1a29c4ec41cdb0557a708e0dd3e917ed633c43e0c247a0febf051db29ffe60ba

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Remi2142922040_pdf_wfdefm.html
Size 11KB
Sample260826-p4dxwsdr8x
SHA256 1a29c4ec41cdb0557a708e0dd3e917ed633c43e0c247a0febf051db29ffe60ba
MD5 b0942a4a84d4036441868d76636c71f8
SHA1 7d4c8a6605fda1b1d7f5bb5e0771aab64330c684
SHA512 4277a814e5f99d7c5908fffcea478c4f39234d881a2cd5f5e7d336c193c5433ad02e330ad04800376888c82fba83ff2b9b1fa7e8c972a49585ee14e6d9c8ed23
SSDEEP 192:COcLN1TQguEDmRufdUXXMWFwE3JRG11jmj4WC7kcla6fx5KMDtByn:CDxmofmXXMWD3Jg1jmj4WC7kmfP5ton
TLSH
T11F42AF13A89A77E48B3A0B752D3FC10C822D2D54E64DCC11B47516D5AFA26AACB037E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4612	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322223723203411"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{215FEE03-D23A-4987-A42E-8D33EF75A93A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 5416	2088	msedge.exe	89
PID 2088 wrote to memory of 5192	2088	msedge.exe	90
PID 2088 wrote to memory of 4612	2088	msedge.exe	91
PID 2088 wrote to memory of 5192	2088	msedge.exe	90
PID 2088 wrote to memory of 5192	2088	msedge.exe	90
PID 2088 wrote to memory of 4860	2088	msedge.exe	92
PID 2088 wrote to memory of 4860	2088	msedge.exe	92
PID 2088 wrote to memory of 5900	2088	msedge.exe	93
PID 2088 wrote to memory of 5900	2088	msedge.exe	93
PID 2088 wrote to memory of 5900	2088	msedge.exe	93
PID 2088 wrote to memory of 2640	2088	msedge.exe	94
PID 2088 wrote to memory of 2640	2088	msedge.exe	94
PID 2088 wrote to memory of 2640	2088	msedge.exe	94
PID 2088 wrote to memory of 240	2088	msedge.exe	96
PID 2088 wrote to memory of 240	2088	msedge.exe	96
PID 2088 wrote to memory of 240	2088	msedge.exe	96
PID 2088 wrote to memory of 272	2088	msedge.exe	97
PID 2088 wrote to memory of 272	2088	msedge.exe	97
PID 2088 wrote to memory of 272	2088	msedge.exe	97
PID 2088 wrote to memory of 1788	2088	msedge.exe	99
PID 2088 wrote to memory of 1788	2088	msedge.exe	99
PID 2088 wrote to memory of 5932	2088	msedge.exe	100
PID 2088 wrote to memory of 5932	2088	msedge.exe	100
PID 2088 wrote to memory of 5876	2088	msedge.exe	102
PID 2088 wrote to memory of 4600	2088	msedge.exe	106
PID 2088 wrote to memory of 3008	2088	msedge.exe	107
PID 2088 wrote to memory of 4672	2088	msedge.exe	108
PID 2088 wrote to memory of 2352	2088	msedge.exe	109
PID 2088 wrote to memory of 2352	2088	msedge.exe	109
PID 2088 wrote to memory of 3068	2088	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Remi2142922040_pdf_wfdefm.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff8e3c2c188,0x7ff8e3c2c194,0x7ff8e3c2c1a0
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,4381267759637948395,5668209165788227755,262144 --field-trial-handle=2456,i,1990308221421720724,15734968661355104248,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,9192699943824703428,1498244685467273779,524288 --field-trial-handle=2456,i,1990308221421720724,15734968661355104248,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,2739618327143764985,13764660793824879372,524288 --field-trial-handle=2456,i,1990308221421720724,15734968661355104248,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:13
