fce0a06e6946778d77b4660b9a0fe9b351de31936ed5952b4d9eac5fa841a184

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 12:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
&source=gmail&ust=1660295998001000&usg=AOvVaw3nH_2TnTIfmUxkdWdBxaNY.html
Size 21KB
Sample260910-pq2f2atbla
SHA256 fce0a06e6946778d77b4660b9a0fe9b351de31936ed5952b4d9eac5fa841a184
MD5 179db551d765df71c34a592f7fb55bc2
SHA1 8c17189202a4fcc76b0a4e21f145f795fc13ceda
SHA512 6ec22534c5d2aa6a570c7dd2806b6cea95213495b02fc79994df585e9a5df060ca57d7cc0a703cd928b06f08a67fd6f77e4e261b6d7c8dde28e83187ade1149c
SSDEEP 384:xYIcN/5xz6zjrFzPtvn+xFRzpUxHXUn/TpoJEfVZGyjQWngh9MSkD9MHBii:05IZFvn+Bz8aCJQVZG8TnghA0Bii
TLSH
T11FA2B026A01F715CEA5638FBDDBE5E1FA120CE41EEEE53C8C51419C17CEA7495A106F0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2324	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335172041316338"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{7C90BF2D-058D-4881-8B63-50906FB3CD58}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 520	2692	msedge.exe	89
PID 2692 wrote to memory of 3488	2692	msedge.exe	90
PID 2692 wrote to memory of 2324	2692	msedge.exe	91
PID 2692 wrote to memory of 3488	2692	msedge.exe	90
PID 2692 wrote to memory of 3488	2692	msedge.exe	90
PID 2692 wrote to memory of 1740	2692	msedge.exe	92
PID 2692 wrote to memory of 1740	2692	msedge.exe	92
PID 2692 wrote to memory of 2476	2692	msedge.exe	93
PID 2692 wrote to memory of 5972	2692	msedge.exe	94
PID 2692 wrote to memory of 2476	2692	msedge.exe	93
PID 2692 wrote to memory of 2476	2692	msedge.exe	93
PID 2692 wrote to memory of 5972	2692	msedge.exe	94
PID 2692 wrote to memory of 5972	2692	msedge.exe	94
PID 2692 wrote to memory of 3928	2692	msedge.exe	95
PID 2692 wrote to memory of 3636	2692	msedge.exe	96
PID 2692 wrote to memory of 3928	2692	msedge.exe	95
PID 2692 wrote to memory of 3928	2692	msedge.exe	95
PID 2692 wrote to memory of 3636	2692	msedge.exe	96
PID 2692 wrote to memory of 3636	2692	msedge.exe	96
PID 2692 wrote to memory of 5172	2692	msedge.exe	99
PID 2692 wrote to memory of 5728	2692	msedge.exe	100
PID 2692 wrote to memory of 5172	2692	msedge.exe	99
PID 2692 wrote to memory of 5728	2692	msedge.exe	100
PID 2692 wrote to memory of 1104	2692	msedge.exe	102
PID 2692 wrote to memory of 2064	2692	msedge.exe	106
PID 2692 wrote to memory of 1332	2692	msedge.exe	107
PID 2692 wrote to memory of 2212	2692	msedge.exe	108
PID 2692 wrote to memory of 4104	2692	msedge.exe	109
PID 2692 wrote to memory of 4104	2692	msedge.exe	109
PID 2692 wrote to memory of 1104	2692	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\&source=gmail&ust=1660295998001000&usg=AOvVaw3nH_2TnTIfmUxkdWdBxaNY.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffe6d81c188,0x7ffe6d81c194,0x7ffe6d81c1a0
