bd1493812fe1d53d9a92416e439eccc532d4150690e943cdded1f7017c65e453

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 3KB
Sample260825-plefpssbkg
SHA256 bd1493812fe1d53d9a92416e439eccc532d4150690e943cdded1f7017c65e453
MD5 2495eaac779becc841dc188688a48922
SHA1 1b22bfa82e33a037e202a6a38ab61ff4954ffc8d
SHA512 1c07f08d86be313593e37574c5098b7830b900e92325cbda0744fc507e56fd4bba35b18fc6f119a28c15f4e969b5a235229013caae4bd1bbc4a9f489fc0c56c0
TLSH
T15961536CB5E620185257247E37DF120574221D5BB809FD94FEAEC3006F4252E89A77FC
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4528	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321342932724275"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{C76E43BF-D2C1-4C00-AAE1-6FD566869C1E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 2692	5796	msedge.exe	89
PID 5796 wrote to memory of 4528	5796	msedge.exe	90
PID 5796 wrote to memory of 5248	5796	msedge.exe	91
PID 5796 wrote to memory of 2964	5796	msedge.exe	92
PID 5796 wrote to memory of 5248	5796	msedge.exe	91
PID 5796 wrote to memory of 2964	5796	msedge.exe	92
PID 5796 wrote to memory of 2964	5796	msedge.exe	92
PID 5796 wrote to memory of 4352	5796	msedge.exe	94
PID 5796 wrote to memory of 4352	5796	msedge.exe	94
PID 5796 wrote to memory of 4352	5796	msedge.exe	94
PID 5796 wrote to memory of 2812	5796	msedge.exe	95
PID 5796 wrote to memory of 2812	5796	msedge.exe	95
PID 5796 wrote to memory of 2812	5796	msedge.exe	95
PID 5796 wrote to memory of 4872	5796	msedge.exe	96
PID 5796 wrote to memory of 4984	5796	msedge.exe	97
PID 5796 wrote to memory of 4872	5796	msedge.exe	96
PID 5796 wrote to memory of 4872	5796	msedge.exe	96
PID 5796 wrote to memory of 4984	5796	msedge.exe	97
PID 5796 wrote to memory of 4984	5796	msedge.exe	97
PID 5796 wrote to memory of 1644	5796	msedge.exe	99
PID 5796 wrote to memory of 6136	5796	msedge.exe	100
PID 5796 wrote to memory of 1644	5796	msedge.exe	99
PID 5796 wrote to memory of 6136	5796	msedge.exe	100
PID 5796 wrote to memory of 3312	5796	msedge.exe	102
PID 5796 wrote to memory of 5116	5796	msedge.exe	106
PID 5796 wrote to memory of 4716	5796	msedge.exe	107
PID 5796 wrote to memory of 5264	5796	msedge.exe	108
PID 5796 wrote to memory of 3780	5796	msedge.exe	109
PID 5796 wrote to memory of 3780	5796	msedge.exe	109
PID 5796 wrote to memory of 4308	5796	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x2e4,0x7ff9a5f9c188,0x7ff9a5f9c194,0x7ff9a5f9c1a0
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,2852364440508153438,18381840216190685293,524288 --field-trial-handle=2584,i,16796086142041765652,4407047843456255472,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,16080771275360342347,8808090943012411546,524288 --field-trial-handle=2584,i,16796086142041765652,4407047843456255472,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:13
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,13204466975880980654,4592589212300278241,262144 --field-trial-handle=2584,i,16796086142041765652,4407047843456255472,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:2
