ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-23g7ty.html
Size 116B
Sample260930-getcaaxves
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4636	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{92602BB3-9D41-4FA5-AFE4-32EB520E15F8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 4400	2108	msedge.exe	89
PID 2108 wrote to memory of 2516	2108	msedge.exe	90
PID 2108 wrote to memory of 4636	2108	msedge.exe	91
PID 2108 wrote to memory of 2516	2108	msedge.exe	90
PID 2108 wrote to memory of 2516	2108	msedge.exe	90
PID 2108 wrote to memory of 4332	2108	msedge.exe	92
PID 2108 wrote to memory of 4332	2108	msedge.exe	92
PID 2108 wrote to memory of 2836	2108	msedge.exe	94
PID 2108 wrote to memory of 1992	2108	msedge.exe	93
PID 2108 wrote to memory of 2836	2108	msedge.exe	94
PID 2108 wrote to memory of 2836	2108	msedge.exe	94
PID 2108 wrote to memory of 1992	2108	msedge.exe	93
PID 2108 wrote to memory of 1992	2108	msedge.exe	93
PID 2108 wrote to memory of 4696	2108	msedge.exe	96
PID 2108 wrote to memory of 4696	2108	msedge.exe	96
PID 2108 wrote to memory of 4696	2108	msedge.exe	96
PID 2108 wrote to memory of 6060	2108	msedge.exe	97
PID 2108 wrote to memory of 6060	2108	msedge.exe	97
PID 2108 wrote to memory of 6060	2108	msedge.exe	97
PID 2108 wrote to memory of 752	2108	msedge.exe	99
PID 2108 wrote to memory of 3272	2108	msedge.exe	100
PID 2108 wrote to memory of 752	2108	msedge.exe	99
PID 2108 wrote to memory of 3272	2108	msedge.exe	100
PID 2108 wrote to memory of 1068	2108	msedge.exe	102
PID 2108 wrote to memory of 3192	2108	msedge.exe	106
PID 2108 wrote to memory of 5908	2108	msedge.exe	107
PID 2108 wrote to memory of 4408	2108	msedge.exe	108
PID 2108 wrote to memory of 2792	2108	msedge.exe	109
PID 2108 wrote to memory of 2792	2108	msedge.exe	109
PID 2108 wrote to memory of 1092	2108	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-23g7ty.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x2c8,0x7fff4b21c188,0x7fff4b21c194,0x7fff4b21c1a0
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,18428677335333415089,1151325150970287293,262144 --field-trial-handle=2468,i,9514902319993862083,16174670144805788951,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,6457015725756822167,14534777985199058959,524288 --field-trial-handle=2468,i,9514902319993862083,16174670144805788951,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,3899585017371825599,7232090569326787901,524288 --field-trial-handle=2468,i,9514902319993862083,16174670144805788951,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:13
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,9840618808355961019,11118422682548596059,2097152 --field-trial-handle=2468,i,9514902319993862083,16174670144805788951,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,8680654008508925032,2289665484526940058,2097152 --field-trial-handle=2468,i,9514902319993862083,16174670144805788951,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,17448134126192704375,17167926015701878298,2097152 --field-trial-handle=2468,i,9514902319993862083,16174670144805788951,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4400,i,14498019618389599375,10964106207852529121,2097152 --field-trial-handle=2468,i,9514902319993862083,16174670144805788951,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:9
