f84d338ccedb0c43ae3b85538d3ef85b0bb2209c7c7117111e016b6e0e6f556b

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app/views/dashboard/partisal/footer.html
Size 1KB
Sample260815-wwrbkshb95
SHA256 f84d338ccedb0c43ae3b85538d3ef85b0bb2209c7c7117111e016b6e0e6f556b
MD5 e2a5bc6ca93917cc6d5ca314a179e93d
SHA1 9cf7c035550e9b6912b9251ae1cf7d0a427cd3ec
SHA512 043ef83d7502319b897a1fa8674d24832cfa28e5548cf8b5f85c4f205ee4192064cb10bb645c19e1d7334e214cd3f2cdf6105c1c5d07c52474fbbd485cf2d652
TLSH
T14411515EADE9E47515402CBB10A9A38C1CA8E547F21CD8AE39FD86512F127DD0D23D34
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4636	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312918527621221"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{B750C8BC-7276-4325-8F3A-0524E06F36D0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 4932	3244	msedge.exe	89
PID 3244 wrote to memory of 4636	3244	msedge.exe	90
PID 3244 wrote to memory of 5772	3244	msedge.exe	91
PID 3244 wrote to memory of 5772	3244	msedge.exe	91
PID 3244 wrote to memory of 6080	3244	msedge.exe	92
PID 3244 wrote to memory of 6080	3244	msedge.exe	92
PID 3244 wrote to memory of 6080	3244	msedge.exe	92
PID 3244 wrote to memory of 4224	3244	msedge.exe	94
PID 3244 wrote to memory of 204	3244	msedge.exe	95
PID 3244 wrote to memory of 4224	3244	msedge.exe	94
PID 3244 wrote to memory of 4224	3244	msedge.exe	94
PID 3244 wrote to memory of 204	3244	msedge.exe	95
PID 3244 wrote to memory of 204	3244	msedge.exe	95
PID 3244 wrote to memory of 4556	3244	msedge.exe	96
PID 3244 wrote to memory of 6004	3244	msedge.exe	97
PID 3244 wrote to memory of 4556	3244	msedge.exe	96
PID 3244 wrote to memory of 4556	3244	msedge.exe	96
PID 3244 wrote to memory of 6004	3244	msedge.exe	97
PID 3244 wrote to memory of 6004	3244	msedge.exe	97
PID 3244 wrote to memory of 4696	3244	msedge.exe	99
PID 3244 wrote to memory of 4696	3244	msedge.exe	99
PID 3244 wrote to memory of 5080	3244	msedge.exe	100
PID 3244 wrote to memory of 5080	3244	msedge.exe	100
PID 3244 wrote to memory of 4664	3244	msedge.exe	102
PID 3244 wrote to memory of 1432	3244	msedge.exe	106
PID 3244 wrote to memory of 5040	3244	msedge.exe	107
PID 3244 wrote to memory of 628	3244	msedge.exe	108
PID 3244 wrote to memory of 5056	3244	msedge.exe	109
PID 3244 wrote to memory of 5056	3244	msedge.exe	109
PID 3244 wrote to memory of 2972	3244	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\app\views\dashboard\partisal\footer.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x274,0x7ff91807c188,0x7ff91807c194,0x7ff91807c1a0
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,7513150171142867781,13284593407098339533,524288 --field-trial-handle=2168,i,7802103216945884063,4287239974978862104,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,4905249699881338231,14469793854432675775,524288 --field-trial-handle=2168,i,7802103216945884063,4287239974978862104,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:13
