5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-7byd0u.htm
Size 1KB
Sample260930-faesnasyaz
SHA256 5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2
MD5 3a134f40128e3382caf68c7037564ce6
SHA1 d53f727b1b15ed1d2286e65613578331cb2a01f7
SHA512 7dc021062e3dd4f2601fa8291c6c7370bcb1b579bc09aac01ed304c2dfe255c0a67248a2e7b90940563d9c914749f0488d85f55208a5f48bf413f651b735d21e
TLSH
T1FD11CCDB03E23DA45493333764434B8EDF380175E7724F753475211A138A29AD4239F4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5240	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{2F389E62-1D21-401E-9694-B030AB98D3B6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 756	4648	msedge.exe	90
PID 4648 wrote to memory of 1896	4648	msedge.exe	91
PID 4648 wrote to memory of 5240	4648	msedge.exe	93
PID 4648 wrote to memory of 1896	4648	msedge.exe	91
PID 4648 wrote to memory of 1896	4648	msedge.exe	91
PID 4648 wrote to memory of 2372	4648	msedge.exe	94
PID 4648 wrote to memory of 2372	4648	msedge.exe	94
PID 4648 wrote to memory of 900	4648	msedge.exe	95
PID 4648 wrote to memory of 5800	4648	msedge.exe	96
PID 4648 wrote to memory of 900	4648	msedge.exe	95
PID 4648 wrote to memory of 900	4648	msedge.exe	95
PID 4648 wrote to memory of 5800	4648	msedge.exe	96
PID 4648 wrote to memory of 5800	4648	msedge.exe	96
PID 4648 wrote to memory of 5780	4648	msedge.exe	97
PID 4648 wrote to memory of 2912	4648	msedge.exe	98
PID 4648 wrote to memory of 5780	4648	msedge.exe	97
PID 4648 wrote to memory of 5780	4648	msedge.exe	97
PID 4648 wrote to memory of 2912	4648	msedge.exe	98
PID 4648 wrote to memory of 2912	4648	msedge.exe	98
PID 4648 wrote to memory of 2056	4648	msedge.exe	100
PID 4648 wrote to memory of 5428	4648	msedge.exe	101
PID 4648 wrote to memory of 2056	4648	msedge.exe	100
PID 4648 wrote to memory of 5428	4648	msedge.exe	101
PID 4648 wrote to memory of 4352	4648	msedge.exe	103
PID 4648 wrote to memory of 4228	4648	msedge.exe	107
PID 4648 wrote to memory of 2236	4648	msedge.exe	108
PID 4648 wrote to memory of 4928	4648	msedge.exe	109
PID 4648 wrote to memory of 3628	4648	msedge.exe	110
PID 4648 wrote to memory of 3628	4648	msedge.exe	110
PID 4648 wrote to memory of 4072	4648	msedge.exe	112
PID 4648 wrote to memory of 4072	4648	msedge.exe	112
PID 4648 wrote to memory of 2724	4648	msedge.exe	113
PID 4648 wrote to memory of 2724	4648	msedge.exe	113
PID 4648 wrote to memory of 1396	4648	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-7byd0u.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffa0f01c188,0x7ffa0f01c194,0x7ffa0f01c1a0
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,5860836164544560459,15353057358316900346,262144 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,6577922604062146020,329559771723674469,524288 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,15733169037808664199,11326184513827744479,524288 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:13
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,2645100773477192951,12969056238952937897,2097152 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,6497456535347392723,17559930801546151853,2097152 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,14212482033485840814,10958986113606699372,2097152 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,12825008721676787039,10371250585590001096,2097152 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:9
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,17703684037276256251,12789319163602008495,524288 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,5374947440693421502,1511199139568665148,524288 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,9825203325014178914,17873825487330388566,524288 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,9825203325014178914,17873825487330388566,524288 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,6331205856479446090,17564659020424712054,524288 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2836,i,694243451633206523,17877441979036596594,524288 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:14
