214e0dc3d6b6d29d0d3dee18bde6636ac080ab8c35988195b1f6bff39f4f0f00

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MEMZ-4.html
Size 224KB
Sample260825-k2swtage48
SHA256 214e0dc3d6b6d29d0d3dee18bde6636ac080ab8c35988195b1f6bff39f4f0f00
MD5 48d3717807e8048376684f54a798a690
SHA1 cd7226e92529ece351b41dabe7016164bd242627
SHA512 b7dbcb99210fc710cda1ef461af68fba3f5fb75d33f2314e497f5b809f8392068a25616b604b35109765627a357638395aafca168c2c6324401ae09115dbc87a
SSDEEP 6144:MIUDNSaM7k9UREMj82NitCvWdpwmOJ4XP2RcrPkGzQynhBbQVFB3lBzx9F20kxqh:5UDNSaM72UREMj82NitCvWdpwmOJ4XPo
TLSH
T1F324C8B1B071E33E019F229AF1B05B50C3D3A69BC7566DE6D02FC6A845D2C88F7A3156
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2072	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321223846669052"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{C0297FEC-D215-441F-8FD7-8F89BD69A014}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3216	3040	msedge.exe	89
PID 3040 wrote to memory of 2072	3040	msedge.exe	91
PID 3040 wrote to memory of 5892	3040	msedge.exe	92
PID 3040 wrote to memory of 5528	3040	msedge.exe	93
PID 3040 wrote to memory of 5892	3040	msedge.exe	92
PID 3040 wrote to memory of 5892	3040	msedge.exe	92
PID 3040 wrote to memory of 5528	3040	msedge.exe	93
PID 3040 wrote to memory of 5580	3040	msedge.exe	94
PID 3040 wrote to memory of 1524	3040	msedge.exe	95
PID 3040 wrote to memory of 5580	3040	msedge.exe	94
PID 3040 wrote to memory of 5580	3040	msedge.exe	94
PID 3040 wrote to memory of 1524	3040	msedge.exe	95
PID 3040 wrote to memory of 1524	3040	msedge.exe	95
PID 3040 wrote to memory of 2356	3040	msedge.exe	96
PID 3040 wrote to memory of 2356	3040	msedge.exe	96
PID 3040 wrote to memory of 2356	3040	msedge.exe	96
PID 3040 wrote to memory of 2344	3040	msedge.exe	97
PID 3040 wrote to memory of 2344	3040	msedge.exe	97
PID 3040 wrote to memory of 2344	3040	msedge.exe	97
PID 3040 wrote to memory of 1976	3040	msedge.exe	99
PID 3040 wrote to memory of 1684	3040	msedge.exe	100
PID 3040 wrote to memory of 1976	3040	msedge.exe	99
PID 3040 wrote to memory of 1684	3040	msedge.exe	100
PID 3040 wrote to memory of 5856	3040	msedge.exe	102
PID 3040 wrote to memory of 3488	3040	msedge.exe	106
PID 3040 wrote to memory of 4228	3040	msedge.exe	107
PID 3040 wrote to memory of 1544	3040	msedge.exe	108
PID 3040 wrote to memory of 3744	3040	msedge.exe	109
PID 3040 wrote to memory of 3744	3040	msedge.exe	109
PID 3040 wrote to memory of 4720	3040	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\MEMZ-4.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffaa269c188,0x7ffaa269c194,0x7ffaa269c1a0
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,15686018734036496971,8515476087231144770,524288 --field-trial-handle=2276,i,4395951040180845369,9436319131761116198,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,6308654811745580738,9571721739058481907,262144 --field-trial-handle=2276,i,4395951040180845369,9436319131761116198,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,8288998364399830909,13753602954545173209,524288 --field-trial-handle=2276,i,4395951040180845369,9436319131761116198,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:13
