d92065054760445a1c7ffb8df944e4bf13206c66ec3bf63e9c92747f62f88125

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
alisa 2025 crp.htm
Size 21KB
Sample260827-vm5beaydnd
SHA256 d92065054760445a1c7ffb8df944e4bf13206c66ec3bf63e9c92747f62f88125
MD5 9b690e2ef78f3e1c7554b838436d5e14
SHA1 090a77b06ee02f3bc634d3284b620080f82c8129
SHA512 296732e7c9e36ebc9ed3bf593eaed853a178e04f7ec761ab096e1823907127a32e300313499088e516c77fa6d48f3fd9beee95627061cc7e9deec0e5c8242e92
SSDEEP 384:B3cDKcuP/FnX16OW3OGRz3apKZJri2bZcFMKYbWJmjoRICF4rPj1iz6sDACv1:RcDVuPtF6OW3OGRz3aoZJrisnjWrir1+
TLSH
T1CAA2FC5133E03848139B0BA3B31B74C6F95694DBA68480CEF61CFD01EF46B66DBA2674
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3060	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323240627988984"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{B059D497-B65F-4AB9-A26F-829B64A4CC9F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6024	msedge.exe
6024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5368 wrote to memory of 5800	5368	msedge.exe	89
PID 5368 wrote to memory of 3060	5368	msedge.exe	90
PID 5368 wrote to memory of 252	5368	msedge.exe	92
PID 5368 wrote to memory of 252	5368	msedge.exe	92
PID 5368 wrote to memory of 1076	5368	msedge.exe	91
PID 5368 wrote to memory of 1076	5368	msedge.exe	91
PID 5368 wrote to memory of 1076	5368	msedge.exe	91
PID 5368 wrote to memory of 3700	5368	msedge.exe	93
PID 5368 wrote to memory of 828	5368	msedge.exe	94
PID 5368 wrote to memory of 3700	5368	msedge.exe	93
PID 5368 wrote to memory of 3700	5368	msedge.exe	93
PID 5368 wrote to memory of 828	5368	msedge.exe	94
PID 5368 wrote to memory of 828	5368	msedge.exe	94
PID 5368 wrote to memory of 5148	5368	msedge.exe	96
PID 5368 wrote to memory of 5148	5368	msedge.exe	96
PID 5368 wrote to memory of 5148	5368	msedge.exe	96
PID 5368 wrote to memory of 1628	5368	msedge.exe	97
PID 5368 wrote to memory of 1628	5368	msedge.exe	97
PID 5368 wrote to memory of 1628	5368	msedge.exe	97
PID 5368 wrote to memory of 2644	5368	msedge.exe	98
PID 5368 wrote to memory of 2644	5368	msedge.exe	98
PID 5368 wrote to memory of 2644	5368	msedge.exe	98
PID 5368 wrote to memory of 5364	5368	msedge.exe	100
PID 5368 wrote to memory of 5364	5368	msedge.exe	100
PID 5368 wrote to memory of 1976	5368	msedge.exe	101
PID 5368 wrote to memory of 1976	5368	msedge.exe	101
PID 5368 wrote to memory of 1304	5368	msedge.exe	103
PID 5368 wrote to memory of 2856	5368	msedge.exe	107
PID 5368 wrote to memory of 5588	5368	msedge.exe	108
PID 5368 wrote to memory of 6016	5368	msedge.exe	109
PID 5368 wrote to memory of 2896	5368	msedge.exe	110
PID 5368 wrote to memory of 2896	5368	msedge.exe	110
PID 5368 wrote to memory of 6024	5368	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\alisa 2025 crp.htm
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ffcedffc188,0x7ffcedffc194,0x7ffcedffc1a0
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,12009161821388261666,2064032505524942569,524288 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,10907604951764902745,5701354822185688373,262144 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,8613438076355638024,3104557098048353961,524288 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:13
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,6156581451207696629,12974950721740200038,2097152 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,6045458158302792823,18258499246920367498,2097152 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,308017950517871896,8700467597787525191,2097152 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,18392752357479307791,10291512533907035548,2097152 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:9
