2944c0c643415e058666d82963053b6af3733fafb39c79b5ce16f127c87745b1

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fleet/56-passenger-school-bus.html
Size 731B
Sample260827-al49sswtfs
SHA256 2944c0c643415e058666d82963053b6af3733fafb39c79b5ce16f127c87745b1
MD5 bcb693ae1d324d2a856702a51d52ae24
SHA1 4cc0db4e21c9331af7ccc4f11d50278cc3047d17
SHA512 e0af51ca0ddc9d5eec846972eaa9dccbac34faf9a3df76b62098c5fd1fcd0aecb8e1bcd848b2cddf6169002a8e3e3ca4d663c71e5e189d92bbc2574f05b773b4
TLSH
T1FF0115CEC4C25545E132D624E55EB950F323224BD778D045801819DDB25627A93A3BC7
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3392	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322635525902083"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{0C8CC393-8DAC-457F-AFE9-6D1100BFC8BD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 704	2384	msedge.exe	89
PID 2384 wrote to memory of 4448	2384	msedge.exe	90
PID 2384 wrote to memory of 3392	2384	msedge.exe	91
PID 2384 wrote to memory of 4448	2384	msedge.exe	90
PID 2384 wrote to memory of 4448	2384	msedge.exe	90
PID 2384 wrote to memory of 4380	2384	msedge.exe	92
PID 2384 wrote to memory of 4380	2384	msedge.exe	92
PID 2384 wrote to memory of 5916	2384	msedge.exe	94
PID 2384 wrote to memory of 5916	2384	msedge.exe	94
PID 2384 wrote to memory of 2108	2384	msedge.exe	95
PID 2384 wrote to memory of 5916	2384	msedge.exe	94
PID 2384 wrote to memory of 2108	2384	msedge.exe	95
PID 2384 wrote to memory of 2108	2384	msedge.exe	95
PID 2384 wrote to memory of 2964	2384	msedge.exe	96
PID 2384 wrote to memory of 2964	2384	msedge.exe	96
PID 2384 wrote to memory of 2964	2384	msedge.exe	96
PID 2384 wrote to memory of 1048	2384	msedge.exe	97
PID 2384 wrote to memory of 1048	2384	msedge.exe	97
PID 2384 wrote to memory of 1048	2384	msedge.exe	97
PID 2384 wrote to memory of 4800	2384	msedge.exe	99
PID 2384 wrote to memory of 912	2384	msedge.exe	100
PID 2384 wrote to memory of 4800	2384	msedge.exe	99
PID 2384 wrote to memory of 912	2384	msedge.exe	100
PID 2384 wrote to memory of 2980	2384	msedge.exe	102
PID 2384 wrote to memory of 6064	2384	msedge.exe	106
PID 2384 wrote to memory of 3780	2384	msedge.exe	107
PID 2384 wrote to memory of 2104	2384	msedge.exe	108
PID 2384 wrote to memory of 3336	2384	msedge.exe	109
PID 2384 wrote to memory of 3336	2384	msedge.exe	109
PID 2384 wrote to memory of 4712	2384	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\fleet\56-passenger-school-bus.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc4482c188,0x7ffc4482c194,0x7ffc4482c1a0
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,1064894820517902930,6004787741932304898,262144 --field-trial-handle=2492,i,15630854443257933775,5694982990749994085,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,9240929515406899845,14954750752496347984,524288 --field-trial-handle=2492,i,15630854443257933775,5694982990749994085,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,2619518209956117864,12480009782122309059,524288 --field-trial-handle=2492,i,15630854443257933775,5694982990749994085,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:13
