4bd67f0b97a4db158e6f5cb3a065cb2ed363db0bc8d0e8335ffceb0286f60312

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PusatCs/3/empat.html
Size 7KB
Sample260910-qcf4lscp2t
SHA256 4bd67f0b97a4db158e6f5cb3a065cb2ed363db0bc8d0e8335ffceb0286f60312
MD5 5573cedd5ddf0d9397d38711c7d25013
SHA1 0884c3c2a69fed880ea2ed859909b6ce7e3a761f
SHA512 e037b3bfb7f31732cc3322ca95ac8628b88685cfae8e16b9e94d2831548d35edefd201892d28380a6f950c5b91875742bf1276edc8c6a3c8c32541307b1454e8
SSDEEP 192:fF92l4aaxfJx34YXAxNpR3dZ45JPprKyJW7:N92l4aYI
TLSH
T121E1544715E310963907A0A49BFB6B4736559403C20ADD6A3FCC639CCFC66D888A338C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1988	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335192224302853"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{BADCCB5C-6626-455D-A965-8C1D7B27443B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 5732	5056	msedge.exe	89
PID 5056 wrote to memory of 4172	5056	msedge.exe	90
PID 5056 wrote to memory of 1988	5056	msedge.exe	91
PID 5056 wrote to memory of 4172	5056	msedge.exe	90
PID 5056 wrote to memory of 4172	5056	msedge.exe	90
PID 5056 wrote to memory of 1472	5056	msedge.exe	92
PID 5056 wrote to memory of 1472	5056	msedge.exe	92
PID 5056 wrote to memory of 3412	5056	msedge.exe	94
PID 5056 wrote to memory of 4528	5056	msedge.exe	95
PID 5056 wrote to memory of 3412	5056	msedge.exe	94
PID 5056 wrote to memory of 3412	5056	msedge.exe	94
PID 5056 wrote to memory of 4528	5056	msedge.exe	95
PID 5056 wrote to memory of 4528	5056	msedge.exe	95
PID 5056 wrote to memory of 4600	5056	msedge.exe	96
PID 5056 wrote to memory of 4600	5056	msedge.exe	96
PID 5056 wrote to memory of 4600	5056	msedge.exe	96
PID 5056 wrote to memory of 4224	5056	msedge.exe	97
PID 5056 wrote to memory of 4224	5056	msedge.exe	97
PID 5056 wrote to memory of 4224	5056	msedge.exe	97
PID 5056 wrote to memory of 4100	5056	msedge.exe	99
PID 5056 wrote to memory of 3816	5056	msedge.exe	100
PID 5056 wrote to memory of 4100	5056	msedge.exe	99
PID 5056 wrote to memory of 3816	5056	msedge.exe	100
PID 5056 wrote to memory of 1116	5056	msedge.exe	102
PID 5056 wrote to memory of 2628	5056	msedge.exe	106
PID 5056 wrote to memory of 2700	5056	msedge.exe	107
PID 5056 wrote to memory of 1996	5056	msedge.exe	108
PID 5056 wrote to memory of 4280	5056	msedge.exe	109
PID 5056 wrote to memory of 4280	5056	msedge.exe	109
PID 5056 wrote to memory of 1116	5056	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\PusatCs\3\empat.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffe8751c188,0x7ffe8751c194,0x7ffe8751c1a0
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,2681177408459655472,11429168074165345978,262144 --field-trial-handle=2456,i,12445483734368602023,2076583906365701099,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,2283049014695837056,13568585798745236419,524288 --field-trial-handle=2456,i,12445483734368602023,2076583906365701099,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,3542802547213326297,14658347653771860431,524288 --field-trial-handle=2456,i,12445483734368602023,2076583906365701099,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:13
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,10918009922119586,9835764717123317956,2097152 --field-trial-handle=2456,i,12445483734368602023,2076583906365701099,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,15440302003320090878,8232845864102730328,2097152 --field-trial-handle=2456,i,12445483734368602023,2076583906365701099,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,3175857546553269441,6847858814139621458,2097152 --field-trial-handle=2456,i,12445483734368602023,2076583906365701099,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:9
