d244c9fb6914cca150f4831d3d1a7dc4a59064ac607809b81ebac8f9e06762be

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app/views/install/install.html
Size 6KB
Sample260815-wwrbkshb95
SHA256 d244c9fb6914cca150f4831d3d1a7dc4a59064ac607809b81ebac8f9e06762be
MD5 000fd85ebde13ff50affec43eb498b59
SHA1 da06ef6bd6d3c261c75db2d17439d0c97d965dd4
SHA512 8f6ba2de26082d7ca8af337333f264608e8e37d52b61ded42a3b867fc5de0511b8c919638452f2215cf8af80a72525f03a559700f50a3706020cccdb9a898e61
SSDEEP 96:uySfNuyQTrGkSZ8kfr3fb8kffCSskfkCSYkf4gCkfwtq9T2oV65ftC8DkF:uyS1uVT/SjD5is7aAgPl9Z2CR
TLSH
T117D1400424F49A23514184FDA6E4DA03EDE1E827C229D44472BCEFD86FDBD836D072AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3228	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312918651111794"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{BECA7B10-61EB-472A-82C1-D429595974FE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 4596	1436	msedge.exe	89
PID 1436 wrote to memory of 4556	1436	msedge.exe	91
PID 1436 wrote to memory of 3228	1436	msedge.exe	92
PID 1436 wrote to memory of 4556	1436	msedge.exe	91
PID 1436 wrote to memory of 4556	1436	msedge.exe	91
PID 1436 wrote to memory of 4728	1436	msedge.exe	93
PID 1436 wrote to memory of 4728	1436	msedge.exe	93
PID 1436 wrote to memory of 3192	1436	msedge.exe	94
PID 1436 wrote to memory of 3192	1436	msedge.exe	94
PID 1436 wrote to memory of 3192	1436	msedge.exe	94
PID 1436 wrote to memory of 2496	1436	msedge.exe	95
PID 1436 wrote to memory of 2496	1436	msedge.exe	95
PID 1436 wrote to memory of 2496	1436	msedge.exe	95
PID 1436 wrote to memory of 124	1436	msedge.exe	96
PID 1436 wrote to memory of 252	1436	msedge.exe	97
PID 1436 wrote to memory of 124	1436	msedge.exe	96
PID 1436 wrote to memory of 124	1436	msedge.exe	96
PID 1436 wrote to memory of 252	1436	msedge.exe	97
PID 1436 wrote to memory of 252	1436	msedge.exe	97
PID 1436 wrote to memory of 5632	1436	msedge.exe	99
PID 1436 wrote to memory of 3164	1436	msedge.exe	100
PID 1436 wrote to memory of 5632	1436	msedge.exe	99
PID 1436 wrote to memory of 3164	1436	msedge.exe	100
PID 1436 wrote to memory of 4600	1436	msedge.exe	102
PID 1436 wrote to memory of 3140	1436	msedge.exe	106
PID 1436 wrote to memory of 3248	1436	msedge.exe	107
PID 1436 wrote to memory of 4928	1436	msedge.exe	108
PID 1436 wrote to memory of 2904	1436	msedge.exe	109
PID 1436 wrote to memory of 2904	1436	msedge.exe	109
PID 1436 wrote to memory of 4412	1436	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\app\views\install\install.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2a8,0x7ff87555c188,0x7ff87555c194,0x7ff87555c1a0
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,16183118080635184174,610841489612688340,262144 --field-trial-handle=2544,i,16631948104341496935,6382609981251879108,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,12631209981694890786,9769656256505600236,524288 --field-trial-handle=2544,i,16631948104341496935,6382609981251879108,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,2762302232744351052,975981644473973337,524288 --field-trial-handle=2544,i,16631948104341496935,6382609981251879108,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:13