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,14200646692840956498,5695769329418647490,2097152 --field-trial-handle=2584,i,16796086142041765652,4407047843456255472,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,4656305344620159564,15774740302039400598,2097152 --field-trial-handle=2584,i,16796086142041765652,4407047843456255472,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,3689293047245746243,17767070898156051908,2097152 --field-trial-handle=2584,i,16796086142041765652,4407047843456255472,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:9
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,14661722443786948956,12912520945596409818,2097152 --field-trial-handle=2584,i,16796086142041765652,4407047843456255472,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,1285148137402455479,14681495368238736601,524288 --field-trial-handle=2584,i,16796086142041765652,4407047843456255472,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,3847306097218101390,16105959982293922189,524288 --field-trial-handle=2584,i,16796086142041765652,4407047843456255472,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,8404865627686487463,6767237423420301471,524288 --field-trial-handle=2584,i,16796086142041765652,4407047843456255472,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,8404865627686487463,6767237423420301471,524288 --field-trial-handle=2584,i,16796086142041765652,4407047843456255472,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,7575601288411891824,1037715342548977865,524288 --field-trial-handle=2584,i,16796086142041765652,4407047843456255472,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,6122235439426842734,13173496320042379007,524288 --field-trial-handle=2584,i,16796086142041765652,4407047843456255472,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,4420056235118083332,2466252872221753474,524288 --field-trial-handle=2584,i,16796086142041765652,4407047843456255472,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,4812518565957383883,2274997450715775726,524288 --field-trial-handle=2584,i,16796086142041765652,4407047843456255472,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6512,i,11135531796039591320,12126251025527496502,262144 --field-trial-handle=2584,i,16796086142041765652,4407047843456255472,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8cfe47c10a109eb78c283ed9f226e98c6f5dec6c8e1237ec6c6994db9068d3bb
MD5 7292785721a73bdb87f9a63b5da69f84
SHA1 a642cab4b4e8c392351aa73fbafbe8bfd70dc2b5
SHA512 bb17855b516bf60bf71c5fc6051f776c32c610575c7ca9ddead257ff23bcbf1615b38cb6a703f6fba6f8c4a92aedbd9e421b45fd0ae54ff6a3e70d63f5e6f7e5
TLSH
T1D0519202B321D7E3D72F84FD60E2D448F2F144540A272E985265AE7F64A6F0678F2273
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5979f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5979f9.TMP
Size 3KB
SHA256 5f319301fd9599f330bbe1050be31411b704e037ad2dd549566f27e15d9b969f
MD5 37b2fdec4c90a50e6a609ff176349d25
SHA1 52ad5ba0cc302029ac82d18b4a9ab9be83c638f5
