b26c45488707b8e2126d512e38d8345360cd37b5e48fb9c9e1756c9fe0bd7275

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
amp/assets/fonts/BebasNeue.woff2.html
Size 566B
Sample261001-pg6dmasgja
SHA256 b26c45488707b8e2126d512e38d8345360cd37b5e48fb9c9e1756c9fe0bd7275
MD5 2dd20be7b1fc722a2e865ceb42fb816f
SHA1 5bd41ebae7f32a1abfa9e92bb1dc87d96f4f026d
SHA512 3cc03e53960c5486bf64689d544036094364f1b43a8635d861c9248517fd1d14b959495d27d850cecbf86a5cede5838372ca162efe6314b929de1b78ef0a5689
TLSH
T123F0CD9F1F12387F2E238170F0C35069CF680A56FB9921E28748001F3ACA04549F6FAD
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4548	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{71956561-F937-4ED8-95CE-29ABF3460D31}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5772 wrote to memory of 4128	5772	msedge.exe	90
PID 5772 wrote to memory of 2996	5772	msedge.exe	91
PID 5772 wrote to memory of 4548	5772	msedge.exe	93
PID 5772 wrote to memory of 2996	5772	msedge.exe	91
PID 5772 wrote to memory of 2996	5772	msedge.exe	91
PID 5772 wrote to memory of 4408	5772	msedge.exe	94
PID 5772 wrote to memory of 4408	5772	msedge.exe	94
PID 5772 wrote to memory of 5032	5772	msedge.exe	95
PID 5772 wrote to memory of 5032	5772	msedge.exe	95
PID 5772 wrote to memory of 5032	5772	msedge.exe	95
PID 5772 wrote to memory of 5324	5772	msedge.exe	96
PID 5772 wrote to memory of 5324	5772	msedge.exe	96
PID 5772 wrote to memory of 5324	5772	msedge.exe	96
PID 5772 wrote to memory of 300	5772	msedge.exe	97
PID 5772 wrote to memory of 300	5772	msedge.exe	97
PID 5772 wrote to memory of 300	5772	msedge.exe	97
PID 5772 wrote to memory of 5856	5772	msedge.exe	98
PID 5772 wrote to memory of 5856	5772	msedge.exe	98
PID 5772 wrote to memory of 5856	5772	msedge.exe	98
PID 5772 wrote to memory of 1756	5772	msedge.exe	100
PID 5772 wrote to memory of 1756	5772	msedge.exe	100
PID 5772 wrote to memory of 5408	5772	msedge.exe	101
PID 5772 wrote to memory of 5408	5772	msedge.exe	101
PID 5772 wrote to memory of 3408	5772	msedge.exe	103
PID 5772 wrote to memory of 3012	5772	msedge.exe	107
PID 5772 wrote to memory of 5840	5772	msedge.exe	108
PID 5772 wrote to memory of 3380	5772	msedge.exe	109
PID 5772 wrote to memory of 1324	5772	msedge.exe	110
PID 5772 wrote to memory of 1324	5772	msedge.exe	110
PID 5772 wrote to memory of 2428	5772	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\amp\assets\fonts\BebasNeue.woff2.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x240,0x2d8,0x7ffa9863c188,0x7ffa9863c194,0x7ffa9863c1a0
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,10704294382424945731,10237085952240115758,262144 --field-trial-handle=2444,i,17579241746900262332,1329707719666007308,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:2
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,7422598594649423012,10108394952742398940,524288 --field-trial-handle=2444,i,17579241746900262332,1329707719666007308,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,9364993284863617436,15793846138458441073,524288 --field-trial-handle=2444,i,17579241746900262332,1329707719666007308,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:13