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,15306767769802771911,10250094879682574439,2097152 --field-trial-handle=2456,i,1990308221421720724,15734968661355104248,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,14644736605196751650,6421524520777946762,2097152 --field-trial-handle=2456,i,1990308221421720724,15734968661355104248,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,7284165747350735117,1050988054175499060,2097152 --field-trial-handle=2456,i,1990308221421720724,15734968661355104248,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:9
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,5856872102312396115,453249257086726026,2097152 --field-trial-handle=2456,i,1990308221421720724,15734968661355104248,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:1
  2⤵
  PID:272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,11485746377610057907,11523656909478153198,524288 --field-trial-handle=2456,i,1990308221421720724,15734968661355104248,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,3183379005446840402,384820057670195027,524288 --field-trial-handle=2456,i,1990308221421720724,15734968661355104248,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,18272136345263225351,3009583452490356885,524288 --field-trial-handle=2456,i,1990308221421720724,15734968661355104248,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,18272136345263225351,3009583452490356885,524288 --field-trial-handle=2456,i,1990308221421720724,15734968661355104248,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,486785180069192919,16623530452136432326,524288 --field-trial-handle=2456,i,1990308221421720724,15734968661355104248,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,4225481320698381957,16530317875462604694,524288 --field-trial-handle=2456,i,1990308221421720724,15734968661355104248,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,14586779030013400411,7107591572592575910,524288 --field-trial-handle=2456,i,1990308221421720724,15734968661355104248,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:14
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,4301141496414541690,15191339381043824004,524288 --field-trial-handle=2456,i,1990308221421720724,15734968661355104248,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=804,i,13733489286949208863,9467142867898721105,262144 --field-trial-handle=2456,i,1990308221421720724,15734968661355104248,262144 --variations-seed-version --mojo-platform-channel-handle=800 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4eafb416bca0db15abc3ab3fbc0a0de1f13cdcab43f1226ee5f2f6ca076aff5f
MD5 9175472fff5fc7a1b5ff38c44962738d
SHA1 d8e2f859cba6e861f957285a5b22f8590c25ebb0
SHA512 11dc4eb4d74a67500fa539ea0026ac1702f3b83700d093a063c2bf0a015f639f6afaae4e3dea5135df649a3439f28dc475d68f7084d5c65439b8dd8a6d615089
TLSH
T1A941D65063280DD1EFA2B1BBA4FC460932F7FC5D08076ED07644AE754A06F710CD2A63
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596845.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596845.TMP