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,342228186067219921,2416429691705926597,524288 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,4083456454476607779,6093323003076863307,524288 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,3056319812940184371,12516985438786638215,524288 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:14
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=816,i,16757562411098684068,15180122683112908958,524288 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5992,i,3839435358258447355,10407377746320137720,262144 --field-trial-handle=1908,i,12321987803491506983,16876126898946802050,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e1837ee53009f9b691f7aee3be45ffb945d4894bf04ccaf875b9947114bb5224
MD5 58ba31abb4a3fd3bbc9aadea4fc9ca13
SHA1 d79c4b2ccee6dadb45162ea34fb988911510f0b8
SHA512 0c096d7f5d364e0911d26f4bc2ea03e3d81b2026be5182b04fc17e7949640761db8056138b55b28aa9abe884d601d2cf6b1be9e992fd3565c35c69def459d32a
TLSH
T1F3D02B3579ACD772C18C503A405901112A95F001FD46C1801953B10848913400006295
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0a1e646beadfff70af6a1dc73b6baa41188262ddbb2b7781270d4e94c92c02be
MD5 893220bb58a1416480d52375128fa19a
SHA1 3a577208211e9133f3744d9ba695501b0481ca9b
SHA512 b3f0e3d85398f7aa7fcea74cd44fd2709c0265d9072771dccfe7508832bc1173f452a0f49028e8bd62ea434676abcdf4a111c8e31f121871fbdfa4acf207b131
TLSH
T1C2D02B3179BCD772C18C503E405A01112A85F001FD46C1801A53F10848913400005281
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 be7815b2a61bfe9a7fbc92561d46a399b10d97a901012ba9e756c830bf78152e
MD5 5886155bfdaf78c52361ad335192c569
SHA1 603233381f8a5f7faa0bba10b9042e7e1444ddf5
SHA512 9e598961a0ac9579261c01b2ec62774ab3c2076797d639851ded3647f179c1bfa5b9f7f11d01588430b5391311eab527ec53f16a3395a468969b68866fcae474
TLSH
T13AE0D8E48AC8C25DB1047887439C570CC2913B1E97C8AF99370484CD7081294E3C69A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 248a28746f9b44a35640ea1b7f79ec125e4fcc0afc4183c4008ba1723e95c2e6
MD5 24a43790d8390f069f82736a6d97cc09
SHA1 33bbe385d06f560db9c3a11264c205ca9e6f2b71
SHA512 928952111041bb9cdddd3c6da66262fde00dcd2d3cb125f9643edc2a02db8c26bd540dea6abacd973436eb7d27d4305504298e28fc72a07f2f7c6b5dbef54d6d
TLSH
T10371DA70B373C60AF75C357640CCC99A367298ADAEF35F15A39A90B4B6C6B6185C0788
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b953.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b953.TMP
Size 3KB
SHA256 0d7d6f840b33830b83d4f5decc0ed280ebc9ade0d543e546803765081c57a429
MD5 c8e6ff8f0ad6cc2d85af209104f1be4f
SHA1 66c625d2f3dfe3f6e0e33b58f9209a4959995c44
SHA512 b2671b1f980e9cca6b6274730e96423afa4f5e6deb7ea98895ef87d6b949e1a88a38afe857c3b22238dc42eabb21af77679512b0d2e446387f2301f7567a3f20
TLSH
T1D971DB70B373C709F79C357644CCC99A3672889DAEF34F15A39A80B4B6C6B6185C0388
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e52ffb4bb27e791d436157df7bcea3748b8122359dbab0866fcab4f1c64744fd
MD5 91c9cca2fea394bdc3eb9227efc254f5
SHA1 1cca91c81652e12e70f4f1b171ed0257c79bbf11
SHA512 0bbdf7947dfd3d2a5fd83410d246a5c9faf6a3c238a7c1dbd34ab918add9130dd6b2e100fa93fab0922c64e7d5320ecf37cc22d2197870085ff0966953b1de15
TLSH
T1BB419FF3C3E8867D891156F4AB146E1BCE1D0915432C3C5AC8D4AF2B93E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dd456471-4712-49a0-9a4b-094371885819.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dd456471-4712-49a0-9a4b-094371885819.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 13779f122afbfb939263df2fd7304eae65011c2c12bbc915044a2c7532a91a94
MD5 db9ee102d195f6db4ac32782c8a2dff9
SHA1 57f4a3672de96edddeff9003ad0491bd8c468041
SHA512 e5a29faf29f547bd24151f20fbd992253222dd1b0f7478f3d4b725be7c31e2085967d1eb0ae2d86d7cb868f31b6eed2c67eac5cdca3b2c5859138bb148165de0