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,1365471879449275729,7575566374514499386,2097152 --field-trial-handle=2544,i,16631948104341496935,6382609981251879108,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3364,i,3040059440281486834,14508825614436083005,2097152 --field-trial-handle=2544,i,16631948104341496935,6382609981251879108,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,6984828890652846354,8214765010648856078,2097152 --field-trial-handle=2544,i,16631948104341496935,6382609981251879108,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,5071028126504795245,11503258765351423890,2097152 --field-trial-handle=2544,i,16631948104341496935,6382609981251879108,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,7652721700522618117,1727847974263714124,524288 --field-trial-handle=2544,i,16631948104341496935,6382609981251879108,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,11364408826361295001,26824600166529424,524288 --field-trial-handle=2544,i,16631948104341496935,6382609981251879108,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,2451443782646870757,9667201145246729503,524288 --field-trial-handle=2544,i,16631948104341496935,6382609981251879108,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,2451443782646870757,9667201145246729503,524288 --field-trial-handle=2544,i,16631948104341496935,6382609981251879108,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,13903137930440429675,6092920214300693825,524288 --field-trial-handle=2544,i,16631948104341496935,6382609981251879108,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,17546488901641886909,2573381670383232009,524288 --field-trial-handle=2544,i,16631948104341496935,6382609981251879108,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,13160899540074375804,4625567007961605963,524288 --field-trial-handle=2544,i,16631948104341496935,6382609981251879108,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,17625682779609988381,8095863227160552034,524288 --field-trial-handle=2544,i,16631948104341496935,6382609981251879108,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,12317758423893655159,4577059051350092128,262144 --field-trial-handle=2544,i,16631948104341496935,6382609981251879108,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 211bc30c13616d76005fe384db7dcd9ba3c681a54b5e06161cf18e74d1fdd6f3
MD5 732a442177c45877400d7a88690008ad
SHA1 4d364f1b202471dd9485226a0311392c1fce4d11
SHA512 4fcbb512d57742ff46f3652d44d664ca9a4d5bab7504228b34325fabb0b419c1e814d30ebc39930123a4c0ac698a5ce43c9272cb77fae6033e9bac9dd34377bb
TLSH
T171E0C24043314655EB580C70A9C5C29633F0CEBE72930A6461E46C744942FB103C042B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594f20.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594f20.TMP
Size 360B
SHA256 f13e46710d2474f70801b157ff2354e2c1ccc5da3d643049c6f15e42002fd4da
MD5 3120eca2fab9bf59141a866c5844c6f0
SHA1 4ff2d207582a72823cadc20b6b2e81dc7574adaa
SHA512 34d87b7f81a77dac1ec6d43ffb37805595bb68de55f45bb7171d1d0d2d8bff8bd9109e5f613605be4fdffdac015528e420fea1add6f06f59dc1db5193c34aced
TLSH
T1D5E02E0083220244EF591CB0ADD9C2AA33F2CEFE72930B6960D86C344E41FB113C041B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fa3043f-ecec-4ed8-8174-123872dc000e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0fa3043f-ecec-4ed8-8174-123872dc000e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