Size 2KB
SHA256 0d489d23db4e0ade79ff20c5b34170afae1412d68a0d59a3270090cb4d3a0c09
MD5 257b8832b1be79f36b10c874323e42c4
SHA1 bde97e8f9b85f9bbb6ae0b982c53eca6be52c2bb
SHA512 836337b7cb15859b3143a098bc1d94904b852d9a0d063fc0af4b5dbde023aea28db995732e293b8bea5013145fe92b6cd6b67783665f1296d535d138f781f0c9
TLSH
T17741D55067280DD1EFA2B5BBA8F8560932F7FC9D08076FD07644AE754A06F710DD2A63
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e11768dcfe80da0979af1b645661db1ea572842d3d675b735437a93865ae972e
MD5 0fe89333d1b6994c51179d4243ced135
SHA1 2995d9bfa148204389f6d92aa8c6f26bc4c50837
SHA512 b8a07ef6f3a031a4c5ac847aeac3b0c9a1ec852b8cc204e9b454c04a1d9b0aa983b519530d9bfd8982afeb9e0edb0cf5f188e3caaebdee751b0850e593d4e46b
TLSH
T1CA31AEF783F4856E9A0196F0AA18AE1FCE2C0515431C7D6AC5E0AE2793F3472E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7143c00aa9539e4b0f612155d9c9f81603c0c9cb8f7a53279719446b3419b875
MD5 89ee3086f3cf26c4edc1230235bc6d7a
SHA1 9d10a9fbd03be2acd9ec30cccb8fa0e266f30258
SHA512 cdfa673fd0c4b440043f980227aeb125449cc95b936b428e1b08ee5564c057ca778a8b4c5b71f606e6a206e33130b2cfa9fb85e562c46c5625a10180d50ed4ae
SSDEEP 192:sxRFR+yM/jK1Ml8wb2/fpsyABHm2Sm7aBazoD8p4J/g6+WNIY3B2sLG+IgIJ:sxRFIl2/fpsyAB2aM/5IAbs
TLSH
T14952E815AA249D7BCCDBD20CFA517F53D6F95573A1901E54AAFC8A0C00E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 504e226f77db6762efd71daa95272952397c2f00e401066f36b65d7c4d6b2637
MD5 1c456b29af46b83709a2906ed94b2dd2
SHA1 35d7852540f8fb87c2e945022fde97e4eaa04e41
SHA512 67920c09e92932740d828ba4a8e987ae802e05299a8dd00f2e5e5c3964f216833a834b41033885cce039cf9d35b607b15358e0bec80581548c9008eec9903570
SSDEEP 192:sxRSR+yM/jK1Ml8UQZb2/fpsdAsHm2Sm7aBazoD8peJ/g6+WNIY3IqLG+IgDMJ:sxRSIqx2/fpsdAs2ai/5Iks
TLSH
T15362E715AA249E7BCCDBD20CFA517F53D6F85573A1901E44AAFCCA0C00E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f8d8450be97ad67c21f730841916b52ce31f2226b24a6ef4a8875d4b9d5c50d7
MD5 868c04c2535b031c295a3f8c907aa3ba
SHA1 f77c4bf1ce8f51d4926b779062ee7f5e84a1648e
SHA512 d7ee117bf37578fa04f480fc3a0d57929d888d4a4fe4352a63049ecc443725ef23258c39a2ec0e30b2e2a2fc308b1b63ceb8637e4477fc1998e5f03c5d68c0af
SSDEEP 192:sxRSR+yM/jK1Ml8wb2/fpsdABHm2Sm7aBazoD8p4J/g6+WNIY3B2sLG+IgD2J:sxRSIl2/fpsdAB2aM/5IAbu
TLSH
T18752E715AA249D7BCCDBD20CFA517F53D6F95573A2901E54AAFC8A0C00E6BEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 2f4e3eb493f548cdbb177c990f29e74224e446c6566e6c8114fff0a27b9abb62
MD5 bd6531c864d1f218c8cd7fa19c53e888
SHA1 92c8957b22ae35ea45cb660e1894e7f606470fe9
SHA512 1ba5aa92d101b11319fc3ef09a82781d159efb1d817554c9535940201714a075a909904e1fbf7b73c753b78729644c57e51b987fe77af83d0c4a7983ccf81848
SSDEEP 768:GiqbvkWg0CfDs8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+MW6YroZai2:GiqbvkWg0CfDsu1jaDF6jZt2
TLSH
T160C20B2B240CC77E4F804EADEC26AED76DD801CB9B988D5447EA890C03C67FB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0ba7958de1f65d32794a9eb44d7f7330267880d5b1e42977e6d5a97f3887e052
MD5 775d17e9d4ce2200cfea195060fc84b4
SHA1 312b8b1e0a71a2912ea7425e702531b060e108e0
SHA512 5b557404be25c0c6f75b88ab5eb3d96758406b4daed22cb40fd8f4dd6e19d72ea624c514990a423571558c040347461857fcf1a19e6a98313144aa4309563cbc
