4a39e4fe768480180c72f3728e8741a54ecf085f54f5a288ff3e1a3d0eea23e8

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
affiliation/views/affiliate/admin.html
Size 22KB
Sample260929-w8f2dawsav
SHA256 4a39e4fe768480180c72f3728e8741a54ecf085f54f5a288ff3e1a3d0eea23e8
MD5 1d7cba4f7e4d5c3bd26de62eb7c07cb3
SHA1 e1902828069fc3050f0c14198757651756a4c6da
SHA512 0ce2d79e803f26b9736424abbd1b84b1f4a4bce6626d86a33f5a962827a125868dd273dc151bd47396fbf4d0d6d8b9f736914742a704420f8453d7838504a035
SSDEEP 384:gxoV33DEyhm7olcWyFNzaAiiTr2rASd2uW53M5YShAQwjlMW5MW2IQ+4XoQWjIq9:F3DEyhm7olSc0YZHwnTnL
TLSH
T133A21E7218FF1F72240A62A3986177DE8EA2B0C7E64305507C9D0A788F9DDB1913FD96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5220	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{A4F83753-432E-45BE-974F-55AFD48B8FE6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2920	msedge.exe
2920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5284 wrote to memory of 1920	5284	msedge.exe	89
PID 5284 wrote to memory of 5220	5284	msedge.exe	90
PID 5284 wrote to memory of 5792	5284	msedge.exe	91
PID 5284 wrote to memory of 5792	5284	msedge.exe	91
PID 5284 wrote to memory of 5792	5284	msedge.exe	91
PID 5284 wrote to memory of 4508	5284	msedge.exe	92
PID 5284 wrote to memory of 4508	5284	msedge.exe	92
PID 5284 wrote to memory of 5576	5284	msedge.exe	94
PID 5284 wrote to memory of 5576	5284	msedge.exe	94
PID 5284 wrote to memory of 2980	5284	msedge.exe	95
PID 5284 wrote to memory of 5576	5284	msedge.exe	94
PID 5284 wrote to memory of 2980	5284	msedge.exe	95
PID 5284 wrote to memory of 2980	5284	msedge.exe	95
PID 5284 wrote to memory of 4940	5284	msedge.exe	96
PID 5284 wrote to memory of 4940	5284	msedge.exe	96
PID 5284 wrote to memory of 4940	5284	msedge.exe	96
PID 5284 wrote to memory of 2568	5284	msedge.exe	97
PID 5284 wrote to memory of 2568	5284	msedge.exe	97
PID 5284 wrote to memory of 2568	5284	msedge.exe	97
PID 5284 wrote to memory of 5028	5284	msedge.exe	99
PID 5284 wrote to memory of 3832	5284	msedge.exe	100
PID 5284 wrote to memory of 5028	5284	msedge.exe	99
PID 5284 wrote to memory of 3832	5284	msedge.exe	100
PID 5284 wrote to memory of 2436	5284	msedge.exe	102
PID 5284 wrote to memory of 2240	5284	msedge.exe	106
PID 5284 wrote to memory of 2476	5284	msedge.exe	107
PID 5284 wrote to memory of 6116	5284	msedge.exe	108
PID 5284 wrote to memory of 5912	5284	msedge.exe	109
PID 5284 wrote to memory of 5912	5284	msedge.exe	109
PID 5284 wrote to memory of 2920	5284	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\affiliation\views\affiliate\admin.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ff946dfc188,0x7ff946dfc194,0x7ff946dfc1a0
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,9636523047013689844,58635551627856156,524288 --field-trial-handle=2196,i,14287426205016331407,13705713117169284010,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,9467847117378763508,14385575797185542756,262144 --field-trial-handle=2196,i,14287426205016331407,13705713117169284010,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,17089760179557833702,9135519052111696465,524288 --field-trial-handle=2196,i,14287426205016331407,13705713117169284010,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:13
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,4912884343008760626,2170819405621033267,2097152 --field-trial-handle=2196,i,14287426205016331407,13705713117169284010,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,3532993884561195274,3194332865037811308,2097152 --field-trial-handle=2196,i,14287426205016331407,13705713117169284010,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,4438661742983678645,787302834065499523,2097152 --field-trial-handle=2196,i,14287426205016331407,13705713117169284010,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:9