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5352,i,8494039359945566318,11983680079879264392,2097152 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,9739127497996360852,10251617849681187890,524288 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,2130968413152264337,6411163622566262218,524288 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,1550244444241082829,12529742050409357459,524288 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,1550244444241082829,12529742050409357459,524288 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,16524272719691204393,16558675188279693394,524288 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,11530204681063322148,540836680136136882,524288 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,13831597785345973011,2914820632492208063,524288 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,2997530523878585336,6014982288912894716,524288 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6620,i,14559922158381925181,10561985375009297613,262144 --field-trial-handle=2212,i,18360331717106800068,824990416376043509,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 9952219a48a85e3dba99c55dc313b86c865ac83147078c35a48fd65894d47e0e
MD5 d07e3566cdb3a942150bbfc31dcc646b
SHA1 1b73bb5d26a6489abe8f3078178e21e9471f8fbc
SHA512 45afa5d9940de3b0d93c37f2b123a2975b35524e3cf4e91f62aab3d547642915022c440be8ca67e2cbf4d2b71f3cc2130e9cbeb336abcb1c16816340aad8a51b
TLSH
T1CB21DC546B3F5AC1F7AD69B155DBD59A7239A75DCB036FF100D0747CCC077051011550
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 3ddf042ad0e790d26900e726a105e9653bd0bad92cc812a74dfcf6542351c08a
MD5 4ce3d8026c04a9ae0f737adef8cfb980
SHA1 3af93565ca7728e83c7caea8a53d636227e01dd2
SHA512 65089a31e6b2d0b23ecdb9bc8ba178262fe1a151ecb9fec0bd399573dce1d5503080619bab3aca209af99bbe58c1532df04062d465bd9a01010848f82f01bb63
SSDEEP 96:DAOYUieaoaVaiZjhWZCb9zSunKl7O7mGwQ:DbYUieaoaVaiZjhWZCb9OuKlS7mGT
TLSH
T139A1BBF6C3D483BE891116F19A25AE2BCD1D151A832C3C5A89F5BF1B63F2471D102A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 223e3c521001c07f58a1a21ae085da96533450079ca91d8b814e30a2a4207d23
MD5 3384114f729aeebbeefa2e70ff2c0ec2
SHA1 2739f780155380dce872d38380ad6956f6234b0d
SHA512 da295f3099707fa3d9558ce433e3e02fc79d11ebb8f52447f532d2a8108bd3e0a96bb86ade6ecc1581f025d8f19ffa48320e53530a75ba1d016788a0d016cfa3
SSDEEP 192:sxRCRAb2/f8sxJN8Dde5lS3zoD8p4G/g6+WNIYCNHuOAG5IgIJ:sxRCI2/f8sxJN8c5lk3/5IZxs
TLSH
T10D32A7155A28A93B8CC7E31DFB55BF53D6F96032A1941E48A7FC961C04EBBDD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1e95f3482f0f145093cbff0884f64111572b36ceced147253e4de6b8031a754d
MD5 03415a1ea37bc22281b91e03343a7372
SHA1 2bbbfaff2cdeb9e2d214903caf94f74fe1fba2a9
SHA512 e4c7e48bc870ee081f9c8e389957a0dbc8a1198c1cb8e54e195d0490bbe7173d9510645022bcaa9d49307cf5c597830b2af57447a2a1bfc90a01f791b16fc2dd
SSDEEP 192:sxRNRAb2/f8sTJH8Dde5lS3zoD8p4G/g6+WNIYCPtuOAG5IgDAJ:sxRNI2/f8sTJH8c5lk3/5IhxY
TLSH
T1D042B7169928AD7B9CCBE21DFB55BF53D2F96032A1901E48A7FC961C04EB7DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f82d8725b1d7bbfa0a6b9650b71361bffd6e8fb8e425c922a34776856fdb6226
MD5 0fd6bc601bda4c8266d80bb367704f28
SHA1 d75c288b3be9af603c83891f5dd1b0b66dec8eef
SHA512 d81f863483f213953b959d7a8bb0bb530ff1750bb2856e0df1ec98b555f5c23973e11ab851422256edf9dbc244e9980d7805c2a4ae7a6cfe4e939a57272e40d5
SSDEEP 192:sxRNRAb2/f8sTJN8Dde5lS3zoD8p4G/g6+WNIYCNHuOAG5IgDaJ:sxRNI2/f8sTJN8c5lk3/5IZxa
TLSH
T1DC32B7159A28A93B8CCBE31DFB55BF53D6F96032A1941E48A7FC961C04EB7DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 b6cde0df3f2d5a24b15e0293608c2dc9ba840eb21a52297962b38dfe6778b637
MD5 121e252fafb94de6ec6c10b5d8bff4e1