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,8005905297709313565,253414721424886626,262144 --field-trial-handle=2132,i,15645855273905428314,11366531599053698527,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,15434882709552584732,622117989503581201,524288 --field-trial-handle=2132,i,15645855273905428314,11366531599053698527,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,14639644916119792462,6257787849730587650,524288 --field-trial-handle=2132,i,15645855273905428314,11366531599053698527,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,17937602386858661626,2801333684614189158,2097152 --field-trial-handle=2132,i,15645855273905428314,11366531599053698527,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,14994926042991450231,16580500252443034199,2097152 --field-trial-handle=2132,i,15645855273905428314,11366531599053698527,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,6776161598058978112,17701173829950424526,2097152 --field-trial-handle=2132,i,15645855273905428314,11366531599053698527,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,1396611987667132762,1181759106342766479,2097152 --field-trial-handle=2132,i,15645855273905428314,11366531599053698527,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,9560501412027127484,14056533666682092610,524288 --field-trial-handle=2132,i,15645855273905428314,11366531599053698527,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,3140283855281490157,11418248843201573067,524288 --field-trial-handle=2132,i,15645855273905428314,11366531599053698527,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,18337797637647676442,18280305747042972569,524288 --field-trial-handle=2132,i,15645855273905428314,11366531599053698527,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,18337797637647676442,18280305747042972569,524288 --field-trial-handle=2132,i,15645855273905428314,11366531599053698527,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,9230994378880402896,14738871477764878886,524288 --field-trial-handle=2132,i,15645855273905428314,11366531599053698527,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,8893171843321514805,4115751682102465520,524288 --field-trial-handle=2132,i,15645855273905428314,11366531599053698527,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,13971523667123917556,7082898049610567947,524288 --field-trial-handle=2132,i,15645855273905428314,11366531599053698527,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,11641931764164709604,14289697887824576953,524288 --field-trial-handle=2132,i,15645855273905428314,11366531599053698527,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6476,i,5694021411432828771,18158006153278161509,262144 --field-trial-handle=2132,i,15645855273905428314,11366531599053698527,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a547d449227ae9ae9e9f2f434eba2444e8002a0694b4c69227fadd28f35b8c37
MD5 c3cc216a383fbd7550845ade4c01c684
SHA1 08ec70fee69bdaf9ef92fcf5fd8456d877bee97c
SHA512 38fd11fa5403bcc8af67eef6223cf28f892d81c73cc0582fb676bed5304780eefd7f246254482cdf24ec578a93b6af733ac75478da5d4792948222d65bb96b6c
TLSH
T1C45143091372CAE1E7A592F951E2C7CFFAF884DAE3876E30090BAD38691BF4510E0053
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5972c5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5972c5.TMP
Size 2KB