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,5060948236979774583,9387642112670027997,2097152 --field-trial-handle=2196,i,14287426205016331407,13705713117169284010,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,7279539060865247092,3513325700551436559,524288 --field-trial-handle=2196,i,14287426205016331407,13705713117169284010,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,7668247624921157050,4229514359148622724,524288 --field-trial-handle=2196,i,14287426205016331407,13705713117169284010,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,13237809725703472316,6992769877241941403,524288 --field-trial-handle=2196,i,14287426205016331407,13705713117169284010,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,13237809725703472316,6992769877241941403,524288 --field-trial-handle=2196,i,14287426205016331407,13705713117169284010,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4132,i,12426140513325948708,12229796510803727878,524288 --field-trial-handle=2196,i,14287426205016331407,13705713117169284010,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,16111536015638732055,16137560731725269491,524288 --field-trial-handle=2196,i,14287426205016331407,13705713117169284010,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,11119684847159755043,2187091146834083222,524288 --field-trial-handle=2196,i,14287426205016331407,13705713117169284010,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,4615469583026326323,10066732384922512502,524288 --field-trial-handle=2196,i,14287426205016331407,13705713117169284010,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6228,i,17463652559546705132,16383484724231031441,262144 --field-trial-handle=2196,i,14287426205016331407,13705713117169284010,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 25559293c954898f2da344ed5fe3faf3c076ca2a1868befb99178bedacb3d026
MD5 7921e958d547711c39f2211be9d582e9
SHA1 d327f17351a129da59733ef73c24b256addb1b88
SHA512 29c83b34cc319b93140a7156f0e4fd32fca94b626b32f9aa46eb5471603b5bab4338ee0313db91199b04ee0ff93fc3dd5d552299e129f6c1cd750f4211244525
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T117B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3dda12b9d28cfa93f06e7ea57a450f08bb40857ecd3e61b03cc3128fbafe20fe
MD5 02e342f598fe485d664714afc95318ab
SHA1 00dc671f633d25f787fc9a9c893b7d5f4e94b811
SHA512 cc52ebbfdb6207c757c143daeb0cf3824bd24e6287e550315ffd119ab7c58f8edba63bac444176a27766d5bf7ce55164abe4a8c4d275ade8c7117178e33e01bd
TLSH
T16B51B7896661A0B4E7A719704DD132C37B34867ED7FB2E9E0DF8F4B51B4E350601103A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59aa11.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59aa11.TMP
Size 2KB
SHA256 4caeb010aeb8ef0dc13d46e91f9894a6923d85d26121d31b36fe22cf64e4b4e5
MD5 1ead354ca38c872589ffd751cf2d0c5a
SHA1 1c05b85bb0da72bf09af841272dbfc4753f02105
SHA512 864dffaf49e30e9b69b90083738946b12b238485377ddf1c65a90dafab242ab9ccab6794ca2016eade0a21e4c2356610713ce815818a16d2575ce527f72da9bc
TLSH
T1FF51A6896661A0B4E7A719704DE132C77B34867ED7FB2E9E0DF8F0B51B4E350601103A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6741b667c856a4f4a6cdd8d5a10303937b822de5f26afefc2ed6bfdf689833c3
MD5 90901aa8281531ab31fe185135b1d6a8
SHA1 6ca3e656252b4ef10dc6bce7f2167e2aed346339
SHA512 12b7934cd5fcb07f04630f075ebac53ac65780609f16a118002fb7ed0fc19e3daf90785cc86a307db5157d3cb3de8316451dd827410f4f7c75d116eb2ce06db3
TLSH
T16051B1F7C3E8867D890156F4AB146E1BCE1D0955432C3D5AC8E4AE1B93E28B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7c85b05b6b72a9108ebb50113883043694c5832b9599eba2670a19851fc620c8
MD5 5f0c668c63b51fc21b8789a7ad14e4d6
SHA1 2175b8f43661a26f568f8785ba2c292fdef9838f
SHA512 14ac72198ff5d34c5d9673de637d81f2c9210bdc3aa5875d4bb95a96bf555fa1d568d434f827f08ce1be914b699f5ad2f40059213ff3b4038772240b2d33e8c8
SSDEEP 192:sxRfRmbx/fes/HRgBzoA8p4p/g6+WNIYEbaG5IgDmJ:sxRf+x/fes/Lg/5IHW
TLSH
T1AE42C815AE28AD7B8CDBD21DBB557F53D2F9503260D01E48BAFC8A1C14E76DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 46e1b6a8dce094e7337aeb8799611cfb716936dc3570fb20f72ad571fe5c45d8
MD5 0fc0533735f082c4837a81ac218e8959
SHA1 962427916feb3a6ef70c7f95c9e9eba0af17a3c9
