447f1e7d4340d55f133552600c986c616dd7adf2ba6f78d477f6478b433c0573

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 18:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
447f1e7d4340d55f133552600c986c616dd7adf2ba6f78d477f6478b433c0573.html
Size 105KB
Sample260909-wras2ahn6w
SHA256 447f1e7d4340d55f133552600c986c616dd7adf2ba6f78d477f6478b433c0573
MD5 33d34e02251416c98874e5c4763e2e7b
SHA1 f81a68793f249855f59986b316be3e096e60dd31
SHA512 81c7f45c204ed003ad6c374fd6a307ad6cd6b086751bf2a2a01106155b7eee6f2adaedb99a089cbae2cd7825d3cc075bbed32aa3ed6a7ba31231039763cc4b41
SSDEEP 1536:JGx4Yn+hEPsgREVsycBu5667sUlbQSTtZNohxGdpnbEaoFbEaoB:0G3QWNvPndoFdoB
TLSH
T1CFB3938701204CFAEFA14DB2465B58673C2C5437BC5791B9E3FD8FA72B41DAE034A269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
748	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334511630316464"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{9ADA38D8-6AD7-4E47-8D6B-80D93F78E914}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 5420	3184	msedge.exe	88
PID 3184 wrote to memory of 748	3184	msedge.exe	90
PID 3184 wrote to memory of 5572	3184	msedge.exe	91
PID 3184 wrote to memory of 2912	3184	msedge.exe	92
PID 3184 wrote to memory of 5572	3184	msedge.exe	91
PID 3184 wrote to memory of 5572	3184	msedge.exe	91
PID 3184 wrote to memory of 2912	3184	msedge.exe	92
PID 3184 wrote to memory of 4644	3184	msedge.exe	94
PID 3184 wrote to memory of 4644	3184	msedge.exe	94
PID 3184 wrote to memory of 4644	3184	msedge.exe	94
PID 3184 wrote to memory of 3496	3184	msedge.exe	95
PID 3184 wrote to memory of 3496	3184	msedge.exe	95
PID 3184 wrote to memory of 3496	3184	msedge.exe	95
PID 3184 wrote to memory of 5408	3184	msedge.exe	96
PID 3184 wrote to memory of 988	3184	msedge.exe	97
PID 3184 wrote to memory of 5408	3184	msedge.exe	96
PID 3184 wrote to memory of 5408	3184	msedge.exe	96
PID 3184 wrote to memory of 988	3184	msedge.exe	97
PID 3184 wrote to memory of 988	3184	msedge.exe	97
PID 3184 wrote to memory of 1920	3184	msedge.exe	99
PID 3184 wrote to memory of 3232	3184	msedge.exe	100
PID 3184 wrote to memory of 1920	3184	msedge.exe	99
PID 3184 wrote to memory of 3232	3184	msedge.exe	100
PID 3184 wrote to memory of 1004	3184	msedge.exe	102
PID 3184 wrote to memory of 2980	3184	msedge.exe	106
PID 3184 wrote to memory of 1580	3184	msedge.exe	107
PID 3184 wrote to memory of 3352	3184	msedge.exe	108
PID 3184 wrote to memory of 4260	3184	msedge.exe	109
PID 3184 wrote to memory of 4260	3184	msedge.exe	109
PID 3184 wrote to memory of 2324	3184	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\447f1e7d4340d55f133552600c986c616dd7adf2ba6f78d477f6478b433c0573.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x2e4,0x7ff9042fc188,0x7ff9042fc194,0x7ff9042fc1a0
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,5095338445369845337,7173190459399644522,524288 --field-trial-handle=2580,i,5300272843244520776,9552489363852686785,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:11
  2⤵
  - System Time Discovery
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,16208378523560149721,2734436142318200168,262144 --field-trial-handle=2580,i,5300272843244520776,9552489363852686785,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:2