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,15323559376586015168,9787475815209142511,262144 --field-trial-handle=2168,i,7802103216945884063,4287239974978862104,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,4107337078544619328,14597082388338509647,2097152 --field-trial-handle=2168,i,7802103216945884063,4287239974978862104,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,7519814421722433225,95613255146673272,2097152 --field-trial-handle=2168,i,7802103216945884063,4287239974978862104,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,8261570540651072282,11908169779038008439,2097152 --field-trial-handle=2168,i,7802103216945884063,4287239974978862104,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:9
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,9190377363524629453,11895458221171667586,2097152 --field-trial-handle=2168,i,7802103216945884063,4287239974978862104,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,12540569102468124735,3281820570192806064,524288 --field-trial-handle=2168,i,7802103216945884063,4287239974978862104,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:14
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,13173270973514018878,9582213450018015123,524288 --field-trial-handle=2168,i,7802103216945884063,4287239974978862104,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,18213431655086727477,11072534029955686,524288 --field-trial-handle=2168,i,7802103216945884063,4287239974978862104,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,18213431655086727477,11072534029955686,524288 --field-trial-handle=2168,i,7802103216945884063,4287239974978862104,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,15585601248640276761,17797953183621067240,524288 --field-trial-handle=2168,i,7802103216945884063,4287239974978862104,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:14
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,4847394636030780329,13142155300284075565,524288 --field-trial-handle=2168,i,7802103216945884063,4287239974978862104,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,9103884220137312383,17340198934778494704,524288 --field-trial-handle=2168,i,7802103216945884063,4287239974978862104,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,9902494767734670204,12727314043678695881,524288 --field-trial-handle=2168,i,7802103216945884063,4287239974978862104,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6212,i,17617684900234139044,2516871990173361077,262144 --field-trial-handle=2168,i,7802103216945884063,4287239974978862104,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

623f460d-6a4f-48c0-a0bc-7cf0cba5792f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\623f460d-6a4f-48c0-a0bc-7cf0cba5792f.tmp
Size 11KB
SHA256 a55f189c8764ee84ecd302143a79c22e4bb45d1d5f9332986a69674fa90ba22f
MD5 2e8ddb5a7f6b6a04262ed819d376b298
SHA1 b594c7a87c47a57a93fa6f41db8626c141ca5fca
SHA512 a2582cc1613dce178b516a64aff9ab8d1f9d36e7843d86dd197db8b0623269ef6991444c7ee4030609a1bff7f02b32c4f23cccf1f8a8c6d00c47259004aaa353
SSDEEP 192:sxR6R9bC/fTsyNdKrjDGzoA8p4p/g6+WNIYE/UjiK+GQfIgIJ:sxR6nC/fTsyNdyw/5IYels
TLSH