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3892,i,681561768466974517,5764097775913656203,524288 --field-trial-handle=2468,i,9514902319993862083,16174670144805788951,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,6544182015729010902,18008265057747884270,524288 --field-trial-handle=2468,i,9514902319993862083,16174670144805788951,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,7086823735651796062,4595620345600352166,524288 --field-trial-handle=2468,i,9514902319993862083,16174670144805788951,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,7086823735651796062,4595620345600352166,524288 --field-trial-handle=2468,i,9514902319993862083,16174670144805788951,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,11826354950509817366,1478552253432619863,524288 --field-trial-handle=2468,i,9514902319993862083,16174670144805788951,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,1624369445402498374,111690008560435789,524288 --field-trial-handle=2468,i,9514902319993862083,16174670144805788951,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,6435015900984902216,4366198071370650141,524288 --field-trial-handle=2468,i,9514902319993862083,16174670144805788951,262144 --variations-seed-version --mojo-platform-channel-handle=88 /prefetch:14
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,9198464084223343807,16802728704527110225,524288 --field-trial-handle=2468,i,9514902319993862083,16174670144805788951,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6364,i,17585071192980607948,10169089961121455802,262144 --field-trial-handle=2468,i,9514902319993862083,16174670144805788951,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5c3691b2e9c18fbd6aba620fc1bb24d760f28aace0321e6d5ece0e219339f067
MD5 f85eb4b88a0fa94d4d4196118174208b
SHA1 b16e3f0f4837b9aeb61b4abb48cef797fc094464
SHA512 870ae64dc65dd2fb4a77f19500236ec6a2746ec80af87e5fafbc89cf07c8f9d42dfa0afb31e0d1790bcc79f50758d8b8314d562c082808f3a37f5c57d138aadb
TLSH
T1E351A5519AE04096F3E78073C6E4AFC7B7336D812683DE261EAAE8BC59423174458E82
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5933f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5933f7.TMP
Size 2KB
SHA256 1b166a8c0dc4bd2086728b6ee8ceb481dc618f8948c288359c3566bdcf2323f4
MD5 36ee6d4e75d0feb437d5b41ab777d602
SHA1 5da8b511c4288735a787bf8bb2eb1f4a68a8f82c
SHA512 292f0a16c58067365b043ed9df50c4a2ca7e21a87965c0b07dcda97f0a2c030a7d5357fb6bdea621b21d15be36ed87d74fdfad9fb527273dea9bde5e6dc4ed0b
TLSH
T1F951B6119EE04096F3E78073C6E4AFC7B733AD811683CE361EABD8BC58423134458D82
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6c0be93de40eeb691751194681b895e9a55b932cb695f007812ebe12cbd53e2e
MD5 11d9b53acd8227cb0ca47ae25a5d01e7
SHA1 33497889e0701b549237b5a01ea305fd1aa39ba8
SHA512 f44be4444cda4ff86bd4c9a901b142de00c5567980f1a532e5dd38bc8404a9ed58bcda0c7655fdace95c6512a791af60d221e7718f240772059d08dbcb4e188c
TLSH
T19641CEF7C7E4867D890196F0AB14AE2BCE2C0915432C3D5AC9E4AE1B93E28B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8801532c681b98a9580d5e47aeca536675aa424688a35cd8382651dc269a8dea
MD5 e801ddd36a10e8eeb70fc421b94b0244
SHA1 0b936904a8ece17575761c80306460676a0907ab
SHA512 0f56288547ebb2d113602169415db181af44f6dcf9f33a430ee6d2503c1c2ea420fe585fa271f4058bbb12340c2ce741885f8c4bba1a093f57eab7804c6f71f1
SSDEEP 192:sxRmRebc/feXs3qrVi/zoA8p4l/g6+WNIYx+qU6GMIgDnJ:sxRm2c/fWs3eiW8/5I+UGN
TLSH
T10032C615AE28A97B8CC7E21DBB55BF53D6F9103260951E48B6FCCA1C00E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 25e4ce3f806d5b17ae611a7815d2ec25e10e1eda6cd9d1027c8839f4632bb98a
MD5 e0ba3d904292e1222ceb54f7d7760bb1
SHA1 8ae4d7dbcd50745c138b27b709de08f0fda6a3f7
SHA512 a93c90bfebeeed592e904faaba3ae9796c6563360f6e5f811e4197d571dfb856c1cd70de002f400c6588f08febbcfcd0c771f5ffe7e2cc30c60f2115cf220f4e
SSDEEP 192:sxRZRebc/feXsbqrVi/zoA8p4l/g6+WNIYxsqU6GMIgIJ:sxRZ2c/fWsbeiW8/5I2UGs
TLSH
T11A32B715AE68A93B8CC7E21DFB65BF53D6F91032A1951E48F6FC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ce3b087189cd0509245f9571a4d2a909d0615568483c4316dc120cccc5b61b88
MD5 51dbc124bf8d0f79d715a0191a8c027a
SHA1 d889b264a925c993cb7b79ed1c68df64d5b51417
SHA512 842f9ea9a18c1851eb3bd2f26f2c2bbe6b5d7000c5f82b62f8bd7c4cec806fbeeb3468d4fdb4485d41ca4fe61634048bdc6f6269a9583075a3abe9538da67c40
SSDEEP 192:sxRmRebc/feXsAqrVi/zoA8p4l/g6+WNIYxsqU6GMIgDRJ:sxRm2c/fWsAeiW8/5I2UGf
TLSH
T18232B715AE68A97B8CC7D21DFB55BF53D6F91032A1951E48A6FC861C04E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 f81fe460fb55a7b0bc968985335b564e4ad71acc9aa424cce888a95605a233f3