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,18212080793243494809,2898587177709054052,524288 --field-trial-handle=2580,i,5300272843244520776,9552489363852686785,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:13
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,7790368164405896582,2613486120752088205,2097152 --field-trial-handle=2580,i,5300272843244520776,9552489363852686785,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,3468676733786340843,15217911431477489942,2097152 --field-trial-handle=2580,i,5300272843244520776,9552489363852686785,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,9610111577800781213,5983805908343144026,2097152 --field-trial-handle=2580,i,5300272843244520776,9552489363852686785,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,17021674149049678561,10266732854887052977,2097152 --field-trial-handle=2580,i,5300272843244520776,9552489363852686785,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:9
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,8296872933941716900,16485763797244552229,524288 --field-trial-handle=2580,i,5300272843244520776,9552489363852686785,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,10407409465334588756,9149359183897916745,524288 --field-trial-handle=2580,i,5300272843244520776,9552489363852686785,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,3423168890316519911,1625778468992884001,524288 --field-trial-handle=2580,i,5300272843244520776,9552489363852686785,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,3423168890316519911,1625778468992884001,524288 --field-trial-handle=2580,i,5300272843244520776,9552489363852686785,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,3943283315264034120,13684768966677383040,524288 --field-trial-handle=2580,i,5300272843244520776,9552489363852686785,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,2710716820362194212,11255677852315818737,524288 --field-trial-handle=2580,i,5300272843244520776,9552489363852686785,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,8701681679320288409,1232353026098110334,524288 --field-trial-handle=2580,i,5300272843244520776,9552489363852686785,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,14933793684516502555,11052888113924065320,524288 --field-trial-handle=2580,i,5300272843244520776,9552489363852686785,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5220,i,13478633425381313792,11385204512678866762,262144 --field-trial-handle=2580,i,5300272843244520776,9552489363852686785,262144 --variations-seed-version --mojo-platform-channel-handle=804 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9967c5177e7b0adc475ef7c73db04f749516e1ef35f01824467ea31d42114a0c
MD5 0ac244ae8429e678148ff5dd049616e4
SHA1 9b803361381c36420a60c651897b66cd3c061b50
SHA512 7efaaae8e8105457412c36f42eb0fd70d71ca61a7ab1592f037c60964dc834a221ebc356e51962e6dc3f06a04b91f92f71c7d2f2d7e255469cbb3db15656a92e
TLSH
T175512BF123E21AC2D32C69B697D28CD836F5A86F04831E107C54BFF09986F1790E1857
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598478.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598478.TMP
Size 3KB
SHA256 eed1ea05b6f59311e68050aacd902fd3e9ae0ceed7dd84e865786aad557ac398
MD5 63667acc7b2ae1f50459e07c0152d191