SHA256 ec80fe06aaf951f2473b2018ecf8df8a4f8639f5d8467147c9614934290116d6
MD5 235a7e5d84509c452e4a90c01a8166f9
SHA1 e372f7e49064f78c870981ab7a667bc9ea0d3647
SHA512 22eabacc5d1ec2171cce7f0435573a88896c93f8182056a82e5a8544290270182cc4f74014c961da1933ac208018f69cc09c32a82665b67265d08aacbb46fc73
TLSH
T1345130091372CAE2E7A592F951E1C7CFFAF884DAE2876E30490B9D38691BF4510E0053
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7931eac920876857556af93c254ea62bce8850ed5982abf7c7c1f63d929256e3
MD5 c3b97aff60dc30e2a909696fe69ba01b
SHA1 87abbb70270037a550f9aa67b0a442b9aca002ba
SHA512 5acdcec20cd21cb9c9a99c3e4f81d099441bc80e6828454a995b4d2569865243231f2e4637b005077467d3087fb19f2e86c9defab61fabf8736a85dd8297794e
TLSH
T199819DF7C3E4476E891152F0AB256E2ACE1D1516432C3D9689F4AF1B63F24B1E10169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 db7c6a3d23cbe1b11c7652e95a14bcd9cea145586ed1c936db08ab3ebb1888a3
MD5 ec98681c121224150715d591d8a9c4a7
SHA1 bb0e309da6bc1de89149691faf9f52210e1315cd
SHA512 8d1944ad1386cc1e6f6893b90e50ffb9c1aaee9fb64637a30af71e97588cf689829501a4d6280dfc630afcd2ea785ad7467458cd8f75466f78e94721bc4ca0ce
SSDEEP 192:sxRDRubP/f8s/Hm2Sm7a6DzoD8p4i/g6+WNIY3B2I+GnIgIJ:sxRDKP/f8s/2qD/5IAZs
TLSH
T1A932A716AD28A97B8CCBD21DBA65BF53D6F9503261D12E48F7FC860C04EB6DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9990415a67d3f4817ed9cd1305f86031eae9da7b69470c3d7d2d3533187b2574
MD5 fd20e42b6f0ef732b68f4aa7cf803eeb
SHA1 fe770ebdbda6aa9e7faacd586bf93318ba35a2df
SHA512 7e209e58a25fb4a41e06cc5265d8db195d931a3c38e8e659273da91071a98bc18fec41fc016eadd1d7e7da845937be49c7b35ef7ad283bd112204d40a583c366
SSDEEP 192:sxRkRubP/f8srHm2Sm7a6DzoD8p4i/g6+WNIY3B2I+GnIgD7J:sxRkKP/f8sr2qD/5IAZJ
TLSH
T12932B616A928A93B8CCBD21DBA65BF53D6F9503261D12E48F7FC860C04EB6DD521780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f580642b9096ca9f1b9338486578438a12632ae4caaea267c23ffc82915aa245
MD5 0dccd922d77080d480999b7879b9f603
SHA1 f3b79b3f05ad0d458dd8a8217197db50dba10710
SHA512 1155d4fea7ed6ea8b428778f9a9b96d57ffadea05e7c7ad0c0b33a2434812ed1045ee7e6ef154e62d7cc90deab1303493b732a1096358725f8e772bbfe51e33b
SSDEEP 192:sxRkRubP/f8sfHm2Sm7a6DzoD8p4i/g6+WNIY3tu+GnIgDNJ:sxRkKP/f8sf2qD/5Idj
TLSH
T15F32C616A928A97B8CCBE20DBB55BF53D6F9503261D12E48F7FC860C04EB6DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 70ab86e411abc39dc90d81e4855c4e4490784db8d456ee76c317b9488c6d7f50
MD5 16c4ff19cd3868fdec17fa828b37e6d8
SHA1 7a48d0d174794c32bee57e3afbb50793dfa42f09
SHA512 2f748202c577302674f08939c8d24933593e66604a3fc99f48b58db73728d78ed1da160f27a41aec5162cc957499fabba99eabc9ddde04b4b12f647c9e06904b
SSDEEP 384:GMgEbt2fCtg0+FfKsKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVKO9W+RTGroOLt:GTEbtkWg0CfKs8F1+UoAYDCx9Tuqh0Vn
TLSH
T15DB2DB3B600DCB7E9F804AADAC59AFD76D5802C79B588D4047FE990C02C77FA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0bb9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0bb9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0dca5f56c1273a5b34d22f5609933d51252904d329cc1f2d0808396b5b539daf