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,17679723674428085814,15123938367216401183,2097152 --field-trial-handle=2492,i,15630854443257933775,5694982990749994085,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3656,i,16211231933580458727,14921725049768936070,2097152 --field-trial-handle=2492,i,15630854443257933775,5694982990749994085,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,13564247097453957057,50716782531681133,2097152 --field-trial-handle=2492,i,15630854443257933775,5694982990749994085,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,4074836006978133726,15513289123292346639,2097152 --field-trial-handle=2492,i,15630854443257933775,5694982990749994085,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:9
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,14696137610088951674,15309682944095913996,524288 --field-trial-handle=2492,i,15630854443257933775,5694982990749994085,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,12914122429431155072,5219284491532791937,524288 --field-trial-handle=2492,i,15630854443257933775,5694982990749994085,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,17144239228924722661,10534931254910458197,524288 --field-trial-handle=2492,i,15630854443257933775,5694982990749994085,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,17144239228924722661,10534931254910458197,524288 --field-trial-handle=2492,i,15630854443257933775,5694982990749994085,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,4060833353774983173,13721915187062389044,524288 --field-trial-handle=2492,i,15630854443257933775,5694982990749994085,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,14458510192344137882,7037529271797083568,524288 --field-trial-handle=2492,i,15630854443257933775,5694982990749994085,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,4078608083010912981,17020320402063341095,524288 --field-trial-handle=2492,i,15630854443257933775,5694982990749994085,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,7427152971776091596,17969729134042969022,524288 --field-trial-handle=2492,i,15630854443257933775,5694982990749994085,262144 --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:14
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6640,i,7816567130582844345,4746770160063686043,262144 --field-trial-handle=2492,i,15630854443257933775,5694982990749994085,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

03688eb4-ade4-4453-9b32-12f0abbe7292.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\03688eb4-ade4-4453-9b32-12f0abbe7292.tmp
Size 39KB
SHA256 3804d13b242cc2384c202bc4b0a8bad29a10fcc7005522a1ae8647b245dbc8d3
MD5 241a59206e95e86d7787bf6c47b3d5c0
SHA1 f8d62277f476a1ac1dbcee32bf2baf548897d5a9
SHA512 de2934aaa3454314d05a2dbe01d7688054e116bca94666c8b3fefe7c0ed3971786a226b91ab2bbee66cef9e1c0f2fcd651984b6cdaccf46f50dd27b7c1f31d51
SSDEEP 768:prv+4UNbdG3VVBDTd+ZD00OaeX6+qTko0u229a4vsDTeVH1SdW:pbsbU3m1svVTVKa4eEH1h
TLSH
T1BA03CF32E8A989778DE7D784B14B71472FB91163C6C81B80D8ED6B4D028B5AC270FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