SHA1 8301b494c40c3e48ce405761245e21a531f247be
SHA512 f3b841a91539afc8a82a356d8d4ffe676106d0c5acc1784399c92164328f6b6e87d5cd8c8404dc15671ff17760763785a662841a7f4bb10fcf09480f8555c666
TLSH
T151512AF123E21AD2D32C69B697D28CD836F5A86F44835E107C94BFF09986F0791E1857
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 651c5bd2deba2aec673ae4ddec55862467ddd14244c7e733fc433250cb47cab4
MD5 21ef3edcaadf3783acc2b424edd465d5
SHA1 af3806c0731c4d46fca2ac14ac3d3478d3dd6dcd
SHA512 14d0db79af1d1e97af07abdd109db619977f44f26d6a547242f2a11e9686f2cde496889d72cf7ca36b9f0a7da9ea8f59a0956f9f74dc51e5c2b3dc7ecc9cdb7c
TLSH
T1F451B4F7C3E4867E9A1196F0AB14AE2BCE1C0515532C3C5AC9E4AE1B93F34B1D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 501a738150a639c6f418c3b0224d5f0a7ba239efb4b21dbfef1b587e734370ac
MD5 173b337aa1190519e00772a7e9d376c1
SHA1 83e42a910c213084a9a6b7f4a51821e8bfb53236
SHA512 54211e57ee486619483f44105424aafd72d715f5746f83cacb6ee64ec667862d80f4d0d20a64b97ed512000d68e19d123a4e1f45ef20726543da20c88472cebf
SSDEEP 384:sxRyndnplpX/frZspiehR5l/5IT1zdyjOYPk+:sWndn3pX/frGiehDl/5IT1zdyyYc+
TLSH
T10A52E915AA34697BCCDBD20DFA417F53D6F81573A1901E44AAFC9A0C00E66ED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c19d9177d9f0038f46d2648ef06f7a837068d239a5c136840a6e1b82f585be50
MD5 f0cebdcf0bb34cb0bcdcb64d7ed1d0b0
SHA1 5395afeb5e5ee3a6d370688d50d9f3227fbe5e5c
SHA512 a132129521c6915b7feff42eee41530e15200b5347694c8f96f0ad482db0506726a3bef56369f5cf8b4392da628bba63e2d226812e2aa1145bf591aa0207c744
SSDEEP 384:sxRyMdnplpX/frZsWehR5l/5IT1zdyjOYPs:sWMdn3pX/fr5ehDl/5IT1zdyyYU
TLSH
T18B52D815AA24697BCCDBD20DFA517F53D6F81573A1901E44AAFCDA0C00E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 78c901d6c0a1bb5bc002b511412892d7492b4203baf8e89346fc776e75ded291
MD5 8c28a17a74bb014e0790eb77c8b612ed
SHA1 0df22d7d4501eb1924175566752395e114232a92
SHA512 e183b3f2944416dc037614daff04e2ba2c9364790231ae4b0801800d1b4ed37354ef9e731ac35c6742734d23306896c3a811c378829482e27a0cd21d7aa26383
SSDEEP 384:sxRyndnpqfpX/frZspcNehR3l/5ITMbdyjOYPk8:sWndnwfpX/frGcNehhl/5ITMbdyyYc8
TLSH
T1E362F815AA24697BDCDBD20DFA417F93D6F85573A1901E48AAFCCA0C00E6ADD2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 10e04e13a18f171eed69d0bb22aa503de3134bd37a6c6eeafc1c41c7d848f537
MD5 7cc3d8d4be1b7124cfe22621d87077cc
SHA1 0a3184837a237ed40b3784ba447de369cc408ea5
SHA512 d5b4b406bfe4fc3d6cb451ba4cb1c069f3a82e9fcc31a21cecc95b94441d6ad7bed22df314118e061ce6bee86eba997085c1ba96151d92fb29e022c8db69fcd6
SSDEEP 768:wGedp6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIu4YpEroSh8Q5W:wGedp6WgoufDMu1jatVYJeI
TLSH
T124C20C2B640CC77E4F844EADEC29EED76DD801CB9B984D5447EA890C03C67EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1032052e0974796ab8327f0f3de685a8b6eb70e0b29c9a19cd006f72a6b08ce7
MD5 2e3b4054997151435c8cc6cffe88f0ab
SHA1 a28cd042c5b4dccf3af1077608a73ed84064c4e9
SHA512 bea505e636cde23d48527829ffaad7460c184a295faf930c397bc1499bbf5045a71a77c915f1e1420f51288e2465f057206c016eba7919407e94dd159cae4708
SSDEEP 96:KR4i4n4O4i4U404k4iW4s454Rg4S4iK44Hg4I4ic4y464h4A4i4LH4/4o4N4J4/Q:Cr0xFzJZQNi5tPUgD6LTqN5eHyX+SkED
TLSH
