hxxps://cdn[.]discordapp[.]com/attachments/1550353863847182367/1550353864686051338/Hirimi-Library-main[.]zip?ex=6abd304d&is=6abbdecd&hm=795d82c5002e3f5af9f97c39168236d44fd5161e6be844bd42c004bc8ba24188&

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1550353863847182367/1550353864686051338/Hirimi-Library-main.zip?ex=6abd304d&is=6abbdecd&hm=795d82c5002e3f5af9f97c39168236d44fd5161e6be844bd42c004bc8ba24188&
Sample260930-ecckmszz2k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{96A49C2C-DAAD-4D27-B433-5634159796D7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4272	3372	msedge.exe	86
PID 3372 wrote to memory of 4792	3372	msedge.exe	87
PID 3372 wrote to memory of 4336	3372	msedge.exe	88
PID 3372 wrote to memory of 4336	3372	msedge.exe	88
PID 3372 wrote to memory of 4336	3372	msedge.exe	88
PID 3372 wrote to memory of 2400	3372	msedge.exe	90
PID 3372 wrote to memory of 2400	3372	msedge.exe	90
PID 3372 wrote to memory of 2056	3372	msedge.exe	91
PID 3372 wrote to memory of 2056	3372	msedge.exe	91
PID 3372 wrote to memory of 2056	3372	msedge.exe	91
PID 3372 wrote to memory of 3392	3372	msedge.exe	92
PID 3372 wrote to memory of 3392	3372	msedge.exe	92
PID 3372 wrote to memory of 3392	3372	msedge.exe	92
PID 3372 wrote to memory of 2740	3372	msedge.exe	93
PID 3372 wrote to memory of 4356	3372	msedge.exe	94
PID 3372 wrote to memory of 2740	3372	msedge.exe	93
PID 3372 wrote to memory of 2740	3372	msedge.exe	93
PID 3372 wrote to memory of 4356	3372	msedge.exe	94
PID 3372 wrote to memory of 4356	3372	msedge.exe	94
PID 3372 wrote to memory of 3820	3372	msedge.exe	97
PID 3372 wrote to memory of 4320	3372	msedge.exe	98
PID 3372 wrote to memory of 3820	3372	msedge.exe	97
PID 3372 wrote to memory of 4320	3372	msedge.exe	98
PID 3372 wrote to memory of 1244	3372	msedge.exe	99
PID 3372 wrote to memory of 1244	3372	msedge.exe	99
PID 3372 wrote to memory of 2732	3372	msedge.exe	100
PID 3372 wrote to memory of 2732	3372	msedge.exe	100
PID 3372 wrote to memory of 2732	3372	msedge.exe	100
PID 3372 wrote to memory of 2500	3372	msedge.exe	101
PID 3372 wrote to memory of 4212	3372	msedge.exe	104
PID 3372 wrote to memory of 4236	3372	msedge.exe	115
PID 3372 wrote to memory of 1332	3372	msedge.exe	116
PID 3372 wrote to memory of 3916	3372	msedge.exe	117
PID 3372 wrote to memory of 5072	3372	msedge.exe	127
PID 3372 wrote to memory of 5072	3372	msedge.exe	127
PID 3372 wrote to memory of 2780	3372	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1550353863847182367/1550353864686051338/Hirimi-Library-main.zip?ex=6abd304d&is=6abbdecd&hm=795d82c5002e3f5af9f97c39168236d44fd5161e6be844bd42c004bc8ba24188&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ff865edc188,0x7ff865edc194,0x7ff865edc1a0