369f00bb-4169-4355-b9ea-92767f72a80d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\369f00bb-4169-4355-b9ea-92767f72a80d.tmp
Size 14KB
SHA256 dc7cf0ee52940e9e8f672b963ea598301f3bf99446a7be9d6fd01df0c53ea10f
MD5 6d603bc4215145f073447b3844adb378
SHA1 8ddc66fa157930f2c8fabba85d53211c5e38c1ee
SHA512 3dff90a884563afc7208b5fcfa75965ed3a02847a79a3540fcacbce7525297ffad5c3b265c01eb20752f27e6446cde251f610b99b0863761fb9cdf4b834bb720
SSDEEP 192:sxRZRXyM/jK1Ml8wbm/flsY5GYCbZzoA8p4O/g6+WNIYEgm3nGpTIgIJ:sxRZ9lm/fls4GPkb/5IPos
TLSH
T10A52E9066A249D7BDCDBD20DFA51BF53D6F81573A1901E44AAFC8A1C00E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 889c510ff640b72555baf8bc7922d1d3f6a934003dc4bb784b634d56f07fb8c8
MD5 8b473b79c97cb591b9c7258950263517
SHA1 dd1635a05ba9b7f9faa23932d3614f8c00c3f9c4
SHA512 25f96fecdf4ab630e78109816c9540351069edcba56ad99f580202ff1e33e4834157da1843a4d5911ad2b1ae4143a1e124d8b9a078ef5fcb288938623a4c3f2a
TLSH
T11041D65013741ADDFBA5C5F32FE27E9433B8D8F9080F6F1054D162F53A0536414517A1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 164778bbbde321d8b892564188c85d10bed956c963700ba6f74189ec70e82c8f
MD5 b6621808dc0b050d793e7fc49ecb6776
SHA1 9e28adf8987a50ecd324b94a46d13687e015072e
SHA512 c5fcbefc37253bb490d86273d3873111103bf79ac6f8c274774b84f79f3c9eb3d15812db759dc4b7affac36de32ab222c62bf59783cc636734d2223beb03691f
TLSH
T1EA319CF783F4857E8A0196F0AA14AE2FCE2C0511431C7D6A89E0AE2793F3472E045A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 498986df8d94305f3f025b6f68d37e72a0c980484729e58e790ab64f6cf80526
MD5 265b466ddfcf96a80eb0558714570a61
SHA1 2215813f1f4fa15b7098fe4cfc1fec7af3093332
SHA512 27ef734ebae91c9807927d08d643e76a3e195028e9ac22adb00cd8e842a2acd7ba4c27b8e57654d92e680d7738209912ef3cc46679e3a47fd0be93e1a25932e9
SSDEEP 192:sxRORXyM/jK1Ml8wbm/flsf5GYCbZzoA8p4O/g6+WNIYEgm3nGpTIgDfJ:sxRO9lm/flshGPkb/5IPoN
TLSH
T1FC62D9066A749D7B9CDBD20DFA51BF53D6F81473A1901E44AAFC8A1C00E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4c8aa1466352acb8022239a390597ddaa37cf041f87b233a01152fef4fcdf6bc
MD5 8a6e5028b7cbcd9764ee80ffe9eb456b
SHA1 d3f3dc0cf1faa7effaad17793eac3e611e3a72a1
SHA512 a438cf150be1c730222a9aeb47b70decf694798972b5b4a748b9afb65f578542d0208255f28c9c8b4557960e1e098073ec94ac3fd142246c8efdbee772c585e2
SSDEEP 192:sxRORXyM/jK1Ml8UQdbm/flsf5SYCbZzoA8peO/g6+WNIYEHA3nGpTIgDBJ:sxRO9qFm/flshSPk5/5IQoX
TLSH
T1A762D906A6649D77DCDBD20DFA51BF53D6F85473A1901E44AAFC8A1C00E7ADD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 54c26cbfa4bec548c703483211e3d9ae2c5391882e3a492240687632d8f97e41
MD5 c366c8d48426b3c18b070ed694cf9c3e
SHA1 5219f03a89460539a503bee88f89889ff4de5eb5
SHA512 a020bdfa043d77df9ee408113e503c804f2dac56950b58582270e891d01d52b18c87c65dec79105338e80d423595961d1b7aaee025a6cc37b2cb18582f80dfa2
SSDEEP 768:40D76DrQD8f0DbWgQ6DjfPQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVw0DjGQDL6U:40D76DrQD8f0DbWgQ6DjfPQDFu1jaj0b
TLSH
T1FFC21B2F540CCB7F4F804AADAC29AED66DD801CB97984D9447EA890C03C77EF521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 935941b041c68b61e4ffc60b26df55a99417b6e1026285ec0db1c40ce188a1c0
MD5 b2a62026f99bdf876e65db611f9f6f58