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,7210646241619489070,8009034581681566316,2097152 --field-trial-handle=2276,i,4395951040180845369,9436319131761116198,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,9646428227306200522,15297958565663921400,2097152 --field-trial-handle=2276,i,4395951040180845369,9436319131761116198,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,11940352705321028014,3072714950162351504,2097152 --field-trial-handle=2276,i,4395951040180845369,9436319131761116198,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:9
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4364,i,18073745536980394984,6766775616757715836,2097152 --field-trial-handle=2276,i,4395951040180845369,9436319131761116198,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,13611081617719354576,9699047189252182512,524288 --field-trial-handle=2276,i,4395951040180845369,9436319131761116198,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,16969464731194077454,8636266503441050089,524288 --field-trial-handle=2276,i,4395951040180845369,9436319131761116198,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,12988851207090619678,2850534904027777570,524288 --field-trial-handle=2276,i,4395951040180845369,9436319131761116198,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,12988851207090619678,2850534904027777570,524288 --field-trial-handle=2276,i,4395951040180845369,9436319131761116198,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,15109867343209815312,14382828122951986904,524288 --field-trial-handle=2276,i,4395951040180845369,9436319131761116198,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:14
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,16411667582758081928,898130823967017626,524288 --field-trial-handle=2276,i,4395951040180845369,9436319131761116198,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,14788105768887217426,7640853037192897343,524288 --field-trial-handle=2276,i,4395951040180845369,9436319131761116198,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3068,i,8178603896185871936,14198889420490586735,524288 --field-trial-handle=2276,i,4395951040180845369,9436319131761116198,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6560,i,16694287737281600915,3535544774473576626,262144 --field-trial-handle=2276,i,4395951040180845369,9436319131761116198,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8d02a320340cbc568b91ad6dfbececb61c153b8e4f07d3cb46222c4afe18b923
MD5 67fc26f3c11c7c7ac4b09142a03379b2
SHA1 03797e0a92cb2d2725bc6b25290f8a1f45a279cb
SHA512 7ce1a2dac55e34ec17fc2a5a4aec540f016455c5ad37a6d691391cce1912496105ebf44cf700c9733c2d5247439f8a30e01f06390721edb3b6f876a04cb39ff9
TLSH
T15E6183DB032209E1D7249A7BE0F6245A36F0A4994D7F6E018B3CEE345C46F18A1F092F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f1d8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f1d8.TMP
Size 3KB
SHA256 dd9436e9c109e6a60114d83999c5eb4a8a059dd42311a9936c470a2d430e9933
MD5 eb549885c5da8649db3c03c3f344359c
SHA1 8e4a12c6b57ab9013dd5af1eeddb714ea6d3b599
