hxxp://fimis[.]gr | Triage™

Analysis

user interaction
yes
max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://fimis.gr
Sample260628-kfbemsf19t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4940	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271091441845763"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{C495EB22-97D0-4C11-8AF8-25F7DE741ED3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 5036	4828	msedge.exe	86
PID 4828 wrote to memory of 4940	4828	msedge.exe	87
PID 4828 wrote to memory of 3976	4828	msedge.exe	88
PID 4828 wrote to memory of 3976	4828	msedge.exe	88
PID 4828 wrote to memory of 3976	4828	msedge.exe	88
PID 4828 wrote to memory of 4344	4828	msedge.exe	89
PID 4828 wrote to memory of 4344	4828	msedge.exe	89
PID 4828 wrote to memory of 3764	4828	msedge.exe	91
PID 4828 wrote to memory of 3764	4828	msedge.exe	91
PID 4828 wrote to memory of 3764	4828	msedge.exe	91
PID 4828 wrote to memory of 2360	4828	msedge.exe	92
PID 4828 wrote to memory of 2360	4828	msedge.exe	92
PID 4828 wrote to memory of 2360	4828	msedge.exe	92
PID 4828 wrote to memory of 4436	4828	msedge.exe	93
PID 4828 wrote to memory of 1508	4828	msedge.exe	94
PID 4828 wrote to memory of 4436	4828	msedge.exe	93
PID 4828 wrote to memory of 4436	4828	msedge.exe	93
PID 4828 wrote to memory of 1508	4828	msedge.exe	94
PID 4828 wrote to memory of 1508	4828	msedge.exe	94
PID 4828 wrote to memory of 2976	4828	msedge.exe	98
PID 4828 wrote to memory of 2976	4828	msedge.exe	98
PID 4828 wrote to memory of 2976	4828	msedge.exe	98
PID 4828 wrote to memory of 2856	4828	msedge.exe	99
PID 4828 wrote to memory of 2856	4828	msedge.exe	99
PID 4828 wrote to memory of 4740	4828	msedge.exe	100
PID 4828 wrote to memory of 4740	4828	msedge.exe	100
PID 4828 wrote to memory of 3908	4828	msedge.exe	102
PID 4828 wrote to memory of 4332	4828	msedge.exe	115
PID 4828 wrote to memory of 2796	4828	msedge.exe	116
PID 4828 wrote to memory of 1188	4828	msedge.exe	117
PID 4828 wrote to memory of 4440	4828	msedge.exe	118
PID 4828 wrote to memory of 4440	4828	msedge.exe	118
PID 4828 wrote to memory of 3532	4828	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://fimis.gr
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffd9b3ac188,0x7ffd9b3ac194,0x7ffd9b3ac1a0
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,9440372252268727931,8278636190802247164,524288 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,7568623875842333802,16474059397904060302,262144 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,17373679823739246184,10534289710115679916,524288 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,14213972454869418474,15818179056104169302,2097152 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,5430164329579526119,18304133390077591157,2097152 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,12090144631462096902,4707744659674163850,2097152 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,3436937926976915379,5777993151757532773,2097152 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5036,i,415252357541501313,14760210430509414339,2097152 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,7243394329374251937,7461110045942296340,524288 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,2778228970292627558,7965506497207382203,524288 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,9271001052421252705,10022593088053178064,524288 