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,11881664023859025617,9854590970882089912,2097152 --field-trial-handle=2456,i,12445483734368602023,2076583906365701099,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,14104211721374521506,16264730237189281390,524288 --field-trial-handle=2456,i,12445483734368602023,2076583906365701099,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,6501054461175961366,1880013403867654795,524288 --field-trial-handle=2456,i,12445483734368602023,2076583906365701099,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,17852369374995061135,13303061430260945147,524288 --field-trial-handle=2456,i,12445483734368602023,2076583906365701099,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,17852369374995061135,13303061430260945147,524288 --field-trial-handle=2456,i,12445483734368602023,2076583906365701099,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,2579340332109184452,5814381030351371292,524288 --field-trial-handle=2456,i,12445483734368602023,2076583906365701099,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,12824854741243271159,6514530691659056986,524288 --field-trial-handle=2456,i,12445483734368602023,2076583906365701099,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,16711653386617217544,78559422212924073,524288 --field-trial-handle=2456,i,12445483734368602023,2076583906365701099,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,13791055578969030914,8547792349088227416,524288 --field-trial-handle=2456,i,12445483734368602023,2076583906365701099,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,5970736871870809442,4546845528810667540,262144 --field-trial-handle=2456,i,12445483734368602023,2076583906365701099,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

8ab81654-83f5-4999-bbd0-0abb644bcb5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8ab81654-83f5-4999-bbd0-0abb644bcb5d.tmp
Size 23KB
SHA256 0e73334570f70d2748f25f494fceb91a4e55259686ff1c91e9ff447a395f25a3
MD5 fd8a7af989fcca93a59a4dc7aa8d9309
SHA1 e62a2be99e28eb826a49eb33255920885019adc6
SHA512 ec6550f04de12ba66dc24efbed5e58d5fcb8513c0fbe09f4a526131adaff932658bdaea03c61cf82fdc11894968e3197599f9ef44711323fe81b66b6322b3c75
SSDEEP 384:KAX0EdqfCtgNbFfVNKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVui9LZRGxrocmG:K80EdwWgNhfVN8F1+UoAYDCx9Tuqh0Vf
TLSH
T1F5B2CA3B640DCB7E5F800AADAC196FD77DA802C7A6988D4047FE994C02C77EA91194DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 de88bca5c6ea40b195a1884d752a03dab093bd2a573542559fce0b61151599a7
MD5 08b6d4e8406dc2a947bcbf2d225cf757
SHA1 19229fb49d2c62b12ced1e39ff514fb55f78931d
SHA512 00b9e14c513ce791bbd991fbab6b507c5ea113971e07551cdeb1ac6191f49dfaa921eea93f4f68dcc78800874228c944fbf597b1258b601051ed7b900ea89d1a
TLSH
T163513B5BC3FB45E6C32B82B652DC5C79BAF0848A02076E2341213DB88BDBF5451F2293
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5959fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5959fd.TMP
Size 2KB
SHA256 ee6ab9d7bed53c0d24b501f8e266b8bdaa9cbb2da2e646aedb1f92c9529f8a3d
MD5 7d2a06d6cca77d48377835ef79851dfe
SHA1 d2fb2235ba659857eecc9aa52ccde7f026240ab9
SHA512 035392a10b37ddf0a67657bd5caa04d3ba4c71832ae1aa1575e94e1febddc6506ece32bd445053644af30a4b56b3ccdce927e1508ac14f23976549cd7bfb8761
TLSH
T15F513B4BD3FB05E6C32B81B652DC5C79BAF4849A02436E2341213DB84BCBF1461F2293
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8779b9ab998c5ccbb421befff3486e5db814fec920410d311225b197390e4331
MD5 249e4adefd15340e5d7b3b470d7d9265
SHA1 304a056b76d111b4dab5b34a68bdd1c13fe8f36f
SHA512 20e05a2cb318adcd8fd6bbfe54690bdc6690036161ae6c6e55a74e841b390dde6ad6600928265eabd613bedf2748ca504ea9e0231717b00f06d96a7be92ade8c
TLSH
T12C419DF783E8877D8A1152F0AA156E1FCD1D0426436C3CA689F4AE1B63F24B1D14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3609ffcacc9e90f24af05d30b8a6e14233841613c8cb68a18c11d0bc43743a4e
MD5 026f86dba0ac289d51658e9a344ed964
SHA1 f258334981304da6120ad81c0818d251a1321bc8
SHA512 a6de37c94e2893fe417a3b3c87ca2113f0d56da595f81e1e5a09d1ffae3c3aa07bff1dfc2bd4d36e53ab7c3e7d8ccc650c76db49efe93b1aed3ed8ca307cd2aa