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,15944147975802232348,6520228226568164963,524288 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,9666475672070700423,4302151001211128813,262144 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,1928532372419142501,8033322798278036807,524288 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,17258000184821729431,17363742783064980701,2097152 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,8513393131337890204,5659425711985502122,2097152 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,14783856261969271368,11897372975302451233,2097152 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,9917752851693471517,1909490892089308549,2097152 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,6144609585430454673,5897796198112966657,524288 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,1720460726811093675,13332243470623108985,524288 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,9564537781139389619,997999880518023788,524288 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5748,i,9400940221780294973,10670007911774597048,2097152 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,14065823714300387995,9234670705367376567,524288 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,5229808938479008027,11517409573225223258,524288 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,5229808938479008027,11517409573225223258,524288 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,9768078425336407035,3547822810658083409,524288 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,2190297643765907607,4140949923414620215,524288 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,9621806209535128254,16052529511442017758,524288 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,13126027611173469740,5331305584620182062,524288 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6816,i,3221184480010523866,14652091903767224077,262144 --field-trial-handle=2312,i,10199831779933065380,8247819873316622051,262144 --variations-seed-version --mojo-platform-channel-handle=1224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2028

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

4d81ade8-bb4f-471f-ab3f-ef85ac367eaf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4d81ade8-bb4f-471f-ab3f-ef85ac367eaf.tmp
Size 9KB
SHA256 9170428867f2d318fc255f9fdeb5a1ce7be729ee3e9cb607e3c89922ff1c4405
MD5 71acd010c3e71bf957a6057b4d694e79
SHA1 4b31cd5c5232310de24a3c2f82d2ab5f0e9f2ee7
SHA512 c5f0736a8ff6dea8d9375ddd9e29f86facbfeadd9c6d883808d0ec48c2f09e42d057e2959145626c7eeca9cb935f08c94f62de15c86026438fb8c3533b85d000
SSDEEP 192:sxZ9RUCn0/fxXs1qXjIdpJHW6+WNGY364O+5IgrJ:sxZ9h0/fBs1a8JHbGXry9
TLSH
T1CD22B8516E38A57B4CC7E20DBA25BF53E5F9503261D41E58A6FC861C09E6ADD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e2178d83046e39cf552adfd463ef6fecab9d55bc407f3ab0ff64fa2aeb3426e1
MD5 4854c0524dce69273f2b32b83b082b9c
SHA1 acd84173685c0d3bb1c5f75f861c47e0f56f0f18
SHA512 4cc3dba05ab22e45ee5edf7ea9ee204365c6faf5c7db612ce70f226e1e584e5ea85f8a8fa90fbe5fd489d64fb8c9b0c38f6075feaf737704c41a1ae313b05de1
TLSH
T14651E8E09FB1A198F7E883B4F1D1167332B4A090E5831F5F5452E9BD48077F8589436A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4d10501e583215a0732d0085ffc39488d4883d9350004ad2ae01a661cc82a0de
MD5 b7c5a1e47bb05f538d156c567fab40cd
SHA1 2cddb8ffc4f78bce545c7416773d7157dab42e79
SHA512 7490752c72e107b7f73aaa70f14ab431de437d6070307a28bf5d321b38bc7382dfad81766d988c58b8f9b9ff0360f2bad21afbf4b88fd99ab83d8d4e6b32eb8c