62259bb0-dc8f-436f-b41a-8df0bdcef4ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\62259bb0-dc8f-436f-b41a-8df0bdcef4ca.tmp
Size 1KB
SHA256 c40149fc7179736c0541c593f9ed115a0bcdfab4ba04346d454bddc2f4f25e01
MD5 c3fbf705c017786764c113bce23c418b
SHA1 f6d5ca6487c2255bc44ef8b85b3b3b4fb3ce4173
SHA512 c6d98c638e03a5a535706e1efb5d99afda7875ae746af2d3b905f9ce138acb63044940b858b8ed19d8978b8a9626d79daf78cb70cfc90b6faaed795898cb22b1
TLSH
T14F4190F783F4857E8A0196F0AA14AE2FCE1D0515431C7C6AC9E4AE2B93F3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 50fc1179a85cb516d6ed8f1ca73f37c2a8dff697c11f8d9b77f35ccc6d0fe93a
MD5 1996c6db1c70eb9d677f6fd12fbe2d24
SHA1 e4157640154d6645384fa9cc2549e9755cd10f85
SHA512 3b1ec32b756a925e248ba5dea2d1eafe4d9aa976c31c6c22e076e0caaa0fa175d763b505b64df774c4327bb6a4cf2ba320b782c9dc7a355df85bb7021e59df46
SSDEEP 192:sxRBR9yM/jK1Ml8wbA/ftsHKHm2Sm7avyzoD8p4b/g6+WNIY3B27jG8IgIJ:sxRBvlA/ftsHK2oe/5IAMs
TLSH
T1F852DA15AA246D7BCCDBD20DFA517F53D6F95573A2901E44AAFCCA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 51f348418b90fc02607df94b1280c24e843c05677a016b32224dd37d6d06eede
MD5 63ab7ec14202dab9801a599308117b37
SHA1 c54a2ce7685cb883bbda922ae4f2808f00f5854e
SHA512 e508f2d968d50693bfccb14a6b2390899f8601b05bf66e650477c0fe35c2e9ea4958ec9c04087ba1eca3c9e7b31c19bbde2e8f3eca1f7efc22b87a473813dbe9
SSDEEP 192:sxR+R9yM/jK1Ml8UQ8bA/fts3sHm2Sm7avyzoD8peb/g6+WNIY3ZLjG8IgDeJ:sxR+vqqA/fts3s2ow/5I02
TLSH
T1DD62F915AA24597BDCDBD20DFA917F53D6F95573A1901E04AAFCCB0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 226054cc0aadaf2face72ee1ea099832400735d69584f3aa5622954f423ccd2d
MD5 607c53d2ea3a468ab5cb77edf5992cfd
SHA1 4faba8bff152f7fc30fd35dc111337cd9272c407
SHA512 11a4c2304628bf8c57214bc87f35f7da0aad102058dad4a59be5b3afad283c60ba0312cabefde2354d144b0c02895a4dad7128c82ec7980279f44d984f778d36
SSDEEP 192:sxR+R9yM/jK1Ml8wbA/fts3KHm2Sm7avyzoD8p4b/g6+WNIY3B27jG8IgD8J:sxR+vlA/fts3K2oe/5IAMM
TLSH
T14552D915AA346D7BCCDBD20DFA517F53D6F95573A2901E44AAFC8A0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 da1dcbda84ab3efcca984f8a95070e12b6a563bf31a4f2fe47d0075ed0fe1c2b
MD5 4bb40f0c8665c54ac883f37c6d2d973f
SHA1 affb44b393ff22ce2dc74264284450e7b8dc7857
SHA512 8c4f4e20ca8dfb4891bb4967d8a7059a42271a983ddb336eea0dbab0a136c835e7b7f7f33d15b64f582bbe08c355df0f266d9514e5e72f1a389577d0ba6c4200
SSDEEP 768:GiqbvkWg0CfDs8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+MW6qroZliY:GiqbvkWg0CfDsu1jaDF6BZMY
TLSH
T12AC21C3B640CC77E4F804EADEC2AAED76D9801CB9B588D5447EA890C03C67FB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 e84185707ea7ccc3475287657d02399babd6d92acf6b4917aad6eab1c672893f
MD5 f72d02144c7a50febb7930da28544e89
SHA1 8babd5a8962bc57a919ba0f36684753bd4c0724b
SHA512 3f703d3eee9ff2cb24cb8cb3c478ed6d51272c498645073cc859520e5450967829e902f61a315ce37e62a1a1602e724e0a9ed621752929c4882c4e223250eab5
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHEFw0Oy2UWS/fg8UK4Rg2Uc00/uUJHk0kl:C1i7PF/DWrwfX9mgpct1o7zsHEFw0OyJ
TLSH
T1C1C12391713A0345397DAA0C91FDD86EC3C379A3311CA86B3BA901A65F66E038DFD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

5b243542-3edd-45be-b991-d6ac55daaac4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5b243542-3edd-45be-b991-d6ac55daaac4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1a7493073f716a5a989ed7421e6a44d4d047c65e137f96ae5adf7ddb34c8158a