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,9271001052421252705,10022593088053178064,524288 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,1313878731460179704,12970037117885228976,524288 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,14672110411424003106,6334129489911383375,524288 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,15545193509511143971,6273653596579148594,524288 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,2602115212696394753,6032947744836610396,524288 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5364,i,290396780520497752,5517444847040962591,262144 --field-trial-handle=2252,i,7052055204511837631,7118000295597969799,262144 --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 073a153d4321b09c00294e6bf7abe752b6ea6eea2cdd291fd229962b6e9c5fae
MD5 3ea295a31989a514653534ce3a987a50
SHA1 a902488d9b85829131976722761c3d23637bfbca
SHA512 f979d3333c52968e3ac93a47ec421dfae2aa0ca57d85cc0cb99176c2a8df80d55454954d1c6f47a918af926b8b534b43c7dcf33e8596235b9f340cb9268d1076
TLSH
T1BC71823A101009B1F39042B353C249C5BCB1F7FBFA23FE05E1599DB91F05B41C519184
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7251747ae25fe27024818991db2399acc59d361783469074d51b86b1e2be3e83
MD5 42ee32cca1a3e842ec3e0f88cb7b1504
SHA1 2c1ef62ec79496827d0bc3c66926d73069641c40
SHA512 34db2168ee54716c2460666cb5413472becd396747b807e0fd9cffee62ae6a3317d9b98ac0efd5b263064e20572c7dd6755e91fcda9834a156a3eb95f8c6c7c0
TLSH
T1363168F7C7E5856EC91156F0AA286E2BCE1D0956432C3C1A89E4AF5BA3F2470E10194B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7bc6df6dcb0235712949fdafdb270929f67ed97a9c5ada87b0a6e402e173afb6
MD5 66626fb855043d659ec41d862175b03f
SHA1 9af1effb3cb24ac87b02fbd236965f9a0ae3d934
SHA512 98d444b10bb41e65b0606a84e035b34de34049f96bad2bd9b868c43801a2315ee3660cd22c2aa10260eecafbdda82a837c291f7eb3202c1abad0bfc52d0d9d13
SSDEEP 192:sxZORS1yM/jK1Ml8MkQ/f6sPFflIdpMJHW6+WNrqa/YzihyaIgrJ:sxZOcMQ/f6sPFOEHbP/r9
TLSH
T1D152E9127A34697BCCCBD209FA55BB53D6F54562E2900E44AAFCDA0C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d3fdf5a76c9a386fbd31cb7c5b968b64b014bb5fdd72238f326c54c58aad64df
MD5 cc5d32193b92edb9a7596d5749884405
SHA1 8f3a80d7c40e2fd82dd327d88b36a7e1ee84e7a5
SHA512 a832107e6ae7de7b98d0009a0d8f569e43c67c719dc0b982d3745b300aaf110cd25a0f6a186618bea1786c9e5ae094737fe01a6994338c504cd3d68bcaf3f94c
SSDEEP 192:sxZORS1yM/jK1Ml8UQRkQ/f6sZRflIdpqJHW6+WNrqa/YzLEBaIg5vJ:sxZOcqiQ/f6sZRO+HbP/mT
TLSH
T15352E8127A34697BCCDBD209FA55BB53D6F545B2A2940E44AAFCCA0C05E7BDD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a0a2281b846186bad8ad13fd472a79b7440d0cdc9f37be99ec91e07066a230f3
MD5 45c352d0e43e8af0d7cfe44c94b96217
SHA1 163bee5977dd50a3aeaa72d821eff8ea12d6dfac
SHA512 8f8384ef873a385b0fed5eb530aded767833333e0d5e97404cbb8eab0f2b201ec459ca171a2a14e7302f119b3c6131a2975c8f433289c408effe587d120eba52
SSDEEP 768:3GW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjoroIMimY0:3GW7kf0Wvqidau1jaa5LA3jTM0
TLSH
T15DD2FB3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB7EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dcb364f5fe8b63b7305e671025a76a2e0d612121ab13f70ff5497d0b2d25c8bc
MD5 10425b8423f8ea1d67a5ef5900263242
SHA1 2c7d7acd492fd1a6a674387417368d002979e4c7
SHA512 2a10ca4e7a2106806c209e071641dd09fc1dfd3220ed39d35b8419ce32e1b29a315f5440e4fa9dc1366dfa2f698b3a8ac6cfaffd14b9852bc4465ef5393f41ad
SSDEEP 96:KIbCKc3/WKQouWF8BVr/7gfH6z99gKV19jgxN9qDjwwKBKJ:sSdWF8BVr/72H6B9J19juN9qDMe