TLSH
T13C2198F3C7D5866EC9051AF06A14AE2BCE2D091843283C1A89D4EF6BD7E3472E10198F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6e733fdaeabba192eaf006ac1874cf98ceab65eb13dd1dd2cc14e2d1f825005d
MD5 2a6662aaba87d7d20375e5294bc3c736
SHA1 b027623b0c1190728b420c7a33e4583252003704
SHA512 3b478f27c02c3e5f961e0505b3f9fb52247a5729711a83966fd122e605ce6a500342015a074148ae3481bf48700d36d2805755a25cd2d8dd4ae52001a7332d65
SSDEEP 192:sxZ9RUCn0/fxXsIvXjIdpLHW6+WNGY362O+5Ig5zJ:sxZ9h0/fBsIf8LHbGXZy/
TLSH
T19422B9516E38A97B8CC7E20DBA55BF53E6F9503261D01E48A6FCC61C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bda52721a85397c7ebbc59c80ba8fe917871b4aad64a807feedf6721e9201b0a
MD5 1c51f64f0bef11d0c1a07dca28437c1e
SHA1 ccfc0895c1d71cd5104010822aa7ae1014126318
SHA512 5fac118cd9b8b9e1489dd67bfb44085ae1487a691afff1af88f8c1f0fc4381c00601e6f0adea4c8a2049f6ed9672d07c2f8abbb5b32afd38ffb6fc6501a5a080
SSDEEP 192:sxZ9RUCn0/fxXsIvXjIdpJHW6+WNGY36pO+5Ig5zJ:sxZ9h0/fBsIf8JHbGXwy/
TLSH
T17622B9516E38A97B8CC7E20DBA55BF53E6F9503261D51E48A6FCC61C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 41572a71021c8183d417e4765a0a571c9febb941788b98e140f6147dc9af3c9e
MD5 936c8ed601843e69d4c1e4e4846173e7
SHA1 87a7b4b53f8d65c02bb0077f1ad4e9cd72333566
SHA512 44598f875c011550f7d3521be44a7ec771a79f6f8fd2fda20935593f3c9880081f49c11c8ce0ed888fb048d3156005c933390d72954efad93a0cf44bf8877223
SSDEEP 192:sxZ9RUCn0/fxXsIqXjIdpJHW6+WNGY364O+5Ig5JJ:sxZ9h0/fBsIa8JHbGXryp
TLSH
T18122C8516E38A57B4CC7E20DBA25BF53D5F9503261D41E58A6FC861C09E7ACD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8c97e5ea7e3a286b4a3feeb25c25e8d87d74fbf2688eda3e1ec45f2edaa94258
MD5 7c05a9c897a15b3139ff17e1be8896a7
SHA1 cf752799680eed18cbb9314c4158ce78337f135d
SHA512 f4969a0257e92098c407b49fec40b198e406945a2d16676aa9cbe3b3078fe441890b5bb8cedac91169136a200d79cd3b833f4a5451feeeb71e038b129be5a811
SSDEEP 768:77Klm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/oro85:77Klm7QWvUYe0u1ja8/L/E/T85
TLSH
T181C20A3B740CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8ef3b21bdf73ccccadbedfdab6a009d60a401d249e8996e77b8a6d1b8adb0ef0
MD5 cb0de2b0f43bd9f9023007865f409648
SHA1 2fbdf9efccf5fb953d541587ae94e3935b829ad4
SHA512 b61d9701d29e664e9f0546ca3574f3bf1627f02d7d15869e497d4a505f39d50d68ff27bece3549d6409eed057443ba80fb6c9957e497ace386761f5e21fe1c53
SSDEEP 48:K0ydgMyQwBbsbcISkBK9o1yBxKRYTkQCyLQ/26gK+/b2NWISS/K9u10/xIvY1mKZ:Kg1SK+Maun2KIQTtuKmIi0
TLSH
T1AA913210727B1754397E688881A4872F429231733158FF2B7BBD10A24E6BE498DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59d586.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59d586.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 90a5c2cf5f07837650feee08fee55c911bda97bd5a6394794a2132c274ff5c7c
MD5 9ce55a5264ab95b4938079db753dea88
SHA1 e86b605b08b389f5b48d83e277b842516b97ce21
SHA512 df5b49ea81ae0bc6c64f6e6683b602936814127a84e174592dff01da43e6461745de25668c4776055d4c0a5fe48bc23f85a1610c34293b3ce50c916208441bbd
SSDEEP 384:9ZcIhsNlUrTSbxhyh//GJ2ttgOIwZOyLoSoa:lhNQa/3tXspSh
TLSH