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHbEBVj5J1WdSIg91K4EgT1c7j6dJOHJGXk:C1i7PF/DWrwfX9mgpct1o7zsHbEBVj52
TLSH
T1DC911215703E1292393DAA0C91B9881ED6C274E33499E46F3BA805A61F77E038DFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a038b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a038b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 be106e5a2ee00304c30ec6e57b9c168f1713ebc3a64322c94c2e74024d4a9c56
MD5 26d99a94f7185de65d5d964c3d025415
SHA1 4db9a0abaf12ccd45b452e1e857065c2f2eb002a
SHA512 ed737389e89aeafd7485dde47e09bcf688bfe60688e23680b9f5846869a98c1464d0f7de9c0cebc5f0900823808283567fcd0d33c943c69c68162d1bf3915399
SSDEEP 384:IZcI/38NVx6F9JWcHGfd+UJfRXOVyS5dfLXHufLX/9vShCiDBTayppFJlmqJrYnE:2/3Z3c+wfZOXfjHufjlvShCQRER0KG
TLSH
T1E0F2BEB1C8B59D734DE2D249BB463B53BEE59123D9C85B44D9CC9B0C01836AF271F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0505e9a45a677af8d3343f107de34464e9e267909931e9d1162d599009fd0d33
MD5 5aa66a1aff1c17137b74d1b036b1898a
SHA1 1ca04abdb5850506e805bdace200fc7f356bd974
SHA512 c043edea88493be1637b32cab542b31e39972d430f20cb5b6cc25dda58928a1b0eaae3495d9eb80152bfae53e5804b39d69e760a378f76a889ca369817c76f84
SSDEEP 384:aZcI/38NV06FUJWcHGfd+UJfRXOVyS5dfLXHufLX/9vShCiDBTayppFJlmqJrYnE:Y/3F3c+wfZOXfjHufjlvShCQRER0KG
TLSH
T102F2BEB1C8B59D734DE2D249BB463B13BEE59123D9C85B44D9DC9B0C01836AF271F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 9c76ef6a944ba079fa7ae1a14351a1bdaf943f866ba97af1b461ace17cc22a4d
MD5 baff69dc96c6c2e3d2b796919e4a3197
SHA1 cecd1f8ee14a959a589023df5496a232c565f412
SHA512 3e6e59ebee5ad2aae85aa37e43760cee1f135bc9267c15b2f3c2f4d9fa27f9fc44eeb2149d4746d1e0170bea9c63cdf27d6f19debd094aef3dc032ea76478779
SSDEEP 768:RFQm3swgI3c+wfZOXfjHufjTvShCQRER0KG:gm3xwfofDufHvSIJG
TLSH
T1CFF29EB2C8A4DD779DE69245FB4A3712BDE55173C8C89B54D6C85A0C01836EE170FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 12b630b6b8034422b2bdfd16ba765585732aad2b0b53dbf77b5b83420739a4e8
MD5 6eb2ec967984a7d69fd844af680f23e0
SHA1 4e69bfc1e63feb50647c0abcf9c9775f408678e1
SHA512 67a00836e7c06269b28e857e42fc4e4203472f70d3203ee1f2c9587fc09d16a7fd50382bb69228ac08aff32e07c1b8c7f457285cfa64b0302cbc10b1742ace36
SSDEEP 768:Rrv+4UNbd4338kc+wfZOXfjHJvShCQtL2bwWV:RbsbO33RwfofDJvS30wO
TLSH
T1F403BF32E868A9339EE792487646BB637EB86173C8C54744DACD4B0D018269F371BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4a6fa8d4d7656e203355db90089c01cbff8c5d24f35efdc6474b60fdd1685ea7
MD5 d69a4a048f5fe38e3335cbb5ef2c4c49
SHA1 5ffd435340d03a500e2e45e0e6d89dd223c9b946
SHA512 f5763ce92097db06f258a7b0181e1f28054bbc6de507fb39aa78082526b804a0b2f17d7bb3757ab040058545af474f16755faeddb106b2954b2ab02d589ee98e
SSDEEP 768:9rv+4UNbd43tVc+wfZOXfjHufjfvShCQsE2bwWV:9bsbO3xwfofDuf7vSf0wO
TLSH
T1E203BF31E478A9339EE29248B64A7B53BEA55173C8C54B44DACD4F0D018669F371FC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adc18bcf-075d-4d15-8ddf-feb53fc48bd1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\adc18bcf-075d-4d15-8ddf-feb53fc48bd1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download