SSDEEP 192:sxRuARob7/fHsqqmBLzoA8p43/g6+WNIYdJyGrHIgDpJ:sxRhc7/fHsqHBqm/5I0X
TLSH
T19132B715AD68A97F4CCBE20DBB557F63E2FD503260D51E48A6FC861C04EB6DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 96e0e563c0433f55014e2d7d7b31db8edea6b607a5394507836c11644eabb04e
MD5 7d05e708cd94e2571d95633081ce81b5
SHA1 4f93bda24802f8e66c3cf26dfd571be4f8caf180
SHA512 113f6a0c4a81cc047bbf981ab9bc7bdc2da4009e40cf97cc40b5331b96ef9479a2bbeed127b2a7904274c0c2447e46332e1d7bc267797700a92531a0b13c83b3
SSDEEP 192:sxRuARob7/fHsVqmBLzoA8p43/g6+WNIYdqyGrHIgDXJ:sxRhc7/fHsVHBqm/5IDN
TLSH
T1E332B615AD68A93F4CCBE20DBB657F63D6FD103260D51E48A6FC861C04EB6DE221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c60cb1164995acb6b691c630faa92e4e2c2bc5e46f44d370542892badc4db1bc
MD5 5f70f2c3cccf06c09807d44b0029bce8
SHA1 46b91b588ab9caed1876d4f79ee6b8e9236ab191
SHA512 0a6305aed6096ed24eadd31ceb2129d7037fea449c363fa569c62f8238cb70a7748c6e7a928aba43fbc320757cc27791aeb0d8a9c60df8ae0fcc43617d9e9a23
SSDEEP 192:sxRuzRob7/fHsNqmBLzoA8p43/g6+WNIYdqyGrHIgIJ:sxRec7/fHsNHBqm/5IDs
TLSH
T15132A615AD68A93B4CCBE20DBB657F63D6FD503260D51E48A6FC861C04EB6DE221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 a187ecadfee4c64efd3d4bb6538f0d444870142cfe4e20400af66b30cf34133d
MD5 bf9933097f0556c223b04d7f0d980bb7
SHA1 6fd2c01d56be18a46c35dddc1df723245e6db9b8
SHA512 daec895c94349b1adee9366b513318a79279d3e033f7191d8908d73835a421d894bd5b0fde19831ed7ccf8a64d8cdfe77ac0fc443fc06a84be6f3eda0e30965a
SSDEEP 384:qYe+z1ifCtgUGFf8SKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV269GGRL6roKrP:qF+z1oWgU6f8S8F1+UoAYDCx9Tuqh0V9
TLSH
T151B2EA2B604DCB7E4FC01A9D9C196FD76DA802C796588D4047FED94C03C77EAA21A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f32bbb0c-c43c-4643-ae18-084619fd4c51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f32bbb0c-c43c-4643-ae18-084619fd4c51.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1d4367eac8208c0013e2dbe44f21af5aa19e090d45a37d9ef164eb92dc353ed7
MD5 08cac64977e6cef57e787866f99e4105
SHA1 dfd4a2bb036885a495a2965dd72424acf9ce00b3
SHA512 a7366a62ab6e878d17b1b51c2eef99ba996413fc507d38b0d6468f5f2f6d52d10d5d48a794dc482c1d8a0969b84074790c39da352fd5fe066d57cdb7232afcdb
SSDEEP 768:cv3NlmXK3O0ituP1h3Yogkl5akl8pbHW0AWDM3DrgvPr9f:cv3HV1h3Yog05akl4bHW0A9zrgL9f
TLSH
T176F2BF75EC75AE735DE6E284711A7212BFF8C163A7C85A8494CDAB0D0197AEE034BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 91cd2abbb4ab0dfd273a9438b4e27993476b2a93d2e86c16542edb66b5b40953
MD5 46ec4c73f2553489699915e83c1ab44e
SHA1 b2133ef8dec08af3dc834865583420f887cc7210
SHA512 f4e9a4e16b6dbc9af13133769f4057ffe87e4721623cba882928df7e6479a69f4a9bff16702390a9866e95cdf392d3de3071f8ca67dadceeee9c6d3959c6c683
SSDEEP 768:jv3KljXK3O0itu81h3Yogkl5akl8pbHW0AWDM3DrgvPr9f:jv32z1h3Yog05akl4bHW0A9zrgL9f
TLSH
T169F2B075EC74AE735DE6E284711A7212BFF8C163A7C85A8494CDAB0D0197AEE034BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 d015b79149db3bee3f5284e895bf3d125550906ea07eebaaffdb0bb79e0aa539
MD5 7a660c83b7a0c373ae58013bc48ecc8e
SHA1 5b082dd50b62f9cc7f55d8936e1eb290cb9604c0
SHA512 71b7c4b9c39f3f7a9581124c03d0aa79555a3d99ce0349fdd961c54973483d4b61766a4055ec7102ca07eb1dfd2418d0ffabaadd18c33db66fa8ea981dbd4faa
SSDEEP 768:RFQ030wgUlmXK3O0ituh1h3Yogkl5akl8pbHW0AWDM3DrgvPr9f:g03J31h3Yog05akl4bHW0A9zrgL9f
TLSH
T19A03BF32DCA4DA779EE6E7C4B51A3212BFF8816396C89A8095CD9E0C01575EE034BC52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 49ee68a39a2c582e2fc45814f6b358ab181cee09fc4656d49dde98679398ff9d
MD5 685b8c2bc4a5b9c2006453136c2d5ac8
SHA1 fede9026bcdb541abc03a1cd1fbfab137a9432f3
SHA512 78db607e533c59db55a5e0450802d9debd731f1e9954aaf0e45791ecc8e802428859456a02f7317fb8ee8e3fdfaec9fe1e8136b212c552bcd153ef91477d9028
SSDEEP 768:B/UxvxjgC+CZ3AWK3O0it31h3Yogkl5akl8pbHW0AWTkSHvP0Vv:UZj3+I3B1h3Yog05akl4bHW0AhSCv
TLSH
T11503CF3AEC65AD738DF6A284761AA317FFF894635AC4569445DCAF0D02873AD030BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download