T10B827C359C78ACBB6DE7A185F18777034FB48027E7C5AF9499EE6B1C01DA1A8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 f2530c2bc512aee8537f20eae5c205790810142dec1cbeb26cb19f448be0c59d
MD5 50bb619c6a458819b7ce05e45f8dcf9d
SHA1 ce94303338d5fbdcc3ed8bd29615e393f4d22076
SHA512 55764edb612512a959f451e268aa0c4d4e4d35636d27c1eeb27df9416bdf53ae66542f9d429333e74ef1ad7dac4136164d97b1e30c13ce19f049b5a3c95587d1
SSDEEP 384:ciF0ZcIw0sNW8TUNTUlIlKTSbxhyh//GJ8ttgOIwZOyLoSoa:HFyrLwg4Ea/ntXspSh
TLSH
T156A27C328CA8D8BBADF79A85F54A73138FB48067D6C5EE90E6DD5A1C01DB1E8130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 04bd6e44399053ef3f4003e2b76c4cf423a60e223ec97f9af299a4ac23d9c87d
MD5 aeeaddbd56aab721e21e5596804e6ce3
SHA1 db65e5d904f04d82e0520c67f98d0cc712f3df1c
SHA512 777a26cf521aefbb99bfef00529477c9c320b8b5ad47d84548dfbacbaa470d481bab763b6ae14e903b459540247a221515fcc5007d6372ac2996825f774a1b58
SSDEEP 96:KqONkrQsjpfbU3H5ih/cIPURHl8h4otop5QTDWBkP4v+Y1xf//ojdhxZBmqxxLOg:BONf6JUAQmiUySGuo//GBm8/NxQqTU6
TLSH
T1DB120935B8A8AC6B5EA3A981F08737135EA44227EB856FC4DADD2F1C05DF16C130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 05c63c03264abdf6bbc3d9be32428020b42e8d58e5ab8bd09a42e6c394793026
MD5 19f0768574f28fbe418c57f9a8b14acd
SHA1 a450fd48cd270afc46b4691cde636158ba22abab
SHA512 41f2c9c5103dabe533d0a7652a568b1d846dfecc778b6b3c8183794ac11d3ac3256dcc5f6d2b72830edc90d23f31e27407a52e339a2e4671dd483c500b4cfa58
SSDEEP 384:NZcICsNlUKTSbxhyh//GJ2ttgOIwZOyLoSoa:VC0Ea/3tXspSh
TLSH
T14A827C359CB8ACBB6DE7A185F14777034FB48027E7C9AF8499EE5B1D01DA1A8130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ecd00e57c5ed8cf0f49d5d291a9ea856c82b5991ee4e85440bb6885e137a500d
MD5 dae8cd1c18a66779bd071210947468d6
SHA1 2631ef781c84f90fff56a3771e1614ecb441b831
SHA512 43f46c8a56366530d7972803d0ebd74ef4eff0df0fd497a50ee8d65728c66fecdaac77a99f303fba75ddac518e2e17628bf1976e47ef6667b508fe33923f4517
SSDEEP 96:KqONk5QsjpfbUmjH5ih/cIPURHl8h4otop5QaDWBKP4v+Y1xf//ojdhxZBmqBCx4:BONd6JUm0QmiUyJGso//GBmqBC/kU6
TLSH
T12102E838BC787CBB8EB3AE45B0877B239FA41067A6912F84DAE91B1D01D715C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e2820574bdee8c98755ccd0b374f963383b989af9e0d37071d5b7b9de7775bfa
MD5 90085d38bd2f0af3beb5b510374ae9c8
SHA1 384b89970fd679b93caa5e52044153edad823509
SHA512 34c00f37e491cf5f05d4f6ce6e9667d344536efd96d58fb5aabffbeab380b41a51ee4778fb89c5e45dbb0d06355d95c9df9743dd4539c94183e07779c5ae42c5
TLSH
T194411958B6EA1148B3B76F5A9FB6A86D487B7D772E4AD05D00110E4F4623B44CC61733
MD5 SHA1 SHA512 TLSH

Submit Download

Hirimi-Library-main.zip

Path C:\Users\Admin\Downloads\Hirimi-Library-main.zip
Size 1.7MB
SHA256 c675a31b18705fe05a34c2f0a4054a7741360db5f8cb0e13cb07e61b06b34c59
MD5 813a22c6f1a9b14ecd60454f0802d888
SHA1 0d98c981bab8b01515f1cebefebc03d9efa5f9f5
SHA512 d506ef3c2a0ad6143741dcdcc6b2bf474ca9d95251dce05dbbd7d039d0f4b14093a774757f0d516266991ecee46cefd8ddf4b05502f142d718ffce20cc1fcc4b
SSDEEP 49152:8NPCjQwWncFZxzgNpTUgPSufKagEGcaOonGHXSBBK8WO:8NCjQwWnc3WNpT1Kf5catGHXyBvWO
TLSH
T1C685021E921B1DB0F4AE77FE7513831E9767B729890E5E29A8903834C617C429F13B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download