T1DC32C8156968A97B9CC7E21DBA65BF53D6FD5033A1D01E48BAFC861C04EBACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 71946b9e263a8bc528b16463ff3b6ccfde708772a2f202c65c8e9a355d7a05f7
MD5 88ebef50a16d7e2c8bb9ff585472fb2d
SHA1 aeb1d872eb3e3bc83f5ad9af9aa0f7a6749ea4a8
SHA512 91afce2c1e38dd156e8448a20d4ce9c356b633c2a489b43e5848b469a0fdbacb0854e74fcf7e7ced5124435c6c4c66339b099755820cf6276cb1976044993b06
TLSH
T15E51966043272EF1F7A4B8B216D118893F38D02DE52B6E1ED1D3FE3448973602E224A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b59a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b59a.TMP
Size 2KB
SHA256 b83ebb5b54b7e1c8fe95d0139c88a94a19dd491582b550407264e4752f59e8eb
MD5 a84d5d43f3df0b9f079fa5c378e432ff
SHA1 714a9019cb9fa37a48840f834ac457d0e9c9125b
SHA512 5a48538b6efaf3c8c59c4a45ec67b936c877f987b0cd3dd3b9332c0c4152061663f34d0bd8a87c6337028bb5c6cd2af23d3a8fb93e37508320428f44d6e52d7b
TLSH
T1AB51976043272EF1F7A4B8B216D014893F38D02DE52B6E1ED1D7FE7488973602E224A3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 41294226837cf6b26d7f0228fdcf3547e2fc659d28efd58eed92d1f5666931c5
MD5 ecd53dfd527690d19b7e66ef66240b68
SHA1 c1ddbaf62dad5f9f93eff26ca2dfa0363e4f4202
SHA512 a75d322be54af163bdb7d997388781c4d703d5489a84365d64e0a6ddd3c007b3c0463a107472092b2d0faabfb1c8bee6e07eb6892d98bcbeaf07a3633fdf4e40
TLSH
T13241DEF787F4857E8A0196F4AB146E1FCE2D0515432C7C6A89E0AE2B93F3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2fce998488e63b53fcab5826d49e7b5be2d2425c11cff81f4caa63c5bd0e4c5e
MD5 09abd1843bd1ae34cae9dc1b31c45da5
SHA1 f23252cd7dc034063fe56dfed70fca1bdd517901
SHA512 c47a64753b1bda6f3375f6d90651166b5964e97b91e9aff7cb6a005381283bd6892679a3b03fa33c496ff54efd75d2f4da047a8d7148e7d966cc56bd6bc5cd79
SSDEEP 192:sxRRR9bC/fTsMKdKrjDGzoA8p4p/g6+WNIYEzUPiK+GQfIgDdJ:sxRRnC/fTsMKdyw/5I0alT
TLSH
T15642B8156968A97B9CC7E21DBA55BF53D6F95033A1D01E48BAFC871C04EBACD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1b71b2c7992ec10d7c25bf31edb9140702511f3734e2b92872628c4244092882
MD5 da6566a539cf11ea31e6d632b1161dd6
SHA1 2d832f8b069c9a3f23f8bdced7e1096729a63ee3
SHA512 f320528cbeea36735cd6b4011158d6971de4f25ccb3c7d2ace35a7d5fdd955ae68cfa2eccec2de55b42321989fa48c8a59bee4434df1384dc340f04f760095be
SSDEEP 192:sxRRR9bC/fTsMNdKrjDGzoA8p4p/g6+WNIYE/UjiK+GQfIgDLJ:sxRRnC/fTsMNdyw/5IYel5
TLSH
T14D32C7166968A97B9CC7E21DBA65BF53D6FD5033A1D01E48BAFC861C04EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 aa4bd0b23863398025887775089711ae2b4193bea6c5bff4bb81289ef0e5fc2b
MD5 e6bd6805f412c9e35e83dd6e1da6a456
SHA1 4382305312289412b98fe3e226460056d55d7c19
SHA512 c0b9d5f6e7edb3a60729df380105f4c2b343e2b5fd74738d4046bc5cf305c57e3a947098a4b454dc5ac4bdbd58a4ba015f8a1ccca3d9091e09150ba2efec0635
SSDEEP 384:0OhQi3gfCtgHZFfeQKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVwY9VHRAXroZCH:0UQi3aWgH7feQ8F1+UoAYDCx9Tuqh0V/
TLSH
T1C9B20B2B600DCB7E4F801AADEC296FD76D9802C796588D8047FE894C03C77FA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

98830ffe-e5b3-4401-9080-6529f6ba57ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\98830ffe-e5b3-4401-9080-6529f6ba57ba.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 99c9d24c2256f42603522d894f397a3d3282e079a50ee035f1b7e309e914adce
