bbc24cf0260b7c1dd0f7091fc4044dba4791902414003ee699f0ba031a6d5635

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
anhcuoi/application/cache/index.html
Size 142B
Sample261001-pg6pdssgjf
SHA256 bbc24cf0260b7c1dd0f7091fc4044dba4791902414003ee699f0ba031a6d5635
MD5 d92311600f6632e0f98c0e5777acf431
SHA1 e799bd5ab234730a641b034fb62d5f7ca0461c50
SHA512 0f6c1d055daf7e1ddc565fd70c9a98f38fc3ee874141494cb2c4f3ed41f43b2d4304167592ae7e41ac95af257b92e2074f5ac82a8f4286624878ed402e1bd09f
TLSH
T1D3C08C66220C2C0C52F233B01AC02260219323C002032B255B8451233A1111DCDC218D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3052	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{9874DE0C-03DA-4542-BA21-9C6A3207748A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5464	msedge.exe
5464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 4164	1884	msedge.exe	89
PID 1884 wrote to memory of 3052	1884	msedge.exe	90
PID 1884 wrote to memory of 4844	1884	msedge.exe	91
PID 1884 wrote to memory of 4844	1884	msedge.exe	91
PID 1884 wrote to memory of 3096	1884	msedge.exe	93
PID 1884 wrote to memory of 3096	1884	msedge.exe	93
PID 1884 wrote to memory of 3096	1884	msedge.exe	93
PID 1884 wrote to memory of 2872	1884	msedge.exe	94
PID 1884 wrote to memory of 2872	1884	msedge.exe	94
PID 1884 wrote to memory of 2872	1884	msedge.exe	94
PID 1884 wrote to memory of 5904	1884	msedge.exe	95
PID 1884 wrote to memory of 5904	1884	msedge.exe	95
PID 1884 wrote to memory of 5904	1884	msedge.exe	95
PID 1884 wrote to memory of 1552	1884	msedge.exe	96
PID 1884 wrote to memory of 1552	1884	msedge.exe	96
PID 1884 wrote to memory of 1552	1884	msedge.exe	96
PID 1884 wrote to memory of 2752	1884	msedge.exe	97
PID 1884 wrote to memory of 2752	1884	msedge.exe	97
PID 1884 wrote to memory of 2752	1884	msedge.exe	97
PID 1884 wrote to memory of 2704	1884	msedge.exe	99
PID 1884 wrote to memory of 2700	1884	msedge.exe	100
PID 1884 wrote to memory of 2704	1884	msedge.exe	99
PID 1884 wrote to memory of 2700	1884	msedge.exe	100
PID 1884 wrote to memory of 1028	1884	msedge.exe	102
PID 1884 wrote to memory of 2268	1884	msedge.exe	106
PID 1884 wrote to memory of 5040	1884	msedge.exe	107
PID 1884 wrote to memory of 2372	1884	msedge.exe	108
PID 1884 wrote to memory of 4736	1884	msedge.exe	109
PID 1884 wrote to memory of 4736	1884	msedge.exe	109
PID 1884 wrote to memory of 5464	1884	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\anhcuoi\application\cache\index.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x328,0x7ffd7d15c188,0x7ffd7d15c194,0x7ffd7d15c1a0
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,6572869965801816567,17941484455681976440,524288 --field-trial-handle=2164,i,13512429141376187980,15413985741044501205,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,12142382749314338194,12828166052172355081,524288 --field-trial-handle=2164,i,13512429141376187980,15413985741044501205,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:13
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,17014352227697692831,7344363507070988713,262144 --field-trial-handle=2164,i,13512429141376187980,15413985741044501205,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,13252109339152366665,18271886117116494358,2097152 --field-trial-handle=2164,i,13512429141376187980,15413985741044501205,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,66425680706831463,12928319298150019408,2097152 --field-trial-handle=2164,i,13512429141376187980,15413985741044501205,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,10770905809374323697,1406864542362573254,2097152 --field-trial-handle=2164,i,13512429141376187980,15413985741044501205,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,5760415941378009334,12535607263909075626,2097152 --field-trial-handle=2164,i,13512429141376187980,15413985741044501205,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,7025525297238630390,15958811198655899645,524288 --field-trial-handle=2164,i,13512429141376187980,15413985741044501205,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,3629745126600144435,5639542354813560956,524288 --field-trial-handle=2164,i,13512429141376187980,15413985741044501205,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,16981057047736370246,12559000593241023103,524288 --field-trial-handle=2164,i,13512429141376187980,15413985741044501205,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,16981057047736370246,12559000593241023103,524288 --field-trial-handle=2164,i,13512429141376187980,15413985741044501205,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,15014060164821974585,10399899068585787745,524288 --field-trial-handle=2164,i,13512429141376187980,15413985741044501205,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,4140837802155656521,4285899719930590442,524288 --field-trial-handle=2164,i,13512429141376187980,15413985741044501205,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,8469463296068756979,8821236446197895934,524288 --field-trial-handle=2164,i,13512429141376187980,15413985741044501205,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,11782225512672106605,3391466825834873050,524288 --field-trial-handle=2164,i,13512429141376187980,15413985741044501205,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6448,i,1854928168899376378,17818843462534276157,262144 --field-trial-handle=2164,i,13512429141376187980,15413985741044501205,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 25559293c954898f2da344ed5fe3faf3c076ca2a1868befb99178bedacb3d026
MD5 7921e958d547711c39f2211be9d582e9
SHA1 d327f17351a129da59733ef73c24b256addb1b88
SHA512 29c83b34cc319b93140a7156f0e4fd32fca94b626b32f9aa46eb5471603b5bab4338ee0313db91199b04ee0ff93fc3dd5d552299e129f6c1cd750f4211244525
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T117B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 34890ea55a70bac33150a689e6d9a51b93dab899d0a10b331786ad79ab489ee7
MD5 b114e940c83d1dfd5696a7927f3aeb97
SHA1 5d1198845883affbb0d861e594ca8d663ea5260c
SHA512 dac0d892e49ce8eb5b658a254910667c08b9ab9a2c32a180c54d9898694520808bb79a8c2c1d0eddc79094981eac2a55a40887a339ccacd172f20a1796c79678
TLSH
T18061A602D357C799FB9E40F49AD08DA7B6304AA1689F3E73DE68D0F86C0E3782136244
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59efd5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59efd5.TMP
Size 3KB
SHA256 b895c2182aff37d6279c817087b5c4ca299e34f21e18111f379a5221718c95c4
MD5 1cf7e5bbe14aadb83f871c14890cb984
SHA1 83ae3ab7a78e11b301b855d455057caa6f051913
SHA512 831320c79096275d4d0b9509ee0f363f47e4ecfb01dadf913a2ca74a33c10b0ecb3fb028ceb29b81337a56c1f5cfd17e381d45fb8ea288d8d3b4358c4cd67bdf
TLSH
T1C561A602D357C799FB9E40F09AD08DA7B6304AA1689F3E73DE68D0F86C0E3792176244
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c21e039c6a18fcecd3e1b4682edde6b373ffdd42f18cdf01b98a401b356f940e
MD5 becde942e32adcd8b8c1a119bf34d242
SHA1 618aa20a28c1628bc9d05cc545e68ee09a002052
SHA512 e77cba3b6585c1a92c548983b2b2bcfdc1ffc77a8981ddfa9e5580824203ece60f201a71792ec6c80e50b830df4cb62a37ff1a8b433eb6f172fb12bbb3fea26d
TLSH
T1A541AEF3C3E4966E890156F0AB14AE1BCE1D0915832C3C5AC9E4EE5B93F34B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 550c1678aee4092a59946a81a2dc143b7a0e67b084c7a40316e727bfc7bb6675
MD5 c10d3694549861062e5a7ad62de2e469
SHA1 35d7c74cd0b13c140cd7780d5cf0502bc7cfe52a
SHA512 f44adedded6f50021d0d00ff82714f5b6f50d46d7b45e68f2a0ff8a3396aca48b0174f77e55fd84153af10c7d89ca0c4ebb182ed188f211d9e6b2a02d5c0e98b
SSDEEP 192:sxRrRLbY/fJswxzoA8p4C/g6+WNIYojyGFYIgIJ:sxRr1Y/fJswsj/5IL0s
TLSH
T10D32A415AE68A97B8CCBD21DFB65BF53D2F95032A0D51E48E6FC861C04EA6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ec14c0e60993df9fe2103d0d8d274277168c4eafad758f9795df9819cc640e3a
MD5 97a439666e6d629d96fe5bdde31ab209
SHA1 86766a7c365c0022d9bfc28754958ca7e8032e9a
SHA512 b56150677b106e990c5ec5cd57bcdef0882826aae1d779e8570e49f6085d88a2f12af2a12af2e485df9fa2231e90c0713cc73dc9202a9c7503c151ac89fcc122
SSDEEP 192:sxRoRLbY/fJskxzoA8p4C/g6+WNIYojyGFYIgD+J:sxRo1Y/fJsksj/5IL0m
