA512 e322439e113f14ccaa8fca157e3b1d11ef47cfc64859a8b7e51dc8daadb62ae93cec30d6f0a2013f6cb650f4db65582ce73428861b408a2dce15a83c83d54a69
SSDEEP 768:6rv+4UNbds3PODZIO0ZQRONzc4ReyIsXYeVH1S5D:6bsbS3+Otc44bsIEH1Y
TLSH
T1CB03DF32A8788A77ECF6A686B14776537EF8512BC2C81E94C8DE5F0C464B5DD130B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5885f07-7004-43b0-8249-c0097281d181.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f5885f07-7004-43b0-8249-c0097281d181.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download