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3272,i,18216301799685224411,4370072945454160301,2097152 --field-trial-handle=2444,i,17579241746900262332,1329707719666007308,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3280,i,4849145699796621241,7287655987086947021,2097152 --field-trial-handle=2444,i,17579241746900262332,1329707719666007308,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4104,i,7126696400738064584,1902170202895669000,2097152 --field-trial-handle=2444,i,17579241746900262332,1329707719666007308,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4116,i,405329736313859349,18297157124015569119,2097152 --field-trial-handle=2444,i,17579241746900262332,1329707719666007308,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:9
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,2698771051008160674,13541887929981858537,524288 --field-trial-handle=2444,i,17579241746900262332,1329707719666007308,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,733293822321217277,14493680337054562987,524288 --field-trial-handle=2444,i,17579241746900262332,1329707719666007308,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,8012459073278099014,17230693487979704160,524288 --field-trial-handle=2444,i,17579241746900262332,1329707719666007308,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,8012459073278099014,17230693487979704160,524288 --field-trial-handle=2444,i,17579241746900262332,1329707719666007308,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,4789339655078437383,8599029610497533532,524288 --field-trial-handle=2444,i,17579241746900262332,1329707719666007308,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:14
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,1078778162929406835,4550936966797227592,524288 --field-trial-handle=2444,i,17579241746900262332,1329707719666007308,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,9762733740120773751,12665284569496682913,524288 --field-trial-handle=2444,i,17579241746900262332,1329707719666007308,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,14765863016772654670,13343676648855665257,524288 --field-trial-handle=2444,i,17579241746900262332,1329707719666007308,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6496,i,4507525464454731954,17562163037625920331,262144 --field-trial-handle=2444,i,17579241746900262332,1329707719666007308,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f52b68f24cd37d270170717bbfde29b054d089f36e1b161da4ff3a5ac7a2061
MD5 19834bf6d5fe4c121bc504c5ee4bdf2f
SHA1 20655dae478ff010c6e609a00c16d0b70598b9f2
SHA512 ec26c9754c29d5fcc692ab846efa54c8339d2307eaec6c492f8448f697e5ba9f7e92237d48c04992f526dfc8d0a2d2f4dd34155c477eae14798d5e287882e0c2
TLSH
T156D02B08799C9374D109203A4129021636CCD000FC03D001C4E2334508C335100490B4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9843a30e8aa41784e8b4191f14aeb6021533cce5d67a22cca824f407055fd39
MD5 621af5a580df292a964e87f2cc0e0159
SHA1 89f89986802e8a488158c3a72ba889e40942cd3f
SHA512 f3418c67e8f516807016e9b06517f105039744619839d4ed37a345d4cfcca6b12400c305bcebd3d826a1722ba42e2aa9eb545b23f91abf220595e8b8eb3f9ddd
TLSH
T19BD02B0479AC9374D109203E412A021636CCD000FC03D001C4E2735508C335100480B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9a44471058c6a8f9fb21b432825812801c315b2bfba83409487a3173e6083b8f
MD5 dd6c9f60082c017fa0bdde8a0a74b72a
SHA1 d28a913e51042e9f58a0fef34c956885510f3262