SHA1 cbda3371a38ead50fef47dafa43d6e12fc44d8d2
SHA512 0b866e54062e2c9bb36d303d561ba7c4d9d0bf17618e91a2b118b260b5e9fb18df0c14de3d0994113d963a000c2ef50a2a1d3ce6bbb9f96461cf35a8d69e0855
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvJroZSs:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0Vd
TLSH
T1B9B2E92B600DCB7E4F800AADAC597FD76DA802CB96589D4047FED90C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ebf75dc5986d83c9382bfc44c9387e4be76b9a0d24b4d33d0242ab8373276fb4
MD5 1c341152974830be17d7763ff810d04c
SHA1 c39fedad48c74f444d8d077a430cee8801192bda
SHA512 70ccfc52df4c6b716cbcd8d9e7ce44a9c327007cab494ac53c989870caf5190df860286369d8ee2780ad79113321e6e697ccbb7eca4710493c9fbdb752bd2974
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHmGmbmqmGmAmomomuWmYmNm1gmmmuK4mbJ:CbEBVj5JAdSp9/EgTK7j6dJOHZ2HDxT6
TLSH
T1DA914301327B02817C3DA94C8479C86F86C1B0663415B76B3F694A964F66E479DFF8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a61c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a61c8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5fae1ae6a8807b6e534d66508e92e428b4128bd7de69609d4da76efd4294747e
MD5 48dcab9111329cf5b2268824e56db587
SHA1 cccf655dfde82e83ca923af4f90716f31e6f8c72
SHA512 88eba5b0b73abc5706d14372bf28ef328158740b8bcb7a0d9cf0d7434dad38543c24cbb171690b5c0e9b9d86ee18f3fbe925e053a1113df67cbdc80358809edd
SSDEEP 768:Yrv+4UNbd73eeUDt/8up8+p3bd66j+4BRv86aLIWvm:YbsbF3Lo8+p3Z6n4ytm
TLSH
T16B03AE73E8699D738CF6C644B1467A437FB851A396C00EE4E8DE6B4D019B09E270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 bfe4a8595aaa7f954916c5b72a3ae6ac5b848c0c8cf7d9724dbbdcc0904f8d7b
MD5 e187a4995d55aab17b95d11ea7eed720
SHA1 da5105b8b5d15a5d1a838fb1d2af65c058ee4d98
SHA512 bbe8ca301c3ceef2aa9264659fa96ed1c64a9516433b17463a67492dbf4c847b2b92f7439c1b6aac23dd9ca53dd357e9d612464df176e2874d9f1d96c1a0273d
SSDEEP 768:CE3dIUDt/8Kp8+p3bd66j+4BRv86aLIWvZC:CE3Q08+p3Z6n4ytZC
TLSH
T1EEE29DB2E8A99D738CF5D384B2463743AEF4506396C44ED4D8DE7B0E01971AE170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0276479bce7a63a893279d800053db4d15e5f86ccaa726302e63b7ec7f926956
MD5 8163656b2b37cde31f85eac3c63b9364
SHA1 01c0400cf7395f2e34178f2b668479008622d10b
SHA512 4d49444ba23476c85d37cde92ba10f3b3809f9c71863e607779137181c3cf73ef5fc4a979cca27da91d59399f889a24bfc5529936b8e7bb6d27ed7203203fb7f
SSDEEP 768:VFQ23TwgZIUDt/Sp8+p3bd66j+4BRv86aLIWvZC:023W8+p3Z6n4ytZC
TLSH
T188F29DB3DC98C9779CF9CB84F6463603AEF450A38AC49ED0E5DD6A0D11971AE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 586ea7490ceacf87d229f6b428aa75794254519680a993cbf61d1a7da5a6d34a
MD5 576187b318ba6a7cddfed878e5af15d4
SHA1 eec4ea25a170d968a4bad12ca150cb48cfe6779f
SHA512 e878bb5dc6d89ecdf8cc7f535d8f20b36ff420798fb6b73617fe0a84b0554dae28d26db629c3675069a943c6af1c73f4f251e8379971f77544fbc3222242aa2d
SSDEEP 768:Irv+4UNbdD3WcDtFNp8+p3bd66j+4BRv86aLIil2bwCl1:Ibsbp3JL8+p3Z6n4yf0ww
TLSH
T1FB03CE73F96899739CF6C644B2467A437FF851A396C10EC4E5DD2B4E019A19E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0f03ef222cadd475a88b8c83d17dbf326111501f624c34549408c2a50d25df5c
MD5 134627977cdba914b18cdbf24e618e7c
SHA1 8b3278afe656c21f6d5450d1ccba246f52bac84f
SHA512 da205dc23ac47e6c5cc92b6f1edcb1c394cfb8ed2521a15fe5cb7d9af8a3b309bf261105355ba8e0dbae7c201617d06cc143d522e8a7c831d82147a1b7c2de5b
SSDEEP 768:Srv+4UNbdD3tiDt/8Np8+p3bd66j+4BRv86aLITv2bwCl1:Sbsbp3LL8+p3Z6n4yu0ww
TLSH
T14F03BF73E968A9739CF6C684B14676437FB851A396C10ED0E4DD2B4E019A19E630F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f15e82f7-1e3e-4063-ae7f-0f85abef8dbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f15e82f7-1e3e-4063-ae7f-0f85abef8dbf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download