SHA512 7f824208e5c3141f75d4d382e4c27995f4a2dd5d91648dff1757ee61f7d5fc777e1c6d1437f954b285719d43ae4f7aaa37e1668f3c0a347c7cc667c095874357
TLSH
T1C66183DB072209E1D7209A7BE4F6245A32F1A4994D7F6E018B3CEE345C46F18A1F092F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ecec90cd247adc24e9c8cdfdec811571103214502a4459d5a7975be08ebd3188
MD5 72b172a79b8c92f5438cef04f11c2e5b
SHA1 fae844b33f96484eda1a3cdd7f98bd6ab3c4ddc4
SHA512 1b7a34358da5dd5e0985917811f4462f2bb015a2845bdf5818572128e891e58352856312f73bfeb69403597f9af660088b7315ddccfaf53921ad89cd6160cf37
TLSH
T13241BFF783F4866E8A0196F0EA14AE2BCE2C0516832C7C5AC9F4AE17A7F3471D14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 77fe385f2dd433a98c2162b872a05927d7d7f6654588cae2d1ac644e65910535
MD5 406532daf31030fab2e6755fe32fa87f
SHA1 1418646bb311e0add728847d68ac2e1971d605ae
SHA512 0bd6d6ecd7caa65289de3130e111c083544fdafae9f8f06aa4f7422ec07aeb36e00813651a2b89b705658b3324bd49553bcfb4ff24ca1ec195c2676ed16263db
TLSH
T14441B1F783F4466E8A0196F0EA146E2BCE2C0516831C7C5AC9F4AE17A7F3471D14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 37681eabb435b3fc1cd9b3f91ff9e1ce84e0bf2c0af449d87a51f97c02c0e5cf
MD5 e09c940633fc6535b0a1fc0cdca2934f
SHA1 3ba55738e7392c568e191a2655dd97269f279a52
SHA512 fc4381ca880eb49be6bec5a2b7a4e734e1eb3837c2c70971121f462e009b4a7d1947e17d922366fa3b089939163a30f8367a2c6dd2716b1d0082c4bccd33e9e8
SSDEEP 192:sxRPRYba/f8se3YCbczoA8p46/g6+WNIYEgO34GmJIgIJ:sxRPEa/f8se3PNT/5Ijks
TLSH
T1763295156928AD3B8CCBD25DFB65BF63D6F9507260941E48A6FC861C04EBADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7968d66364a3d95151675dc1753ff6e98ee183600be3e9f556af867bad8a159c
MD5 802fc4eafc20313892b73325b3b7085d
SHA1 3d2f07444cb81a36803adec24d1144e777159ea1
SHA512 009a1076a33ca8c47e61ab5b1e77f5644f71fc74da111f555f1da43e029662506fa131bd7f004818d7d87dee4399bfc7557f28a6039385714a6a3b1197667865
SSDEEP 192:sxRcRYba/f8sl3YCbczoA8p46/g6+WNIYEgO34GmJIgDUJ:sxRcEa/f8sl3PNT/5IjkM
TLSH
T12132A5166E28AD3B8CCBD25DFB55BF63D6F95072A0941E48A7FC861C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a84547dcc53a10d9f8726f8d2e2ef63618f19727ec6087668726f20b67542a15
MD5 aebdedd5cc0a6f8b751210d55833f853
SHA1 812a6624b3ac94644a42decfe95f1ebf8e0103eb
SHA512 2cf24e84b208aa173d9eb1d21b558cc8ec84b77e3c7b8606863c68f1decd4c63db704b0a688f2dc625b6653ea68a9398b2160b9e76cb822f03e95e37eec3f130
SSDEEP 192:sxRcRYba/f8slAYCbczoA8p46/g6+WNIYEY434GmJIgDGJ:sxRcEa/f8slAPNT/5I7k2
TLSH
T15442A5156928AD3B9CCBE25DFB55BF63E6F9507360901E48A7FC861C04EBADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 e5d20225acd2d2e469e9accba072a31686b214c19c0a366fec185fd10e05e200
MD5 413f6ec5a65e263156f9859303a73466
SHA1 525feab884c1d78e0c317f3c00bb2c837fac90f7
SHA512 a3138855dbe56074d99c9a1c072867cceac5c1542287e696de9955d5fa5387f62fa7b11061e2951fe22103b6c7fa6a057d4fb7760c48f52258da739013cea526
SSDEEP 384:40DxK6DJQD810DrfCtgQ6DRFfIQDFKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVm:40Dk6DJQD810DbWgQ6DjfIQDF8F1+UoH
TLSH
T1ADB2EB2F640DCB7F5F804A9DAC196FDB6D9802C796988D8047FE990C02C77EE92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a8c15.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a8c15.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 755452ced3d47e16fd7937263f87a5f6aa4021c4a6f526f534d95185566bca6e