SHA512 37108eab276bdf1c27b7b0f74ca137eb456e322df790cb4c34a42e81ac81251f89a9edb7ab10381b3f0e4ccd1c96636c8b63bc46e21f9a0a9ffb3bfef78ba1c3
TLSH
T1BF6156579A335B8AF368307265FC2E4B3D36C68CCAF30E509B56C4FA29A9350E250458
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5988ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5988ce.TMP
Size 3KB
SHA256 f51a29e670ca546d6bdae75be4039234cd50766d232dc8353b858fad0125ef65
MD5 61e9c48be9c6cebbc0d9bc3f5abd3df8
SHA1 9d616cb97d6fd5ef7af265cd6f23472598857851
SHA512 e9ef436408ef32bafd9c50aa1cf830c48c054ed6be39ac23817073d80a1d51ca9a9d8045585af0827c2ca1e495d63ba571b4354beb853ef7e5ff63b3a3b752c8
TLSH
T1396157575A335B8AF378307265FC2E4B3D32C68CCAF30E509B16C4FA29A9350E254448
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 baad9b5c6bfe3baa320a6a28205f457f5424aa9d49edfb905d47d6b23d60f004
MD5 771e5c952d910bb553dad8105cfb66c7
SHA1 16f1168694d2ee6b44010be4509c7358ef8fa25f
SHA512 0a4379dd65143e2c68794423a2d7f12751d87f840b474f38d0f0b1d0ebb743e4f455238148df7bf573835cede238786141cbe5f5542f4305b774cbe0a76b087d
TLSH
T101419DF3C3E8967D890156F4BB186E1BCE2D0915832C3C5AC4E4AE2F93E24B1E14099F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6503441a0667a8f6825ab489e18b4f2354ff6b670d4577cec9c1163911bd73f3
MD5 03b38df5f2c91a6fd341987e20a330de
SHA1 6b65f52a6b6468344182a56bea047556a712519b
SHA512 ce428ac75c312ca5540ab160e91fd71ec1fa8db24a51c58c4ca3bcd0b9044eedf3d4b8ca4a176d52096e6110e632340d09aa50633b87d5d9ae0837e6592a1492
SSDEEP 192:sxRrREbC/fZs3qmBtzoA8p4m/g6+WNIYdfpGL5IgDN+LJ:sxRrMC/fZs3HBgz/5Ixhk
TLSH
T15632C915AD28A97B8CCBE20DBB597F53E2F9503261D51F08BAFC8A1C04E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d9fe7fdec03965cb90e4b3878a663cedec54998625be5e67c5209b5d87cb1a8b
MD5 b3c0c064d57c98b936e418312a3bacc5
SHA1 4048ec70c35c9d3e3bd8a5f74e2b5ebb8ff18ef6
SHA512 ce6bfc7e3641c97c55a1bf064a166f1af3abcd51694b076252f6b2a56034c977df056ff2fc142a5d3512a5de1320ba3bcb32997ea194ebed23bf0dff0913989c
SSDEEP 192:sxRgREbC/fZsQqmBtzoA8p4m/g6+WNIYdqpGL5IgIJ:sxRgMC/fZsQHBgz/5Igs
TLSH
T10432B815AD28A93B8CCBE20DBB697F53D2F9503261D55E48FAFC8A1C04EA6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1a3f4dc8b1ac2bace47bcd18ac20ff12d155fd90f9ba27805dbacdc8a4e9ae25
MD5 9d629b72ba6818048e0670b1324efbac
SHA1 2c8c098bba5b46c495039c3e0815543f21d39e90
SHA512 1095b8b8c2c57175ddd295985b25467f7853fd8bbc4aadfcdda0a3a709a4401174c8ee64d553a73ee66fe393c5e2f3a7959cb2cc3a11d7f7ef4efc032951e852
SSDEEP 192:sxRrREbC/fZsaqmBtzoA8p4m/g6+WNIYdqpGL5IgDN+FJ:sxRrMC/fZsaHBgz/5IghW
TLSH
T10632C815AD28A97B8CCBD20DBB697F53D2F9503261955E08BAFC8A1C04EA6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 1cfc1e4abad3f00554d03bf186b473c4d96a8ce8ccb42d3adb5ff2e7d27a5578
MD5 937e5abf6b3215f58e52824ddc1af375
SHA1 bce7ca1b222ba888f10d69b9e24f0512ece92306
SHA512 522d79069a93a89c95306e72d68972a5b7edf9221b4138677e4c9428657ce4c77f3d8b005a058526e3c3acd269d8281cc2e6c5ba889be5777ed6c2832d1f06cf
SSDEEP 384:qYe+z1ifCtgUGFf8SKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV269GGRL3roKrP:qF+z1oWgU6f8S8F1+UoAYDCx9Tuqh0Vm
TLSH
T1DCB2FA2B604CCB7E4FC01A9D9C196FDB6D9802CB96588D4047FED84C03C77EAA21A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dfb77fa0add756815a02fbfc72e103cd333952cc6de571a7862b7e34cb384679
MD5 1056148c830897e1e5d268a11f9a0cb0
