5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1092870-p299a5.htm
Size 1KB
Sample260930-dbf11awzhs
SHA256 5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2
MD5 3a134f40128e3382caf68c7037564ce6
SHA1 d53f727b1b15ed1d2286e65613578331cb2a01f7
SHA512 7dc021062e3dd4f2601fa8291c6c7370bcb1b579bc09aac01ed304c2dfe255c0a67248a2e7b90940563d9c914749f0488d85f55208a5f48bf413f651b735d21e
TLSH
T1FD11CCDB03E23DA45493333764434B8EDF380175E7724F753475211A138A29AD4239F4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3440	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{8EDBB1DF-2D73-4CEE-9945-D92C179FB503}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3700	msedge.exe
3700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 1192	2924	msedge.exe	90
PID 2924 wrote to memory of 2296	2924	msedge.exe	91
PID 2924 wrote to memory of 3440	2924	msedge.exe	92
PID 2924 wrote to memory of 2296	2924	msedge.exe	91
PID 2924 wrote to memory of 2296	2924	msedge.exe	91
PID 2924 wrote to memory of 2288	2924	msedge.exe	93
PID 2924 wrote to memory of 2288	2924	msedge.exe	93
PID 2924 wrote to memory of 244	2924	msedge.exe	95
PID 2924 wrote to memory of 352	2924	msedge.exe	96
PID 2924 wrote to memory of 244	2924	msedge.exe	95
PID 2924 wrote to memory of 244	2924	msedge.exe	95
PID 2924 wrote to memory of 352	2924	msedge.exe	96
PID 2924 wrote to memory of 352	2924	msedge.exe	96
PID 2924 wrote to memory of 2884	2924	msedge.exe	97
PID 2924 wrote to memory of 5476	2924	msedge.exe	98
PID 2924 wrote to memory of 2884	2924	msedge.exe	97
PID 2924 wrote to memory of 2884	2924	msedge.exe	97
PID 2924 wrote to memory of 5476	2924	msedge.exe	98
PID 2924 wrote to memory of 5476	2924	msedge.exe	98
PID 2924 wrote to memory of 2164	2924	msedge.exe	100
PID 2924 wrote to memory of 4380	2924	msedge.exe	101
PID 2924 wrote to memory of 2164	2924	msedge.exe	100
PID 2924 wrote to memory of 4380	2924	msedge.exe	101
PID 2924 wrote to memory of 5096	2924	msedge.exe	103
PID 2924 wrote to memory of 4680	2924	msedge.exe	107
PID 2924 wrote to memory of 4704	2924	msedge.exe	108
PID 2924 wrote to memory of 6104	2924	msedge.exe	109
PID 2924 wrote to memory of 4512	2924	msedge.exe	110
PID 2924 wrote to memory of 4512	2924	msedge.exe	110
PID 2924 wrote to memory of 3700	2924	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1092870-p299a5.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffed4f1c188,0x7ffed4f1c194,0x7ffed4f1c1a0
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,7390484711084643292,12184431488668397464,262144 --field-trial-handle=2152,i,13502909683158572513,8196663876567447997,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,15921631328375718990,12017456258431904646,524288 --field-trial-handle=2152,i,13502909683158572513,8196663876567447997,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,16419336688963825606,7930931669535831379,524288 --field-trial-handle=2152,i,13502909683158572513,8196663876567447997,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:13
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3664,i,11170736282540436873,14222926360535024302,2097152 --field-trial-handle=2152,i,13502909683158572513,8196663876567447997,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3660,i,2441446998627687183,13883646715238641631,2097152 --field-trial-handle=2152,i,13502909683158572513,8196663876567447997,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,16861172322114588432,4492678986045572823,2097152 --field-trial-handle=2152,i,13502909683158572513,8196663876567447997,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,8678725646431618183,10817777009890920755,2097152 --field-trial-handle=2152,i,13502909683158572513,8196663876567447997,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,14959818898202269664,13918776140979682126,524288 --field-trial-handle=2152,i,13502909683158572513,8196663876567447997,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,11760649809367955659,9266759802499372880,524288 --field-trial-handle=2152,i,13502909683158572513,8196663876567447997,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,2342405241988734954,10536708519589402427,524288 --field-trial-handle=2152,i,13502909683158572513,8196663876567447997,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,2342405241988734954,10536708519589402427,524288 --field-trial-handle=2152,i,13502909683158572513,8196663876567447997,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,17109941773903232339,2066796179985142492,524288 --field-trial-handle=2152,i,13502909683158572513,8196663876567447997,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,16830973217204653889,8617098418115107653,524288 --field-trial-handle=2152,i,13502909683158572513,8196663876567447997,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,9365578766678984229,17355529883708097234,524288 --field-trial-handle=2152,i,13502909683158572513,8196663876567447997,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,16929638036247189846,12711359793359314920,524288 --field-trial-handle=2152,i,13502909683158572513,8196663876567447997,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3712,i,9063121207984261613,5120026370401227106,262144 --field-trial-handle=2152,i,13502909683158572513,8196663876567447997,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5961b0cd46a020fa7bc290cbac9478141154e44a102f8337bba6aaa3687f33c2
MD5 eed8174824e795365fd99f662b21bb0a
SHA1 c300a35dd1c501a02105fb3e2614fe5a92fc042d
SHA512 00ee03224ece82306d994f41667173be031248866efc9e899fdda7767dbb431816e30f279c6364313990785e6f14145809709b57d8759b8cbb70f3b94f0f957f
TLSH
T1E2616240DF508275F7B8003380D0FCDF363382B699871D5E1659D5B8994E7B583B5597
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a7b0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a7b0.TMP
Size 3KB
SHA256 ddd2310621e5bd6e3dc98f0695ddfa12c232bd620e23aaf9edc20453f0f52ee6
MD5 1c54dae4d54b1c454d3799138210a517
SHA1 bd0a225f91ddc93fbf61e4f00f341ba59650091a
SHA512 8a499aa412e168a7f4fe39ea79f38d41ba5699326addae7adb819eaee0330d58f0a073fc6fb10713f8347ce3c24c40c7243ad4301d0224aaf2fd9f22165e2c8c
TLSH
T104615080DF508274F7B8003384D0FCDF3A3382B699471D5E2A59D5B8994E7B583B5597
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3ac2a3ea689201e570235d80470d220f26ac1e9bed2c69614eb5151e81e70ec0
MD5 01430c2ae8240d92b4242fdf09fbebbc
SHA1 04b8da144fa4d0c45dae04525a138575988afe51
SHA512 cc61af40bf67ef010dc5b2ce1baebb4f421317f0dd7d3dd1262d52d146328a27d43e381ef0b9cb679c7a031e29d5430269e0f7b0a5d29c4be969fb72070eee54
TLSH
T12C418DF3C3E4867E890156F4AB146E2BCE2D0915931C3C5AC9E4AE2B93F3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 25d32d8d4ef4ba399db7db59cab53928dd3bb8e38db88bee57fc44014e3cee84
MD5 1fb2b4e2f0c5eb3177cf2b5afa02cf51
SHA1 b624d71ebe79c64ed5d2af69a1cedf05fd2fa0af
SHA512 f9d3026043f2c4cd46c8a44a767b686583cf33919385ee51bd894736cecb9eb619c4a4d32419cee21d43ae77c5761f202ec2cda2f132a45454abaeb0a479c7ff
SSDEEP 192:sxRbRVbp/fVsckzoA8p4S/g6+WNIYtfKGOIgIJ:sxRbHp/fVscFn/5IJs
TLSH
T17422A615AD68A97B9CCBE20DFB55BF53D2F91032A0952E48B6FC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e3220c0c151bd01c0fc2b98a536a39a13ff44ec2ba82c2642789badafb199270
MD5 2fbacc3a2a61778f61192c3f5c9da74a
SHA1 67326648b38d4cebcb8ab10ec4603a2d41e5ca72
SHA512 a615a5b1e20d452fc82315f49bf889871e2edbae1305c164a268638f612b2338b81d3e530cd142c1f3032d77ea624577aa99b9d600ece415c6f48b0da629f35c
SSDEEP 192:sxRURVbp/fVswkzoA8p4S/g6+WNIYtsKGOIgD3J:sxRUHp/fVswFn/5Iid
TLSH
T10132B715AD68A97B9CCBE20DFB55BF63D2F9103260D51E48B6FC861C14E76DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 39d59b4e4c0250ed90779c863596e3c68161fb81e5a02308bae83b56e44a7db6
MD5 215a3fcc5c4858e672a1e5f567555045
SHA1 a2f9fd5f2734ed1ee0e701563917186fe1b4c2f5