MD5 91c955c162d667e63067fb898be728f5
SHA1 1fa81cebefcc07b49c4a527834567b3cbe918edf
SHA512 dcb409969d95afc4dc695ce50c241e1aa915ac9ddc8f65c0ba09afc9f4e6fea428a53dcd6f6fea154af4b326b06f6ea0c8d76372b12d268372b45d1632a219d5
SSDEEP 768:Yrv+4UNbdm3f1qGWjDVsK48dHeByERRFzjK3Y1oH:YbsbM3fwGen48dHSyw/LoH
TLSH
T18903BFB1A8686E734CB7D28A76437A57BFF0421386C81664C5DDAA4E84CB0DD170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8f0f264e534baad583c107caa8ce895735d99bf60eb9ba0aeaa5174d553cd4c5
MD5 be13c4a8d0076b8be581cddd4b1ac5cb
SHA1 b7b8f13df4eb7a7dc3c2c71ba1eb9d311cff9a99
SHA512 fa853c1cea747a6e0fc02160c4c5cd6826ea2f13e644e29389eafbf991f3249c951ef6d3892bb6d7da0a673b552a31582e31fa0d11a3a25de49a1f6914fdd85e
SSDEEP 768:U53S1qGdjDVCK48dHeByERRFzjK3Y1Pi9P1tq:U53SwG9J48dHSyw/LPatq
TLSH
T14BF2AFF0A9A45D634CBBD78E7A433717BEF04213D2D8666496DDEA0E44C71AD030BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ab15bc53c49947fbfe0646c669f0dadf71dc224dd75151d76b55a7715d1fff1e
MD5 55158d7e7607530b2a3539d0d673f0b6
SHA1 4381cec1dd1f865874752008e19343482c7611f9
SHA512 40ca8a1a32e39a3bbff44bcee1089dd3ebdef5047b4d46cab3a84a4c8504e87a072ec5dbf76ae6508008ccfba3aec796a75fe99b3799a4ebad81ce09d2dd3526
SSDEEP 768:Nrv+4UNbdf3DqG9xDV2K48dHeByERRFzjK3J1eVH1SCj:NbsbJ3eGDV48dHSyw/wEH1Z
TLSH
T19603BF71A9A85E734CE7928A7583761BBFF4421386C41B64C5CD6F4E858B0DD030BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b9c19e011a89bae0e0a63b00bd10eb1fa4893cf249235c259e5e66a05ac3e67b
MD5 f3c77c6055101bc10ab39aa0875516f6
SHA1 990be696d3ba7eab45435bf820d16cafcdefd78c
SHA512 183abbc6dda69575b91ecc24752e915e74f3c45b36abed4747b61795a916b393aa7b5cb3b2cf2d97e618a55add673f153caa1caff553cd7c2806dc05aecd7bff
SSDEEP 768:Qrv+4UNbdf3xqG2iDrK48dHeByERRFzjK3Y8eVH1SCj:QbsbJ3UGfe48dHSyw/2EH1Z
TLSH
T18103CF7168A85E734CE7D2897683B65BBEF4421386C41B64C1DD6F0E85874DD130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ded362b0b1aac20d8a43e5202e0d9cc40d839437d129b20662990e607cb705b6
MD5 1da35ba585b7c3a0647391c75c31384d
SHA1 a97d6c59d208dd62b5ad264e092724b66d89bad9
SHA512 0ca946a62ba6f8fdd9d567ae5be2cfa3f241ac93b730027bbab89e1d4c2a49e5f87808dc40994ed0d967a4b886ffc289e636c0da96431faed8a9fb898acd94bd
SSDEEP 768:053f1qGdjDVCK48dHeByERRFzjK3Y1Pi9P1tq:053fwG9J48dHSyw/LPatq
TLSH
T162F2BFF0A9A45D734CBBD38E7A433717AEF04213D2D8666492DDEA0E45C61AD0307D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f4a8efac-4894-4193-b54b-5e37cffdc1fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f4a8efac-4894-4193-b54b-5e37cffdc1fa.tmp
Size 38KB
SHA256 333288000370bcf5fef6d5fcb43b6bdf2093c4ecc78768e7ed9e45e5c8592d18
MD5 292d093c15527a8790db487b2c7a413d
SHA1 8b19d90e42c1726f096ce476d84f28cb13f64ded
SHA512 95dd87339e07e5b4761ca310ceecdbc996b9f236d3dfd9fe3dee2c6f445b1587b7f3e96ff5c684a0a8c74662cd4681552983e2b2e45d37f6afb45bfec1d92f0d
SSDEEP 768:YFQQ3JwgA1qGdjDVyK48dHeByERRFzjK3Y1Pi9P1tq:7Q3YwG9d48dHSyw/LPatq
TLSH
T1C403AEB1999499779CBBDB8ABA473317EEF04223D5D4A66493CDDA0D44C709C030BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download