MD5 af8e69d7233d9138dd1c7716c275ca0a
SHA1 2b036bf02431670243ef75ab283266df220415a0
SHA512 5b53bf5b7b5799942afabe3e6ac13db8c567bb69d139bd02d84a1bdb36638678fd2fd82ddd017807e1134764a61d10e12811d2b1521ab4bbba4ed7c3a40c9893
SSDEEP 768:Brv+4UNbd43wFc+wfZOsfcR66Igfcl66RvShCQsx2bwWV:BbsbO38wf7f16Igf56RvS60wO
TLSH
T1F403CF72E8789A339DE79248760A7B53BEB95173C8C54B84DADC0B0D018669F371FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c93a948fcb2e5b4c11512cfbb448ca45276c045470727e23080c3f74c033a96c
MD5 5b9d9fa5b911d0065302aa5c0b1da12f
SHA1 22fbb39a3f356ae28f5e99181daa8e800592fad8
SHA512 bccb068e32f588513f4ea4d65f2d2a9db646dda9972a6abb1db1ee7a00c98b1b38cc21fde8be2d5ecbb5f30751d2c7999055b79b7e573d269672d50712331ae2
SSDEEP 768:grv+4UNbd83VjWnc+wfZOsfcR66Igfcl66HvShCQRxoxM:gbsbm3Vj8wf7f16Igf56HvS9oC
TLSH
T15403C071E87899739DE25248B2467B53BFA96173C4C84B58DADD4B4C01C32DE2B1FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f18fa5dc383f16311f3fc9e186082864f2e38ce0458ee11d8c91c1a1de737727
MD5 69d5ba4f3e922bbb5ed4ed7e34208a37
SHA1 6a63e7303fca4e7c8ccf32e309abbbb96bab75c7
SHA512 94d74ae73bcc9aaf0df8ebc8ccf549adeae53b701b09f20f2895b493a874958cae9e453dab8ac5491259a44943b67219e7830c09f7979de2d9738cf44c686906
SSDEEP 768:jf3AjSnc+wfZOsfcR66Igfcl66UvShCQRxPi9PN6:jf3Ajowf7f16Igf56UvS9PL
TLSH
T1B4F2B0B0D8B45E739CE6A34876462713BEF55133D5C84B48DADC8B0D05C369E1B1B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6d7075f54d407f0636ff870beb5899dc70ea8c1d03a4d440f575536a443fc81e
MD5 ac7e6584be2702acae811b9a06346406
SHA1 2f6db43ac5d4e6bb7a4ebc09a5ddb32389c66258
SHA512 f99084cb96e3cab2fe4a5ae45d98a9e60ce22ba367018edfb1b5f884fa9c782b04af7432e20057394d60db581e9224bbd89a840335ea4e214bc80b9a63b63799
SSDEEP 768:8f3JjSnc+wfZOsfcR66Igfcl66UvShCQRxPi9PN6:8f3Jjowf7f16Igf56UvS9PL
TLSH
T1ABF2CFB1D8B45E73ACE6A34876462713BEF95133E5C84B48DADC8B0D01C369E2B1BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 68d75b7356b1709e85be7bf1f1013a424afa8178023b444842bcb5083ac7cf7f
MD5 8f404078b09805b408d4b3b459f1e32f
SHA1 a038ca31894ca2d11dcb959a3ca49478d9976232
SHA512 ad1c5e5f2508d674b18f33577e1f6d5910f67740b23d8eb7e5b6ece5bc56cb5bbead94c5d8cb10a90e8c66f576349e9b56d2f8edad7113437c425639adb32deb
SSDEEP 768:Rrv+4UNbd433vkc+wfZOsfcR66I/vShCQtV2bwWV:RbsbO33Wwf7f16I/vSR0wO
TLSH
T14A03C032E86899339DE792487646BB637EB96173C8C54784DADD4B0D028369F370BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac19f763-ebda-46c6-94bd-1d6f7c95e6de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ac19f763-ebda-46c6-94bd-1d6f7c95e6de.tmp
Size 38KB
SHA256 27aac48a5ec31321e6f636ac66623cc7941230a14cb6a5e1a3247b07ebf63757
MD5 bf3748dcf29e93d9b65b39e0e44b2f59
SHA1 2722867db4f97c9f477407b590d9bf23491155d5
SHA512 7db3ec91ccd488e7999d3fbba8c15ff689fd97e6b57bd5b3ed7f395da9393553d45983e33f253e128d9044f7dcacb6b918aa3af5a9cb8626f364be17aa18953c
SSDEEP 768:XFQI3awg5jSnc+wfZOsfcR66Igfcl66PvShCQRxPi9PN6:qI3yjowf7f16Igf56PvS9PL
TLSH
T14903AFB2DCA49A73ADE69788BB492712FEF65173D4C49654EBCC8A0C01C32DE171BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f45e8f29-7709-4ac6-8f86-88aee2d45774.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f45e8f29-7709-4ac6-8f86-88aee2d45774.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download