TLSH
T1FC32B515AE68A97B8CCBD21DFB65BF53D2F85032A0D51E48A6FC861C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 22c0dbb77ce63e61f9c991b4b3e9c6c28115bc33b01c1c02010cb1d94540f19b
MD5 8f5b3bb7265cd0fd377e3efefbaf9d5b
SHA1 47c6f5ba46802fa5f443887b9ba1757feffaf85c
SHA512 1255320835cb71b84a84cd28a3ade052405c2beb7e67dd62065536aea0da7ede07fd26b335aa62f4c336cf0187c42bb4ec639c1ccaa716208c33fd95660d73b4
SSDEEP 192:sxRoRLbY/fJsuxzoA8p4C/g6+WNIYoFUyGFYIgDEJ:sxRo1Y/fJsusj/5IC00
TLSH
T12C32A615AE28A97B8CDBD21DFB657F53E2F85032A0D51E48A6FC861C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 2bb21467210d7c6ed8699d9b8be696279d632949d9ba09b2e1354d1dec3d992e
MD5 6d210e6d6d0512fd98964adefc32fce0
SHA1 76375ee564c767f430fabd539b940a44856f5a04
SHA512 0f09a309a3230769b2cf7a0c843e5e38b8e85adc647c6851d05400fbae9f831a6739aa5aef5d649c1199b6c1b29543cfc36c562f6402387dd075f2094e90abb1
SSDEEP 384:pFZwWWPfCtg/NFf1pKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVt5931RUqrondR:p/wWWnWg/Xf1p8F1+UoAYDCx9Tuqh0VF
TLSH
T1A9B2D92B704DCB7F4FC04A9D9C196FDB6D9802C796588D8047FAD84C02C77EA922A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b390ba4a29ae6c762aae057dc30bf9c258a8bab0b7930fd9c73de6550330968e
MD5 cbc9a4b3056094e85a4651aa62f5c351
SHA1 4d97f4ef6bfe0b01d8cdd86e93acf66e2f5b8986
SHA512 fb624a2a709a35806839af3772084665d0f409b13a21e95a2ead4c5b6c9694190a678c8f1502640629594befa0613caaf6aadefcc37012690850bcbf150c5015
SSDEEP 48:K0KI/KL6ErypAIvKxW8IZaZDZeZqZwZcZ4ZkoZcZpZPIpZSZkKWZB+ZYZkiZKZ0E:K0KAKL6aKAIKxW+rqKccWFGjiWkoP
TLSH
T154918121703B038139BE2B5954B5969A465132E3317CF96A37E901624EAFE046DFE8FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

aecc31f8-94b0-4f6a-be01-a23202f23378.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\aecc31f8-94b0-4f6a-be01-a23202f23378.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 761a88a79ebbf669d2b9c2afaa6a5054294cf42af4fa99b95e16f8f2e78c7383
MD5 c8e73b4bf8bd741074df2ff1e30392fb
SHA1 b3fcd8c6db714aeac6bf55d3292f57650aa819e7
SHA512 70e1d3e518736dd0b0c5b3760c0a85b3c80e19d635be8a75a56d71ab344bc7d75fb300beb5832be57a66fb4dc2642ba5df4e4f9efd336790da9ae870ca57741f
SSDEEP 768:mS38ITO9Ew/9OA9at01j0iq00+Iain4YGHbi7:mS388CHq00NaU4YUbi7
TLSH
T153F2BE71ECB09E73ACF6A685B60267865FF05513C3CD5A8085DE2A0E004BAAA1707C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 29998bcf28cf6242d30561550e33992917058d58cb4acfe40840ee86fbeb3549
MD5 e91ab50551389eb8e74d758cade0d561
SHA1 fe8cca184bcec3ccf6d548a4fac780fadc6bc828
SHA512 5065d898f0824e0a2e68fc4d2cbc39251a4e28c65f46f26f9bcfe24a9db17da18ea3f3156b889caf4d66246fbb8abb5ea0b3e2713a3cb85a996970a3920ce9d5
SSDEEP 768:cFQE3ewgoRTO9Eh/9OA9at01j0iq00+Iain4YGHbi7:PE3RCCHq00NaU4YUbi7
TLSH
T139F2AE72ECA0CA77ACF7ABC5B60667469FF01153C6CDAA8086DD690E00476ED170BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 4b92cf7bdebf42b38b2eba44cad3aeb43b03fdf455d285f161b55e519eb6c9ea
MD5 567729fd94c778637394ff3e10f2e25a
SHA1 f5a0b3d2a889cad15c1514ad8c948f6f53b7673d
SHA512 98d1f1a47d6f69529955aff067585d42128005bd3980339e6a1ecb656f5c57991a4f6322493b9ee39558bef265b6ecc7bed05ada6fbd8793962135b068872108
SSDEEP 768:X/UxvxjgC+H3A+vO9L/9OA9at01j0iq00+Ia2jSHxRz:KZj3+H3AOCHq00NasSTz
TLSH
T15C03CF31FCA19D739CF7B384770A63879FF44663C6C96A9049ED2A0D01876AD13078A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 3a6313d0f11ab1d06a33ffe61ea1463bb9adcd0b838bb516f5acc876414028dc
MD5 a1d1a8eba77f1318a615fd21f3680c83
SHA1 5663f7a0d88c14832bec5bc21a6ce113c5c66848
SHA512 7525a1ebac4f12f44964d1995b74cd920c2d924acb1efa1909adfbdd840c13843f5b64c8fa6b8d90d44492768115b56eeff104cb92777a4111d11ccc585b4411
SSDEEP 768:nS3PRTO9Ew/9OA9at01j0iq00+Iain4YGHbi7:nS3PtCHq00NaU4YUbi7
TLSH
T159F2BF71ECB09E73ACF7A685B60267865FF45513C3CD5A8085ED6A0E004BAAA1707C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2f091f8-6aef-44cd-8133-e42382751715.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c2f091f8-6aef-44cd-8133-e42382751715.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download