MD5 4491dc4cbd85de948bf47379f1b19466
SHA1 ac6c6f61343105b425a2e293d1df3a566b9c835d
SHA512 d4c814def107c1ad44cb6f8bd1b6fb1cdaeb27e63c3d5931940fecf37b66bc7459724faa17b6774d19b4984938cfbcca90f063d6469339eb11509900959745c5
SSDEEP 768:prv+4UNbdi33//uXJXvHc+wfZOkfbfI66ZvShCQRklvn:pbsb433HqJX9wf7fbfb6ZvSABn
TLSH
T1E003CF71E87899339DF78288B6477B53BEA86163C8C44654DACD4B0D02C36EE271FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b9c2efd7c4e02f8879417229489672bc901e01f77e161e068f71e08516b0ddfa
MD5 d78dc5cda22c573822524a204fdd9652
SHA1 13e9529a088fc4a6fb5cb1a5b02d1b2e7d0c8f4e
SHA512 7bc168f6cd705209a7681f4826730b6b7de51f56f879264ba125092fe47573cb841e790047f8ed1785ef7588da252062bf6d4fb76f840384f25bf619ea667097
SSDEEP 768:fh33//uXJXxHc+wfZOkfbfI66wvShCQRkMghe:fh33HqJXvwf7fbfb6wvSAMghe
TLSH
T167F2AEB1DCA45D738CE683887B466B13BDB59223C9C85A44DADD5B0D01C37AE271BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 3e708e1d6f53f8f0817ec79be7e63d140b6bc3c6482d79d778b2e96d2fcf043e
MD5 e36a0877be51c3ac913b014221fcc18b
SHA1 3eede731e76e7c354d7e47b1184c20427a1e78b3
SHA512 6da24a32963480a0a170513959888eecb203f11959ba9f8dbcbdf07270da79f5781ac854b42314414618b57783fe1b2a8ad36d8fa9b3ac57d56457fb9dadd416
SSDEEP 768:yh3a//uXJXxHc+wfZOkfbfI66wvShCQRkMghe:yh3aHqJXvwf7fbfb6wvSAMghe
TLSH
T102F2AEB1DCA45D738CE693887B467B13BDB59223C9C85A44CADD5B0D01C379E271B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 e9ec0d0a067837e0b83d34222a92669c1d3c096bcb5d19ddbe06cd8728ffc14e
MD5 7a02d02ede3e7fbd11d0bd03d315e789
SHA1 4875f7895ebf2f027f52270c4f31ab3d2b74b7fd
SHA512 0dca46a63ec58648b7183ee3ebfd7949b5aecac8da44ab66274e33edcc3a3294146aebba8699f998f8c7d6423380a46fd39094ad3a43335832faab0d01d30131
SSDEEP 768:oFQw3Zwg8//uXJXxHc+wfZOkfbfI66DvShCQRkMghe:Lw3kHqJXvwf7fbfb6DvSAMghe
TLSH
T179F2AEB2DCA48A779DE68788BB4A3712BDF55173C8C89654D7CD4E0D00832DE271BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 972259834421fea36c716e19bfce96e2d7d06a15bfc7825c9416953a0bb6525e
MD5 0892b1a7b0aa4506e8869ff6297ed886
SHA1 2c3f8ea6041485b8ed246d5de4cb030ed370c37e
SHA512 95f7b673987f0975f970e9f2503acd62a8c73f5a168e1eedf683f5ced65f4c6ce83ef6245bb020143f6982df203e2e28c168478137617aba7db510c8e6d2acfa
SSDEEP 768:Rrv+4UNbd43VBkc+wfZOkfcvShCQtP2bwWV:RbsbO3Vowf7fcvST0wO
TLSH
T1EE03CF71E86899339EE782487646BB637EB86163C8C54784DACD0B0D429369F370FC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8d780af0fff33c529b06c085b60cb69dc29c03ff3b436d25a0fa7e5a5186142d
MD5 929d34fbd0f43b1fb1096c3de2bba91b
SHA1 348a2414069b5483824c7e7af67f7d15c58c5074
SHA512 256746eb7f6c57f27ab6318bbcb7a6510d0977c589b81006e01412a04e28c5f8c737e6f0c02287173b1f864c7bfbfb4a4422e4ebf1cb1eb5dd467587e223aa4a
SSDEEP 768:Trv+4UNbd432lc+wfZOkfbfI66KvShCQsk2bwWV:TbsbO3ewf7fbfb6KvSj0wO
TLSH
T11603CF71E86899339EE7824876467B53BEB9A263C8C54784DACD0B0D018369F371FC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f0d4f85-ca79-4635-8a7a-efcb48550362.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5f0d4f85-ca79-4635-8a7a-efcb48550362.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download