SHA1 5f9ab0956d5a24e07371887c2b262b33aa36dc29
SHA512 83ca78e02ac88d877fcea5bbcf846c9b15c69450e932e2f92e8a81e1c8224008f91a1dd122b3e502be833c0fba878e5e6581336b43362747fd78485c84edd3bd
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHv4dZvtNhW528gBhK4Igvhc3f+BtiHhevn:CdqjXNn7Oj4XfV+gBkldQzLkHv4dZvtF
TLSH
T11591B054327BC3C1387EA54882B9C45F828271A37158A53B3BA902959B67E079DFFCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 88c53e3b944b9cf760801605ea0b00f953f5bdd689896ad6928aa7fc1dbb1ea3
MD5 ea1a01a7dcdf9e84bbd9fbd553e9b64f
SHA1 2e2535739fce33b9fdf86af3cfb06ece9187b0fe
SHA512 6e37c653d727d3681096f2944dedda0aa9c363de8484b8b9e38c045ebe8be6f907ecb5ee67432296d400102c9dc56a5b9557c0c19774854486b4634ad4239851
SSDEEP 768:Hrv+4UNbd63kRxYDTd+ZD00O8gdeX6+qTko0u229a4vsTW47:HbsbY3y1MsvVTVKa4F47
TLSH
T1D403CE32F8699D738CF6D285B10B76436F7811A39AC81B94D9DE7A5C028B56C230FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f675bf7a3bea9e336c09a0f43c18c11e550ca7604c6f420082796bfa6c29ac8c
MD5 5ea21e48b30659d37f533e5ec541d9b9
SHA1 21328d572662e0ddc93df1f4766e8126de132711
SHA512 5557112302a9e69d5c6f32f980293fe67a67e9669f1274899d163008645ca7c090ef604b398a046ff3fcb6b3acc2c1b6819e6c5245e74eb0dda3dda47b931708
SSDEEP 768:kJ30RAYDTd+ZD00O8gjeX6+qTko0u229a4vsTW4FN50IxL:kJ3n1MivVTVKa4F4FNrL
TLSH
T11EF2BF72E8658DB788A6D381B20776436E7452B3D6C82E40D8DDBB1D118B629270FC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8ba53aa824c4634a5917a2a04b01114be53c69a87b821f56daee9d54dbb552ed
MD5 493e3a143579c1702c18e008481e1d42
SHA1 fd73af62b8f15ae58cc80cfef06175a7b7d37ede
SHA512 b16387c4bb321a9f601c31c082ba4fe190d02cda7a8592820d416689c0027c4b406c0bd45ffd13b249d30ffa8e51b38cc863ed5fdcfcb7c9a83279f61710458d
SSDEEP 768:5J37RAYDTd+ZD00O8gjeX6+qTko0u229a4vsTW4FN50IxL:5J3a1MivVTVKa4F4FNrL
TLSH
T156F2BF72E8758DB74CA6D381B20776436E7452B3D6C86E40D8DDBB1D118B629270FC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5b02ad3c5bee2095aabf162bcedffa8d33b174736ec157d37a0789fc5dc78120
MD5 13e06174fe7eb92ba7e3cc58090c61f2
SHA1 480f19714aceb74b7c590b070d3fc861eee3b24f
SHA512 7526c9378af2e8fde66994d2cf9b6bc01023b6d5caf464bc0a3008f07cd22be15bbefd240e89815e6041c42638001ba37feaac65dc4fb885a503ae310116006f
SSDEEP 768:yk30RAYDTd+ZD00O8gXeX6+qTko0u229a4vsTW4FN50IxL:yk3n1MmvVTVKa4F4FNrL
TLSH
T103F2BF72E8A58DB748A6D381B20776436E7451B3D6C86E40C8DDBB1D118BA2D270FC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 6933546984ec9457285f4080c76c43e33a17b11d75e78449e9cd143e5f5bd30b
MD5 e0a6686d5c64087996eace56d4494c1f
SHA1 a5fe1115846601ec24fc89834f9a8c5a24612f5f
SHA512 f4092692f4e0cd5e363cc5bf25cd1ab76f004e04b854b976249f335007071b4a52e6f8812528476cae74e9b0badcb9f2ad7a5c9586c549fd3a1308d14d1a6cc7
SSDEEP 768:Vrv+4UNbdG3TDuDTd+ZD00O8gpeX6+qTko0u229a4vsSW4eVH1SdW:VbsbU3D1MovVTVKa4c4EH1h
TLSH
T15803CE32E8A98A738DE7D685B14B71472F791263C6C80B90D8DE6B4D068B56C230FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0810a248-f484-4cb8-a9af-b1240493a3ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0810a248-f484-4cb8-a9af-b1240493a3ab.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download