MD5 909bb237f9c3164ffecfa19270e4472d
SHA1 c8198d9b048a93181621f2cddcfa5e70c04a19b3
SHA512 5c1b1068d4da66135491676dc75cd8ec566b46e2a36fb23413b2977cd47aa1dd666f4442163b2ef550a83f81b8629120d70facff605bdd7c4449721aca010973
SSDEEP 384:z/ZDnwZfCtgbRFfkWKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVnL9K6RMZsrowg:zBDnwFWgbjfkW8F1+UoAYDCx9Tuqh0VJ
TLSH
T1C7B2C92B644DCB7F8FC00AAD9C196F9B7D9802C79A548D4047FE994C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a3f813e5f8a360fd0a7a549961008e3739cfccd1edeb38b266441fde2885c69a
MD5 b41e1cd98768a59e506138416b1256f4
SHA1 ab03d64d2b480723a98caf9e7b4f2fee98ccfb69
SHA512 c8d670ee759b27d1eef4f1f144dcac2bab8362437a50b2d7ba24d18fa4dd81d4f2ee1dd6ca929e17b8e14203f77b6fbab7496addd9c64354a608e410c462d8de
SSDEEP 24:KXx1ctOmrXJVHYd7aeIZhHKeQhmPH10bXSypsccFMyXeteJclIfK5h61ySsf4mJy:KM0IzKtaMHyZuIfK/6UHNI1KOY4nINKJ
TLSH
T1E291D225323B5242787E3524A5E4B76F178731933434E96B7BEA14A24EA7E044CFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59cc5e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59cc5e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 445defe7d9fc35c820d9be945328be59db0df6f4ddbe6e75f72c3268d1103283
MD5 589103ef6eef76931d02cfb6d1c87d29
SHA1 f4d6b56411da0cb345c10914625d105512abf953
SHA512 03ef993eabb95b0fd8e9f5759ffc9c5653719e9dbb16449d672268a8d59885f30f53b27214c9900572712260a86275f0620fa7e77d1e8196083846f66a22f631
SSDEEP 768:BC3k6T9TOfzfM1rtyfM1LyJYe1ELsAvC8/YEI+2s7p8:BC3KfzfMSfMuYe1EQujYs2sd8
TLSH
T1C7F2AE72DCB4C97B6CF29689B2452713BFF4811395C88B94D6DD270D0583AAE534FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 c88e7aa4dda431bb41f2fe19932ff3d998359728a51a90b928308d565170db3e
MD5 faa026300c95ce4496d4c5a277c3d963
SHA1 0dd6703d90ab88a6364cf7308f60531f507a68d9
SHA512 8eb91c9c87cd3a6ae3465d6da71f4927b2cea42260523428b617820705c850d8cc95afa358bf193fd1774a9194652434b8a31dea08de1f65f3f9edb063a19686
SSDEEP 768:k/UxvxjgC+33U6T9TOfzfM1rtyfM1HyJYe1ELsAvC8/YEI+2s7S0:RZj3+336fzfMSfMaYe1EQujYs2sm0
TLSH
T1AE03BE36ECB89C375DF2A684734A1353EFF4851390C85AA896DD2B0C09C76AD534FC5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 37fef536d6d1978e696424de13d074fd0822b1daa147a3ffd60aae92e4668a3f
MD5 abfa486698e7b31459d0cb8363c7d034
SHA1 a1a65856d3e3547ebc54296b59682ba282bf5a28
SHA512 6a3f6105dbfee1ea3e52c9361b0f8deab6a486853512d38c756192debe19d1bb2119322d486c459464fb79dcf40dd0b748a6e807aff77f6c8c51d80c7e2bbe53
SSDEEP 768:MC3r6T9TOfzfM1rtyfM1LyJYe1ELsAvC8/YEI+2s7p8:MC3pfzfMSfMuYe1EQujYs2sd8
TLSH
T195F2AE72DCB4C97B6CF29689B2462713BFF4811395C88B94D6DD270D0583AAE534FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 8aa72b7e09928ea0d94dc3ab1b840452bb9293e16dd6b4d659bbde2f9fc0a5f9
MD5 e1a4a49271680d7cee830f397349a9ae
SHA1 cc4963daca58dcefd5e010cb5a551facd89c2ad0
SHA512 14d9cda394b17fe0b4260418774ca7625664ab3d6e6286a8dec1621a6ce9237db29724a0d1aa36dc0f85a3e246717d9e5e80d845137e57d708a68d53a632f6ee
SSDEEP 768:AFQg3Qwg56T9TOfzfM1rtyfM1CjGJYe1ELsAvC8/YEI+2s7p8:zg3AfzfMSfMbYe1EQujYs2sd8
TLSH
T131F29D73DCA4C97BADF69B85B6492713EFF48113C5C89A94E6C92A0C00935ED134FC6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 48039a602afa8269dbd752bbe95ebbcce86b8513299e67ef28d2d733a11520db
MD5 717358266be11e770c006a54a8534dae
SHA1 5e8febaeb2778d0bf4f135c3b712893edcf0ad68
SHA512 b2011dc03314c365263c31d7de56138a85cdb583f02c8e3b1b4c367b1d1fab11a5c5c17720a2ff7feb23e9d73c79d8182caa94f2701aa5a9e692f6d06185d90f
SSDEEP 768:h/UxvxjgC+i3yK9TOfzfM1rtFKJYe1ELsAvC8/YM+rSHrkw:0Zj3+i3AfzfMKYe1EQujYvS4w
TLSH
T15A03CF36ECA48C775DF2A788734A5757FEF4812394C45AA886DD2B0D05C72ACA30F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d5b225e-f95b-4e2f-b876-18edbb2f5387.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1d5b225e-f95b-4e2f-b876-18edbb2f5387.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download