SHA512 a4659629edbbde881c2a7c8d8157b73864b3df34af9bcfd89789b450dfa3974420970348c01d0e195da21a29446c2ec989be0f650baa62816b01a9c1a6e84533
TLSH
T18951A302B321D7E3D72F84FD60E2D448F6F144540A272EA84265AE7F64A6F0678F2273
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 91759fb5131681a267c1bbc3eb44a2b1df0e1b7f475089762d560daca54e1da4
MD5 a799fadd7bebf141ca2b7d04fdf28130
SHA1 90a8db232329949f1b3d00a3e8e51dd01e651e59
SHA512 b8fafd992012d72a4b319c5a24f6b38473abc916dbe2bb5ed5085b673f455ccff311c0b33fec5c579a12b53bf0737ff6046ff9038ac405415b2d42c0efb45251
TLSH
T1FC31A0F783F5957ECA1186F0EA14AE1FCE2D0511432C78A985E0AE2793F3472E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dcc56cb1-2018-4d10-b186-cfe629b3fc8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dcc56cb1-2018-4d10-b186-cfe629b3fc8e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7799964ab77a711a400655821f63a624dbba6d18c7bf8169bd99a5ca828d20f5
MD5 0e47129a3a7af26d8f35f15092a1c9fa
SHA1 90bc347e7eb37082032bdb358da271e9a32a3513
SHA512 c96b5e005ef81f3e44fa563b2e69f3886513728aafb1eb28f6a150b5be5bf10462c374e8e074f13f41d39ed82f9baef6d0fdd7eba89d129dcaa9eb5919a38c14
SSDEEP 192:sxRfCRnyM/jK1Ml8UQRba/fhsUYfd8bNQ6MzoA8pe0/g6+WNIYlnZri1Gl2IgDcJ:sxRfCnq5a/fhsUYl8Q69T/5Idnc
TLSH
T18B62D615AA246D77CCDBD20DFA41BF93D6F85473A1901E44AAFC8A0C00E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3b82e02f4365d094cc49cccdf059602980f49347525a0bf12b35861fb83b439c
MD5 3e0fa49c71885635629f15243c0e77e6
SHA1 90f7e8dad4a0e9765b675ed5dec7915c0f55994e
SHA512 383e80a7ab7c47dab35e1bd56a7f3bc917af6580aff9caa4ce79deb53d7405d83c5c6722c9ec3e9dc5210796b1d57b0d000cd85e59b33fbb2295f70c4ca73416
SSDEEP 192:sxRfCRnyM/jK1Ml8wba/fhsUY3d8bNQ6MzoA8p40/g6+WNIYlzZ1i1Gl2IgDGJ:sxRfCnla/fhsUYN8Q69B/5INne
TLSH
T12D52D815AA246D77CCDBD20DFA517F93D6F95473A1901E44AAFC8A0C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9a48184ea5f78995f6342aa09ff993a5494fd783813a8280b614feebf1b59f87
MD5 02df6f8e5a46f3594100388994551e42
SHA1 9f6f09c46e9f67310c5a5fbc9cf5e1a4b19be963
SHA512 8cb507fe837b7c08613aa957c14de95230f1433be41e2e88c7ab8a1f71dbb2a8a7d43eaa6239f2cef619b0badc57ffd00fc541876b98ddc59011a1334a80f6ec
SSDEEP 192:sxRfJRnyM/jK1Ml8wba/fhs3Y3d8bNQ6MzoA8p40/g6+WNIYlzZ1i1Gl2IgIJ:sxRfJnla/fhs3YN8Q69B/5INns
TLSH
T13C52D815AA246D7BCCDBD20DFA517F93D6F91473A1901E44AAFC8A0C00E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8e54222b1c470cff747229b049ca606ead041468bbd73de73bdb11cbf3a748de
MD5 00b3da67579bcdad1d3e366228259569
SHA1 60bd67cc23d90027644f33a65b1439ddff3ba415
SHA512 5bc1cd76ea346aaad71a42322b7c6a832713ae2d3990e7224b12fb521e4c0901d24b89781fe01efaf50967ebd820d09f6ef1656cebdb13d86d812dcb7b2196a3
SSDEEP 768:dhRACxWgg+fAJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVL13fzroPcTUB:dhRACxWgg+fAJu1jaulfA0Ts
TLSH
T1B9C2FC3F540CCB7E4F844A9DEC29AE976DD802CB96988D5447EA890C03C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 84c91f89091128edeec34db8e7247634d35b042aa53f8234a301c3f2f8903570
MD5 ecb75b9a3e10feea6883a15fbcd69c6b
SHA1 e0941d0ece20c7cfcfa9eb593466a93ffc12657f