SHA512 2914ffc64205ea30c4bfa3d0c215cb48a4b91f063217417d7b57da44a5a885eb17e3dd9859331df0761705d45fba3b650526626e6d26fd51e388cb6810b3f55b
SSDEEP 192:sxRURVbp/fVs+kzoA8p4S/g6+WNIYtfKGOIgDhJ:sxRUHp/fVs+Fn/5IJv
TLSH
T11D32B715AD68A97B8CCBE20DFB55BF53D2F91032A0D52E48B6FC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 9761375e997d457fcb26700eb69eb8fd68cc576d31d387e3b7ac0835ab8128d1
MD5 068d548468001b1d259228b9167191df
SHA1 e170d7dcf3bde1f542eca026a4c9db361e29fc58
SHA512 53be955ec4a1802d53892890682bdae1bc0dcf9340e508455ebb68053216a5fa2b4b1e0ca617758e787ee04aad34bc3814ab58142d6a695f4c97ad1cd312ad40
SSDEEP 384:dFIGx9efCtgmkFfk6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV6W9G+RhBromLq:dmGx9sWgmMfk68F1+UoAYDCx9Tuqh0VN
TLSH
T19CB2D93B640CCB7E9FC00A9DAD196F976D9802C79A588D4047FA984C03C77EB912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7d39a1dc2e74d6f5403378600190d7a2e22055d021a560ba05a116bd65974b0f
MD5 5ed6e6f48a7887ad4c4b0c1ff65ef53f
SHA1 68c18901a8c04c09bb568cd285bf19e04d816223
SHA512 d4a2e513f80e8696c3065b597829a126b97e60635f49f28569e3092f8bc33e56209eec21c4e67d9dc75fbbcd388c7023a465324f0d5f5a769323137d77f5a1d0
SSDEEP 48:Kc6IfKnqs3yBgILKFyctMIbKVK8HyD9gBtrH:Kc6QKnqmCgAKFyKMwKVKuW9gBtrH
TLSH
T129918660713B5640387D360C91E69BAE57427263341CEA6B7BEA00525E6FE488DFC8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b3d39a4e-9739-416d-ba53-de623e93d1ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b3d39a4e-9739-416d-ba53-de623e93d1ef.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6a19380344f39f4a8167a6f86e828169b406e25eed136ad40bc0f6fcbf44880d
MD5 38d63ea6ab62414c8a66fb6804af3549
SHA1 ea7e0f127629d8d391ce50820c6b8081a374b383
SHA512 e5d020c038541ac427ade85669f3c2acd62830d4c6556c67023c0c09dfece3c59aa8c6670844ce49b11a6f8ff376652efe12f06edf5e1d00f2c59cb12d96ecd5
SSDEEP 768:I73CZ29KnJXUaLxDc9bsMSJz/Fn/92sSEp:I73CZV5UEVQbs7JTL2sXp
TLSH
T1A1F2BF71DCA049A79DEBA7C0B68AB6037FF44553C6C95A4894DEAB0C06D72ED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 ce04c071589bc0f36a481b1be91f2ad63dfb709153e9a54e419254924283c546
MD5 e0bdb2cadaf03679d66f9e3acf2872d3
SHA1 845c4442558a4a2b76e1885c37fa83d53e580f34
SHA512 7ed0898b6324f417ab4c672f18696e08160da8582549bf921a2c8821bb0453f324751612e97c9477e8eec594f83c6d2df8b2cfa58beae806ebdd00e5120e2db5
SSDEEP 768:EFQZ3lwgUZ29KnJXUaBxDc9bsMSJz/Fn/92sSEp:nZ34ZV5U6VQbs7JTL2sXp
TLSH
T1D703B072DC9089BBEDEB9BC0B68A7603AFF44553C5C9A654E5DE5E0C02972EC130BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b00b0d6224f810734e3ab4b34823688fe5b5b173d705bc0e405008bef5d05acc
MD5 750d57e9bce06e9f55bc185aa9f1faf1
SHA1 34f9755f04577a9a202c32bb645bf66f05ae1817
SHA512 b7ad7fd63a75b3e3c32d8bbcb35341e703e35da3cbddc80e66b5f7b68af24fa20b12312400e7a8700992a4be8c2b1771179b2b72568ee46b97aca6d7acfd094d
SSDEEP 768:y/UxvxjgC+23hZu9KnJXUa4xDc9bsMSJz/Fn/9owF:3Zj3+23hZN5UpVQbs7JTLowF
TLSH
T1C203CF36AC905CA39DE6A780764BB657BFF44953C5CA299849DE5E0C06CB3EC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 7f2e2fc9cf4bf2da3bc4c20c38cac6dacb826f5d04b480a4ab544c6698f5c55b
MD5 008caae577c7c1d57dafcaf5fc4e2410
SHA1 9ace7d934ba5393a43dfd4b71da8453f5a0c3004
SHA512 ce850d3df61ca5899e5addce2e5870de4ad3febc74d327ec478e84d7131cc20ac1985f33998a5ea820d3652170f3db6b544c660f0927aff8c70c4a6e23bd54bc
SSDEEP 768:y73hZ29KnJXUaLxDc9bsMSJz/Fn/92sSEp:y73hZV5UEVQbs7JTL2sXp
TLSH
T1B0F2BF71DCA049A79DEB97C0B68BB6037FF44553C6C96A8894DE6B0C06D72ED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 ae494b8f44158e79b855de0f7994273d41586c7b69c7aa41f70d820e7e8ee651
MD5 df735d13848664d50d7b370a40bc8215
SHA1 098aab910c3cd0f4d8f22f33eaf08d3d3c90beaf
SHA512 5d449afa79d56877a7e304f6254d8dcc495e9d11400c9fea7cd1a07409376ca34a2dc3a1e89685ad00db4d1dbbe50eb575f464e605554a38d272e06bfa272622
SSDEEP 768:z/UxvxjgC+U3u9KnJXvxDc9bsMSJz/Fnn9SHXPyK/:GZj3+U3t5vVQbs7JTLSb/
TLSH
T17B03C03AEC9058A7CDE767803A8AE657FFF44953C5C5299845DE6E0D07C73AC1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download