TLSH
T19F917415303B13413CBE688C92A695368E4232A33959B46F7FB800B25E26E175FFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2914f58d-9f55-4c83-9c69-5adcb4eccebb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2914f58d-9f55-4c83-9c69-5adcb4eccebb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 546e239bd0116acfff3f51f5d3599d5bc6832b59b8608c3e57cc1f2827adfa7c
MD5 643ee6615085e1c8f141c2baa5243fe2
SHA1 e89102d2c20e69db056cf9b6e71f68eabff7dbba
SHA512 ff8d384e6cb96106ff756afab576bf07a6e83d77e2f71538e43ac89743e228bf531f1e2ad187250910cb7ee9f8aea0f6d29008b631a377d50ef89ccfd48ff4fe
SSDEEP 192:u2LsNUPHQpFQqNBba5QmiU1rDwB4aGBPKrs+FdGGm1pFE8FdNcqeU8:zsNUPHyQSbkhwuEddm1Q8pMU8
TLSH
T1FA321A766C74AC2B9EA2E145F04637135EA48167EBC42F84E6ED5B1C06DF7AC230A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 083a1c1d9b6165c14248729807014449efa608dfdb1cb69fd77552401309af0f
MD5 ad4669f6da0fb24a17a1aeb6ce0dc375
SHA1 8b4def717d805db934d070c7218b7ff04502c089
SHA512 4a87707ba69af55e294926f6fb95251f8e5032c77c6d91c15b32ddc77d96ee3ffab3bdb79c2039f06756bee85035d475e9cbd7d567d645b3bb19ad73671f84f2
SSDEEP 192:umLsNUEHQpFQqNBba5QmiU1rDwB4aGBPKrs+FdGGm1pFE8FdNcqeU8:vsNUEHyQSbkhwuEddm1Q8pMU8
TLSH
T1AC321A726C74AC2B8EA2F145F04637135EA48167EBC42F84E6ED5B0C05DF7AC130A917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 18a4ec4ea2d1a40cc25bf7cd129ad4d1f9fdd264dacf2e3713f45b6f135204a0
MD5 c5736dc126881fe94713c08fb7731432
SHA1 004f62f71a2b8116fe62f13d505a9cc622b555eb
SHA512 e3b699e1ff6aaf54f57e3aef95af4aa843266b81f6f5acb7adc3fbe4c6a89a16e0b0f8b67ffcba8aec055f43ed1269ff563bf7d9ebd1d4910878d6d1538d7364
SSDEEP 384:eiF1tNn/s3n9SGzsNc8TUNTUlIlSyQSbkgwuEddm1Q88Mmn15wbAjEO8myt:1F1j+9x5wg9J+mQ88Mmn12bfZbt
TLSH
T1B6C229F258D7893ADDAE9747B73D2E029EBCC167B5802950B3D84A0CCD9A2BFD305905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f1caa9464b1f238134eac0afac60a476120df4a15d57814c029230c1919b11df
MD5 7e095978f65a57ead1300665a351f7b0
SHA1 2d186f783d3cfda00ec75014d269afd8990e4619
SHA512 9910e03d9281d413718d39131735586ba2853f68317ac16940b3e6d1efa9e484a09c950cc2703d7f11a4b06aeaea9c4bf8de1efc42df902fc93b512feac0e327
SSDEEP 192:hON964BmQmiUyYDL5GBPKrs+FdGGm1pFE86WwcqeU6:hON96eCpLDddm1Q84MU6
TLSH
T15C120C326C74AC6F5E92B541F48737135EA54267EBC56F40E6EC2B1C05EF7AC1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 15d64af3573973886f32eb2a64d1ceeb3edf4982607959e697c5b1b3c894888a
MD5 3771334e07b87bd91bbcf0295dbc5344
SHA1 a9b741381291d4860158a07d06835077e2b5c5be
SHA512 46489dc399b96811eb3e12b7c5d1f8b80cc60031dde67747cd687fb0bce75a854f7102c515d0222512e57222583511e270fa129ab51bd4237404030b5b020b12
SSDEEP 192:MONE64BAQmiUy81DW5GBPKrs+FdGGm1/aDEV9U6:MONE6eArBWDddm186U6
TLSH
T1DE020A35AC786C7B9EB2EE05F48737175FD8113BA6941B44EAE81B1C00D734C234282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c8ed3f7-f157-4008-8424-1420fd0efa3b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5c8ed3f7-f157-4008-8424-1420fd0efa3b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b83273eb96af554f35cb6579265f045293cd2d6385857ecd96837cc66a7f9fc9
MD5 521e07b0271cfe5d52bbb9cf8cae5e9a
SHA1 5b1804952cabb214a5ba53666f2f8934364ce39a
SHA512 2fb5ca903fe3d0f75020672995556586231e4a19e835f6375fffd522f60cd48248187d4cc974e24337d2ef92c3c218d90ad7df5c5d639691a2e7b6df40870aae
TLSH
T10F4109A8B6EA1148B3B76F5A9BF2A46D843E7D772E07D45D10110E4F0A27B40C96173B
MD5 SHA1 SHA512 TLSH

Submit Download