MD5 7a155482b3ed80ccf9042e753467258d
SHA1 5c66bdf1fe56f656105bdb7dc6e2cc95834ccb91
SHA512 8c750ac04e6bb7e74e123f9aed594a987dd10b884b035a6db860768b3b2ce9042f62f1619c78dc99db237b07944331d281ac235c5267d4e32f067c37900a4d82
SSDEEP 768:Drv+4UNbdA3ZpjyNDTd+Z5BleX6+qTko0u229a4vsTafcle:DbsbO3z9IvVTVKa4Df8e
TLSH
T14713CF32F8699D738DB6C684F20735577FB910A387C81A949ADE6B5C024F4AC270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 618df21dae58a928f8517ab6000196f7914dd1b9952cd40920bd020ac1dca818
MD5 505a9d3abaf3d87b689ecd78e0768dcc
SHA1 356759cad2a91978d04141200e0417c3d972030e
SHA512 68781bda56c8c84dac8be09850384983ecdf2eced4283712898d8b1f10cb8a95ad20873bc7a7290087fee6ff3b845944d0f2c7044d86ed67333ecf5595ac8aa9
SSDEEP 768:5j3Zpj6NDTd+Z5BfeX6+qTko0u229a4vsTafcly/:5j3ztivVTVKa4Df8y/
TLSH
T1AFF2BF71E8668C774CF5C385B317315B6EBA50B3C7CC2A549ADDAB2C015B5AC170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 eec6c35c6f70b59be64d2b5ae853ff62ba4c9d8efc3c1fd80f91bd1d36dc48cb
MD5 ea9828f4edfaaebf5a83f6b044a16d37
SHA1 9fa164d1e33ef8149a9b24825f3989db0cc8951c
SHA512 9e3f8676f96a2eb88a910bae408110926a2f012b185e01f62e3fa8bca619936f27c256ca8f8fa8f6b512587df0c342b607cdaf8f5e19e4c93680466ba590ed12
SSDEEP 768:KFQH3dwgqpj6NDTd+Z5BzeX6+qTko0u229a4vsTafcly/:xH3MtOvVTVKa4Df8y/
TLSH
T19103BF72EC95CD778DB5C784F31B3257AEB610B3C6C86A50AACDAA1C115B5AC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 a4a80d41f5703a9f70034bdbd143057c469856181dc527fb0719536a6e5e95ca
MD5 3c0a8be0adf72bb27e6770bc1c91b441
SHA1 775ec54b3cec1e578f16742010c6368e4d1ddb47
SHA512 eae9754658098d47e0cdccc0d69c809c678fbe8b93219c971afdd02a77ccf788ce0ed75d25ad1c8182016d781425309ee9c8c934d8f0ea23e24ecd658dab6ac4
SSDEEP 768:1rv+4UNbdG3j6HDTd+Z5B+eX6+qTko0u229a4vsSaeVH1SdW:1bsbU3LhvVTVKa40EH1h
TLSH
T1BD03CF32E8698D778DE6D785B14771572FB911A3C7880B90D8DD6E4D064B0AC170F93B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c8ed2e5e44aaa3c899f8db4e6b5b64a49f6b3787dbe687c64dfe6d99696da65a
MD5 bda10ed4f2c63789e75e4bbc6565ea82
SHA1 fe1c3b3f893d2a468916f40935c52590a79ced29
SHA512 d2d74de538d59833ff5c800985eecf5fc0bbc77b9f4a4062a51dc546bee6e582f8796d363be1cdcfe06f9ec3ea5a4f39af54af349c44636bc3e8583e555f8378
SSDEEP 768:prv+4UNbdG3+nXDTd+Z5seX6+qTko0u229a4vsDQeVH1SdW:pbsbU3DVvVTVKa41EH1h
TLSH
T16703CF32E8A589778CF69784B24B75573EB92173CB880B90D8DD6F4D025B5AC230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 35d838a4037385dac8c4cd5037d8dab86bae571e56664442a9b3c00729394f86
MD5 0590b377516ccbbee04141672f3405e6
SHA1 f0182ebdacaa57f7467df7d6b48ecb738182aeb8
SHA512 ae6587309b23fbc03dee44383c3ea9d48c5176c218737e6774dde388bf306410f6697481da1435d87d8cd09796dd0d62a0f4d86480383796da607a9c30f6de52
SSDEEP 768:Dj3opj6NDTd+Z5BfeX6+qTko0u229a4vsTafcly/:Dj3OtivVTVKa4Df8y/
TLSH
T16FF2BF71E8668C774CF5C385B317315BAEBA50B3C7CC2A549ADDAB2C015B5AC170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15705526-f6b0-4001-ac52-0b780c6fe655.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\15705526-f6b0-4001-ac52-0b780c6fe655.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download