SHA1 0ace29ac48525027ec9c37c8992ece0e0510b85d
SHA512 16225adf0130736567a504eb75a46cdc0bfdb4c46ab4edcfb85100a4e5c098ced340749a1ca6be724325b20139dfc9ee1b3da1a7dd3d14cf9178bce5f826c705
SSDEEP 24:KtPs7c/IzKzhS1aSyJbyXvwTAkCIhKwhk1SSlO5ncj8vIzKDhS16SCZAyX12pq:K8IIzKVSsLytFIhKmk86QIzKlSsoyZ
TLSH
T1BB91784272760684793D390C41B9ABAB464276E73025EE2F3FAC4191DE2EE145DFC4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

47dfebb1-0bc1-4dc7-b627-675a299cb0f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\47dfebb1-0bc1-4dc7-b627-675a299cb0f5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b069b7306c3b741229052ec7892012f39bd550c25e27393d5ff1bef6749e3bff
MD5 e9d0bdc5a1bb0583a3bcfc569ef3e9b3
SHA1 703062606edf1dc4661a17735dd82aed6c240973
SHA512 21e1421867e463d6ba17c2e16f3c99078dae1f6df30446d35b72940c8a7014d5744d2e589650923a6be5ccc5fe08f284a9ac33dfa5d63acb94fafe29bda82f3f
SSDEEP 768:0Z/UxvxjgC+C3jkK3OjwtSsk1h3Yogkl5akl8pbHW0AWDgPT:0MZj3+C3C1h3Yog05akl4bHW0A1PT
TLSH
T1AD03BF36AC69AE778DE6E284721A6347FFF4986356C44AD845DC9F0D06872AD030BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 dd4c87c3e3dc53017e181a1b4cfc8ee0dba53ed0a8137243dbcb75d2e7c0cad5
MD5 0729461f4ef3f35ef355cfd60d847c2e
SHA1 2e132d07114c4493fa502725bb368da633c06d78
SHA512 a768e831a6c21743cbaa7fed8d015e62b39e361038d6f2a2f73f474d16445e9978c9d7fe9ed3a9bbe7d4472a5e4fefed955448419ce4ea77591253e9f891bb4f
SSDEEP 768:0Fr3gkK3OjwtSsk1h3Yogkl5akl8pbHW0AWDg3DrgvPJX:0Fr3J1h3Yog05akl4bHW0A1zrgpX
TLSH
T157F2AE35AC68AEB38DE6D285711A6603BFF8D52797C85A8485CDAF0D015B6EE030BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6b900933b99d38eecad03f414fa1959926b5c60f04037c7a69684cb0370d842c
MD5 0dd67384007a27e2c2e7ae596e8c3231
SHA1 2bb88cc38dd2174276fdabf370c9fc15f7d955cc
SHA512 6c62ff52a831a33e41366183fcd4b2ed74ed407f96a56b2f1e46b190b702c52606ae60ae576a46c1c85ea47326be83d7866f66859665618035418ecaaaf16727
SSDEEP 768:ZFr3tkK3OjwtSsk1h3Yogkl5akl8pbHW0AWDg3DrgvPJX:ZFr381h3Yog05akl4bHW0A1zrgpX
TLSH
T14FF2AF35AC64AEB38DE6D285711A7603BFF8D42797C85A8485CDAF0D015B6EE030BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 bb938f27398cef1398b5d3fe4878c7bc9d49b52a50341ddcb396b895549ef943
MD5 43c9663f02b259ebaf7a3ff57c5a5afc
SHA1 3609f608e06d8de9a82c4b1f10dc939d5895bdd5
SHA512 d0c89f5d105524e8bfa515a6ae941a69f1eb402fb5846794617017034989702cf4d115a5dc0a0dfdf202c6442451b724c3926e78f3da7d0052accfc7da0a411c
SSDEEP 768:CxFQ23Wwg0kK3OjwtSsi1h3Yogkl5akl8pbHW0AWDg3DrgvPJX:CA23A1h3Yog05akl4bHW0A1zrgpX
TLSH
T1C103AF329C68DAB79DEAD7C5B61A7202BFF490678AC49AC496CCAE0D01575ED030BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 f94210d7c7522d053416a36f3d2a18aa57d0e9cb6094f23ef734d5e63c0846ec
MD5 a405ec532959a2b8cd3d5e37b56025eb
SHA1 c07a64c5116e9941b77eb5b03c0d41bcd3c55941
SHA512 59f7eea175a3860df9dcbbfa80b88a4a8fcb718eb72d12e597d395348aa4c85201121f663712aed851d3f6aad58a6ebca0f90cf4e0382a22194171d4286d15e5
SSDEEP 768:B/UxvxjgC+CZ3UIoK3OjwtS91h3Yogkl5akl8pbHW0AWTFSHvP0Vv:UZj3+I3C1h3Yog05akl4bHW0AcSCv
TLSH
T13D03C039EC65AE778DE6A284761AA317FFF494635AC45A9445DCAF0D028B3BC030BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce664b97-ceb9-4db7-b2d9-f357976c5a1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ce664b97-ceb9-4db7-b2d9-f357976c5a1b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download