SSDEEP 192:sxRELrbr/fasE3AtizoA8p4U/g6+WNIYZFLKu2nG7IgDRJ:sxRELPr/fasEad/5ISP/
TLSH
T19232C816AD28A93B8CC7D21DBB55BF53D6F95032A1A42E48B6FC971C14E77DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e5f25ef03bc3131f8f8a815e9e4e1574d3a3359fd4856b77cfa4d5df827529f3
MD5 31780d1a0a23d196aa23bbb449813301
SHA1 6b5d647dc8853499dc71faeb408d34bd89e89a87
SHA512 31cbc2dee8bf9e9866b33f5b1300e0608d287225863deac67529751762d3657e71ec0b7d6de35a22a85bcc88b9c3583f3026312dcb02e56da267af30a038ae76
SSDEEP 192:sxREkrbr/fasg3AtizoA8p4U/g6+WNIYZFLKu2nG7IgIJ:sxREkPr/fasgad/5ISPs
TLSH
T16C32B8166928A93B8CC7D21DBB59BF53D2F95032A1942E48B6FC870C04E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 30eb8bbe126cd39945008c55c56d460801d08c80dfead332a4862358b752899d
MD5 f2b67efb540b640cc6a40b04d68f6b33
SHA1 dadcaa4cbcd3cb219f407ac456519e00668cf0bf
SHA512 38d4d240aec25b3c673f747392625e21ecdb0312393af8397c334ecc5df0ff2711ae0b2695d21c42fae8bfd9ab7e92a50734a05f85d31aa8cc3269dfe720e269
SSDEEP 192:sxRELrbr/fasp3AtizoA8p4U/g6+WNIYZFLNuAnG7IgDnJ:sxRELPr/faspad/5IS0t
TLSH
T1A632C816A928A93B9CC7D21DBB55BF53D2F95032A1942E48B6FC871C14E7BDD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4a35089f66a1d50ad2b3ff987a8dc5d617fbac11f1dba8f3c08d60391eee32ea
MD5 2b2b95488fcacf4ac6c64ebd60c35268
SHA1 054e56495773cb0ad83b45d6c79594e72a3ad39f
SHA512 b7f2992827c4b3d1134be21c26b4e7f32b02cb86dc0d3d397ce49a45b168845869941669a336215100cfbc1f2956a3f29b14ce15070573b82ad1cc3b05f9a38f
SSDEEP 768:9rv+4UNbdH3EgX+LeSFOU+9B5tHzX4fouOToPvB2thtA9VAB/eVH1SlX:9bsbh3fdsnnwthttpEH1Y
TLSH
T1E303BF32A5AC8A33EDE6D398710BB1872FF4915396D00FC499DE2B4D069B9DE030BD56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 79941ea1dfcf36822d12f47b78e963fa3483a746a8ccb38a90af207be6fbc19f
MD5 f27f3f158f62e1eecb3ce550212bb2d5
SHA1 62f1fda0d08ae7a16a56fbc3db90717227ef7922
SHA512 e9aef849760020172aa7109d89e6500bf458e5349e502c931ba36c93f8fc64e0c14f2f61910b7b3576ee483fd1e53af68d893a2909bb0f341a7bca5796243200
SSDEEP 768:pT73LQg9+LeSFOU+9B5tHUX4fouOToPvB2thtA9VAg//mZy:pT73JYsnnwthtti/4y
TLSH
T187E2C072ACA88D73DCEAD398720A72865FF0815395D41FC45DDE671E058BA9E070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 9ebfbe20f7c4cd3e49e12eeee4732b5ebc1ffb68abe18a19b667a3bf60267d19
MD5 9682ee5e7f9192c7af0a1aa2566580f9
SHA1 7e56938accb7fc1e9b34c4f09cd956cbf89cbaaf
SHA512 d63d6702493b1977a59ff111d87ac031da2fa1bbc1ca275efd9c4fc746434a6bba3240e742b1b3edba808beb100166eb7dfbc2f3857168a0db61d3e39b21af03
SSDEEP 768:hNf3LQg9+LeSFOU+9B5tHfX4fouOToPvB2thtA9VAg//mZy:hNf3JFsnnwthtti/4y
TLSH
T148E2BF72ECA88D73DCEAD388720A72865FF0811395D41F845DDE671E058BA9E070BC6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c5bcb642bd670e1785b42777ccad12b6f8dfc5a589f658ea8fc2dc8a1d0ff98e
MD5 2ce38dc52d562e8b1274bacea255b031
SHA1 fe5923992e066f52785640b8c856c88ca2d0c07d
SHA512 7d83dabb53101a6559309e765a425e109886cf52c8a28898120af0123fa7c16e2c810a7faffeb2258430e6c2ed0c7beddfea07caf34693d9efe7c40ef5a6ff2b
SSDEEP 768:drv+4UNbdQ3bkg9+LeSFOU+9B5tHUX4fouOToPvB2thtA9VAg//mt:dbsbO3FYsnnwthtti/W
TLSH
T1A703CF32E8A89E33DCE6D298710B72876FF4515395C00BC89ADE2B4D058F99E170FC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fbed12118d90042cbd9772c8fcba588952688fe1419f656d7171fc358bdba8d2
MD5 607e8c50e30c1ced7aad8e530a1835db
SHA1 228958f9d172dd9069f22841d7b52f55260c4ff3
SHA512 f0785b248dd30e8b9d89f86a6e219d4abc958111c0f87b7790d684580e7087d15cac76ea2a0dd593c32b5cedf365b0cd47fc8bca88dc896930a1c81a20e5d97f
SSDEEP 768:grv+4UNbdH3MV+LeSFOU+9qX4fouOToPvB2thtA9VAw6eVH1SlX:gbsbh3awsnnwthttrEH1Y
TLSH
T16E03C032A8A88A33DDE6D388710B71972FF4912396D00FD499DE2B4D069B9DD070BD5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a93678a7-eb5b-44bf-b5c6-d40867f3d8dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a93678a7-eb5b-44bf-b5c6-d40867f3d8dc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download