T134913100703A12943C3DF90895F99D2FB28274E67119F56B3BA905E55F2BE068EFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a133b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a133b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c79c4d4f8a8a7d5af821408219706934a0ed70248b4cd5e87b61e6ded6c73771
MD5 6326047add0c278b92db75b1f8df80a6
SHA1 f9f4584adcb0f785e58ada756de880cae34c289e
SHA512 0b2d29774a6943ae4ef609c67fefab982d5c3d02e934d7978fa482d54baf58c046e0085f6f113d6cd2a11ace00ffe408e5649c6c88fbe05d4497d55e6dd90acb
SSDEEP 768:6wrv+4UNbdsA3Gf+r38ZP0jCDZIO0fNzc4ReyIsPL6vMgNKkb:hbsbV3ttc44bsKMgNR
TLSH
T1C003CE32E828D973ACFA6686F50776537EF4125741C82AA8D9DD1F4C068B1ED130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ec6e8ee8709ddbb836a60a81bdc25e0c1e5eadaf52fc224554aad88cec2ae602
MD5 e77d2f8cde8b893e494dd27a5714cf53
SHA1 c11a3feadafd921250663bbdd78f124ed5faba1e
SHA512 415e39a1ad043afc4977749add70d8ec587feb71473e1f1a8203e67f7bb3ef39d648327394a4764dde2a8f5e4ff78f339880a1b4e9d693b8b3c11bedd568d082
SSDEEP 768:6MXA3Gfvrs8nP0jCDZIO02lNzc4ReyIsPL6vMgNKMFHc:Xw3Stc44bsKMgNt8
TLSH
T120F2BE32AC24DDB3ACFAA786FA033652BDF5425781DC2D9485DD6F0C058B6AD031B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c17efaf3a57c11b3eabc246c00cdb9f48e69affe965a972406c947b018cc773a
MD5 3a2fd14836412e13f8bf7cd79ab89172
SHA1 0a4fc52dd44a1caae5882492f6db4e6c082d4c7e
SHA512 0d94eef9ecfef1b75356ce23e9e6aa1043df0bbc7d18abf15560100bae4fc9ed05372c41685de7e4d3b0b31cea3fb909dd9a1e9f4754ded12deb1abbeff1b099
SSDEEP 768:4pMXA3Gwvrs8nP0jCDZIO02lNzc4ReyIsPL6vMgNKMFHc:9w3dtc44bsKMgNt8
TLSH
T102F2BE32AC24DDA3ACFAA782FA033652BDF5425781DC2D9485DD6F0C058B6AD031B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 101ca868fd1aa01181b084e57ff6c812d6edb63bc88c453c68c53fc9a10a8d8b
MD5 adc42706f3579e03de0f1dc052c1ce2d
SHA1 0089d23ad901bb798c42d0ad34ac3af5ca39230c
SHA512 1f3b44d13eb2fdc07aa39a96a57b71905318373cc6473e577f4089f828da2fdae33cd24d47f2e976387f201fdb9448f55d8c3ee4fd9d41975919660f2f17011c
SSDEEP 768:wpVFQNA3Gdwgavrs8nP0jCDZIO0mdNzc4ReyIsPL6vMgNKMFHc:T+3vtc44bsKMgNt8
TLSH
T184F29D329C54C9B7BCFA9BC6FA073252ADF542A7C1D869A4D6DD5E0C014B2ED034BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8fa0d088c57c3d5f13fcbe15b9df9d486c0a1ba67782c39ec5a3e270f4d45cbd
MD5 40e2860cadad9e9213b62c563535def2
SHA1 0e19111263f808024f4a980f190511509acf489f
SHA512 bb3e17052347549182ba685fd1a7150980f3bd538d7e071e598fa0c90230e3ca949a5ba90a3b1e3c80066892169ef1ef909f7b5bcf48cc1e6424ee71f3eac252
SSDEEP 768:6rv+4UNbds36crGDZIO0ENzc4ReyIsXL1eVH1S5D:6bsbS3qtc44bsJEH1Y
TLSH
T1BA03CF32A8388A37ACF66686B50776637EF8512BC2981ED4C5DE2F0C464B1DD134B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3811ece174f830b387e75499ecbe119c5acb52059fd7d9ca18e6b9ed36c2da17
MD5 2c2f296cebee5d807d09549187766278
SHA1 d041c1a8234bb8b782b7c0c457e87b5d376249a8
SHA512 65ce0f89518847615347b00cbcc2023d114118702bbad705b38131050b69dd4a6612fc96ad2d7320650b6383700dfa5e186e77ee0f6d526f1ac43c6c3dfdae1c
SSDEEP 768:7arv+4UNbds3FNI2r0jsDZIO0fNzc4ReyIs2L6veVH1S5D:ObsbS3Atc44bsxEH1Y
TLSH
T17103CF32E828DA73ACF66686B44776537EF9521B82981E94C8DD2F4C0A4B4DD131F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

610ed1f5-4353-4d8f-b0e7-9d939f60ac70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\610ed1f5-4353-4d8f-b0e7-9d939f60ac70.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download