SHA512 626b50c1a0df3b5584d5f87e91a150e09eb49ef97fe9a5316765ad687ecbc348be497d45e9ed7bfc2b0f29b6db2d8f3a8744d89ad0e98645333f8db0a5f1fc79
SSDEEP 192:sxRkRmbx/fesKHRgBzoA8p4p/g6+WNIYEIaG5IgIJ:sxRk+x/fesKLg/5IQs
TLSH
T12F32B715AE28A97B8CDBD21DBB657F53D6F91032A1901E48F6FC8A1C14E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 aabab2d4ef920fdf6636349245ec39cbd790526def823c3b29074b79dc1dc43b
MD5 6e1b57433306c64c1ce1e47fa6557ad3
SHA1 7e43a355a6c548c2b88ab536924bb2a92c14043a
SHA512 ef93366dde9a154ac5cd9cbefea9899a596bcf96837b73183bbbd73601e696a797ad0a665b22fec16e4062f3bfe42c59e2bd87ad854a3eea6304cf778a36ae4b
SSDEEP 192:sxRfRmbx/fes5HRgBzoA8p4p/g6+WNIYEIaG5IgD0J:sxRf+x/fes5Lg/5IQs
TLSH
T12E32C715AE28AD7B8CDBD21DBB557F53D6F91032A0D01E48B6FC8A1C04E76DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 6c04d862506309f30ed1ac24ddb23ccd636382df4805ef0aaf2055357c1eb51a
MD5 fd7e22b630484f32f038914ff7ba9767
SHA1 306c63eafbf265b91c584ff499b9f105d9a5c9c0
SHA512 1fcb55032fffa621af147ba0edc6ec61bcf338745f979ca65803e72ca610d7311192822b2f45ae0cf7297c6f707316a47c1fccc89ac7b5f3fb1d34dff07d9cb1
SSDEEP 384:USupCD0fCtg82FfrLKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVQc9hnRXvroJee:U/pCDmWg8KfrL8F1+UoAYDCx9Tuqh0Vf
TLSH
T171B2DA2B640CCB7F4FC04A9EAC196FD77D9802C79A588D4047FE995C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a9dfb1104d227e9815349dfd23cafe83cbe0c45c14aff090c145c03fd6fdb718
MD5 63ba50dea0f2f1115f4957f5cc6266c2
SHA1 c238ec7168fda03350779678341eed400caf1e98
SHA512 4d8dc9b748b94b6ffdc44768f3477604f27771d9f93e80ddc96fd09c17a05e48291108c5faa2d85228127773f3b88b95408b8f38053c9d3183626c16d6abde49
SSDEEP 96:KYLSKYQaaZ8lJXLPkfLSPFhkKNBFvkRpJyXjFqKeUN8:8J/+68
TLSH
T19891450031BB5644387E764882B4972F524272737259EA3BBFBC51A24F2BE151DFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 373fc13b6bbc231cc06c08292ffbf105ae40315c05f92fffb145a976a2600e06
MD5 2e30a3b9bf1dfc16aa78d49ca4a17872
SHA1 4113c88f2a9a29872158d605593c24c9ea7e2e25
SHA512 aa9d2a92bbdcc0597d215a5765eb9c76fd3371103357c36fbe37a5eebba7be1d4b2de560056956bff475e5d7cfc42ed26c183d956da8d001fbbcd82c6d3e1346
SSDEEP 768:6j37r8MAc7fZrKTHyHZp5XSwQs88uBkiT252sRQm:6j300trKSnILNBU2sRQm
TLSH
T1EFF2AF35F8A48CB76CF693817A8A33066FF05147D4C80658C4EE661E029B76E678F867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 19cfa209efd861330f3203bea79432e45f322f6cd5ddcdeb7cfdea69b2b57857
MD5 7fd96394718c70c36164a1c015b3d1f8
SHA1 a905e186cc34e9eb6f737862f71ccc4ebe4d9847
SHA512 30c98e4c14d85809ba8a36f513250cfc3ecc76edd01a9f6a1f6d601a8fd61a0fb116b170deb7fa952558314475128f7523cc207baf531a1d6b78fed3edbecd2c
SSDEEP 768:Lj3gr8AAc7fZrKTHyHZp5XSwQs88uBkiT252sRQm:Lj3nQtrKSnILNBU2sRQm
TLSH
T12CF2BF35F8A48CB76CF693817A4B33066FF05147D4C80658C4EEA61E029B76E678F867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 80d10cf30f6f9e026bea6765bb04085ee7a90db505e9df0c3901052cde89b07d
MD5 f0fc5de276609609c78ac585a3ea98e2
SHA1 b46940b762cc333ea02313acbf47ef284d2191ee
SHA512 c2d0079170c53958a13f92baf152c1f2fb4dc1f73b0ce268550cf57835777f6952d242e8158365c70c93caa11ed53d0333e0e34c821c6b7fbf9fd0bb9bc79894
SSDEEP 768:R/UxvxjgC+W3jyxc7fZrKTHhp5XSwQs88uBkiTCs/P84g:kZj3+W3jvtrKvILNB1Hg
TLSH
T17303D039F8945873ACB39385375A275BAFF05053C4C41B9889EE7A0E02CB75D670B897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 7f9f0899eb6f3132878e1f47ac53665e87e34b9fe81080f787d533e1e63b23b6
MD5 7dc31a50e42a0aeba8d5145335bee0a1
SHA1 34b2c11312645c5191305f3ac7b875d3fa4a1c21
SHA512 98fec6c6092ecb6f70c1126e406df8151f3342eb52d4cc349a650d3fbfd7745ab05629f9a7c09f4292bc91a173819fec0eff034773ba384f5b108c9defbe62a3
SSDEEP 768:mFQm35wgCr8AAc7fZrKTHyHG5p5XSwQs88uBkiT252sRQm:tm3VQtrKSmnILNBU2sRQm
TLSH
T1FBF2BF36ECD4C9BBBCB68781BA4A3302AFF05147C4C85694D6DEA50D029B69D138FC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c41522e9-7202-446b-8d43-8a71a81676ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c41522e9-7202-446b-8d43-8a71a81676ea.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download