SHA512 d65d4b0868197cb2a0452170b038f4ac222c85d69a5a33411b60fd9701be0f01569dfca6aa1d8fdad0796ec954df8cd9afb4fd98ddd9508511013b21ddd08f31
SSDEEP 96:KRxOf7JrvbWf8qgjbK4igtbcx50HPoHWLa2Q44eWIdFgWeK4rgEec+W10mPWPLP/:CxOf7Jrv6f8bjhigtIx50HPoHWLa2Q4b
TLSH
T14E91C311727607C0387EAE1AC0F8986F92867CA23198A42F3BE855654F67E039DFC4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 578ab69df261b82006f6a6f5316cf34c449683fc9a5b4d0b94b8faba5226ad02
MD5 755d44a5c98b94a10cbe03f2267bd57e
SHA1 af50f9403dbd08c1ea908384a895e4e3e399bcc5
SHA512 904eec8f19eda20898c4dfe8f634a45bde031e70dabad1ec2a91236cf426aaffb9efcdeab323131d40e4574f601e6c0191f8fe7a9b3a78ad55f8a066191c9007
SSDEEP 384:ypZcIQ38Nv0sfW6O8+jhzRfY9bY4EZs7gQPlLJQXmIkdP9IimIMWEfMbc+HBfv87:yhQ3c3rc9iJ1E6HNHXmTWTbc+HBfklSa
TLSH
T147F2BF719CAADD376DEAD784B60A7B47BEF9106384CC1984C9DDAB0D018764D170B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 61da694da8922891b4f4f0379c7bc3fec479471b43e0ed307c8ac557a7803d05
MD5 6571567efb6406cee35667bcb880a2b9
SHA1 551a856df177ff56af3197fc106a5b92840ea1f9
SHA512 5ae21a68c5d8cc3f2e9bb63c59269f548042fb3cfd33b627b8ccc9beb8fc6b4d0a7a610b3158a547d808e543fa319a4723292fb206368281b126524be5e53622
SSDEEP 384:aCZcIS38Nv0sfW6O8+jhzRfY9bY4EZs73QPlLJQXmIkdP9IimIMWEfMbc+HBfv87:awS3c3rc9iJ1E6MNHXmTWTbc+HBfklSa
TLSH
T15EF2BF709CAADD376CEAD794B60A6B47BEF81063C4CC1984C9EDAB0D019764D170B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e5e5d5c318102486b3526fdf259dacbb3e626c1a6072fae327cb3fc0e516a870
MD5 bdbb29aa85cab77f8df7bfb4e9169a2a
SHA1 9983d3d77d213007cde67f5134078d69039a1395
SHA512 8e4bb9bc18ee3a92a3dbcc7854dd141fc44cf19f69cd7bf5bc05e6ac582eb93e260d65cf056ca47e2394f22427fe0dbdfb8d7e4bf395771a79bb641fdd641f46
SSDEEP 384:7pZcIQ38Nv0JfW6OA+jhzRfY9bY4EZs7gQPlLJQXmIkdP9IimIMWEfMbc+HBfv87:7hQ3curw9iJ1E6HNHXmTWTbc+HBfklSa
TLSH
T1F2F2BF719CAADD376DEAC784B60A7B47BEF9106394CC1984C9DDAB0D028764D170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f06b308ccb4d69d805dbf4a923b76e5f63b6cb6241139d4cc90676e8b005efeb
MD5 b9e027baea85352efe030d77bed887e0
SHA1 c03b64c01fdf1cbb4a408c02eca89723d21198c1
SHA512 43ab2f087c06a8d32895caaae61cde4bce16b38ebd51ab1e8b253a078658b7249c9d7640149771bfa5c70f253975c0bcae66e92479a8af87cacc240b88e9ef55
SSDEEP 768:arv+4UNbdM3nIfiJ1E6BNHXmTWTbc+/teVH1SvyZ:absb+38sE63eWn11EH1dZ
TLSH
T10D03CF319CBD9E37ADE69A88758BB6577EF811B385C406C4C9D96B4D028708D070BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 721f00bb29202dfcb81e587621a63df0f84396abc24170c8375948c7c4856520
MD5 e01046b024cb921a9ce9110b10502050
SHA1 682b0b57ededaa9893c237b219bb7c435cf5493e
SHA512 8e6b37f718802c3a42b68d31e6ac0609983102ee54933f945b599d2cd9d8dc291e82fde537c1b50651c6feb86003231002e410b1a260ac7086e1e89e3982b2b7
SSDEEP 768:7rv+4UNbdM3zrgPiJ1E6QNHXmTWTbc+eBeVH1SvyZ:7bsb+3EsE6QeWn1yEH1dZ
TLSH
T1DE03C0319CBD9A37ADE69B94B04BB6477EF8116384C80A84C9D96B4D028758D070FD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c151c2c7-831c-4e07-ada8-7ae529b145fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c151c2c7-831c-4e07-ada8-7ae529b145fe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download