c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 06:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-63gfrv.htm
Size 34KB
Sample260930-hpnefssye1
SHA256 c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d
MD5 966cbc85dbef6cabdbdc9c7e5496cc81
SHA1 a975b1e21c10dd0dc8fa0dc9ecc3984ca1aaf500
SHA512 4385a6988471168604246748dec63ed3bcfeecaffa1948583072d992edad73d6943a08af0c354e6fcfc007425da662357166b6909fa654e104b78c0e97c38a71
SSDEEP 768:3srOAOH3uia5QeAE4rYyH1UeH+NypaNJiA9Ky:39AOH+l51kYyHeNVJAy
TLSH
T15AF2E65356D19D37066392F5FCB8BD2C95CA8D0FC248AC04743CAA0C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2280	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{2E13A869-FF50-4F2F-88CB-396D49D06EC8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5952 wrote to memory of 3304	5952	msedge.exe	89
PID 5952 wrote to memory of 4564	5952	msedge.exe	90
PID 5952 wrote to memory of 2280	5952	msedge.exe	91
PID 5952 wrote to memory of 4564	5952	msedge.exe	90
PID 5952 wrote to memory of 4564	5952	msedge.exe	90
PID 5952 wrote to memory of 1836	5952	msedge.exe	92
PID 5952 wrote to memory of 1836	5952	msedge.exe	92
PID 5952 wrote to memory of 4488	5952	msedge.exe	93
PID 5952 wrote to memory of 1092	5952	msedge.exe	94
PID 5952 wrote to memory of 4488	5952	msedge.exe	93
PID 5952 wrote to memory of 4488	5952	msedge.exe	93
PID 5952 wrote to memory of 1092	5952	msedge.exe	94
PID 5952 wrote to memory of 1092	5952	msedge.exe	94
PID 5952 wrote to memory of 4584	5952	msedge.exe	96
PID 5952 wrote to memory of 3444	5952	msedge.exe	97
PID 5952 wrote to memory of 4584	5952	msedge.exe	96
PID 5952 wrote to memory of 4584	5952	msedge.exe	96
PID 5952 wrote to memory of 3444	5952	msedge.exe	97
PID 5952 wrote to memory of 3444	5952	msedge.exe	97
PID 5952 wrote to memory of 1656	5952	msedge.exe	99
PID 5952 wrote to memory of 1656	5952	msedge.exe	99
PID 5952 wrote to memory of 2724	5952	msedge.exe	100
PID 5952 wrote to memory of 2724	5952	msedge.exe	100
PID 5952 wrote to memory of 2808	5952	msedge.exe	102
PID 5952 wrote to memory of 3564	5952	msedge.exe	106
PID 5952 wrote to memory of 1124	5952	msedge.exe	107
PID 5952 wrote to memory of 2692	5952	msedge.exe	108
PID 5952 wrote to memory of 3336	5952	msedge.exe	109
PID 5952 wrote to memory of 3336	5952	msedge.exe	109
PID 5952 wrote to memory of 3276	5952	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-63gfrv.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff993fdc188,0x7ff993fdc194,0x7ff993fdc1a0
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,12153164757231548870,1812614739276304022,262144 --field-trial-handle=2384,i,12591639228772692276,4933309012665453758,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,1461599106254401492,10636023692506671385,524288 --field-trial-handle=2384,i,12591639228772692276,4933309012665453758,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,14260859433478386462,9306662141865418804,524288 --field-trial-handle=2384,i,12591639228772692276,4933309012665453758,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:13
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,11463637971268617125,3098097733523689441,2097152 --field-trial-handle=2384,i,12591639228772692276,4933309012665453758,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,3837954692566235480,5391297836981976390,2097152 --field-trial-handle=2384,i,12591639228772692276,4933309012665453758,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,3342854890663983495,14687416039331901534,2097152 --field-trial-handle=2384,i,12591639228772692276,4933309012665453758,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,13646283159800807004,6679786933704452972,2097152 --field-trial-handle=2384,i,12591639228772692276,4933309012665453758,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,16108291647272123053,10431047749911119808,524288 --field-trial-handle=2384,i,12591639228772692276,4933309012665453758,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,14510552910038953563,16381160288494346451,524288 --field-trial-handle=2384,i,12591639228772692276,4933309012665453758,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,11371029043050011956,5149763203830881469,524288 --field-trial-handle=2384,i,12591639228772692276,4933309012665453758,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,11371029043050011956,5149763203830881469,524288 --field-trial-handle=2384,i,12591639228772692276,4933309012665453758,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,14117062718893936023,10159641959093876748,524288 --field-trial-handle=2384,i,12591639228772692276,4933309012665453758,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,17517874958762216231,9266492449705473040,524288 --field-trial-handle=2384,i,12591639228772692276,4933309012665453758,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,8769432100093541365,10825297611533182393,524288 --field-trial-handle=2384,i,12591639228772692276,4933309012665453758,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,4657266490237872979,10811650484161017835,524288 --field-trial-handle=2384,i,12591639228772692276,4933309012665453758,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5892,i,15506669122586811719,10400378458159622125,262144 --field-trial-handle=2384,i,12591639228772692276,4933309012665453758,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f7d19582aa111269ba66ec22ea2144e2462c0a95b55fe7fa8c8d3cf32ca966e7
MD5 f8837bee0124038cbdeefeddea293eaf
SHA1 598e42a3b542f2d97f710503be23841d6921555d
SHA512 139b12f9361f09eada5d7af725a2fcbcba7c4d793d395884162056b57dbecd085c4da6983ca8b459b6adfbfa2007578add6d24116fd98781c373f79227c95f8e
TLSH
T198513BB057BB7C65E75C36B3A7D00CAE3E3728BD58831EC205BDFA3015867224280698
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59711f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59711f.TMP
Size 3KB
SHA256 0ff7f7bf4ce79214117683fae1c6201b3b00f0186bf1e0c733a8fd5184e2a2a2
MD5 dbf49df52cfb395d2dd366938c7b33f3
SHA1 5a373012bab227af4304597d4a48ec7e2640ac64
SHA512 320005574f56de69e0c954a1b403e03b458c20a2f367faa4947a9a04fbafb5e57d6e0904ccf776fe2568ed1093ffb3959e37adc078868922287939b2e275262f
TLSH
T169514DB457BE7C65E75C36B3A7D00CAE3E3728BD58831EC205BDFA3015867224280658
MD5 SHA1 SHA512 TLSH

Submit Download

8d3384be-cb13-4f27-a585-5a0f0c9d54ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8d3384be-cb13-4f27-a585-5a0f0c9d54ea.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5977a245-d984-4e83-b1eb-07561e9dcc89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5977a245-d984-4e83-b1eb-07561e9dcc89.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a8690fb0c494e4a449d614427cb50114b2c9ee49b7c0976bdbc5c864468a7147
MD5 e800b78a514b7ba527547793daa133e8
SHA1 bbc16e8967746200a4bd3302e7d3a0ee988957c3
SHA512 2dba9b8a791ddf6fb24c2fda4741de07960d7ffe57265a308cd0c79743e55a0973f68f280b660efa0761c490db65bbf7228fc03544654b1a1dfecefb67d6c130
TLSH
T1CC41A0F3C3E8867E890156F4AB146E1BCE1D0915832C3D5AC5D4AE1B93F34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c5e2233653e6d5ff2b42732d5762f6094781b6b9abc529a58efa71388a2b7f6a
MD5 447db819db59fb3a709eca7230fa9990
SHA1 0f5583d6ce474c3f0c4af0ff2eaa8437818d321b
SHA512 258ff1bb4178685062286142c74d082b45d227b62102f8c42fbc2f01742b89268bff423dee8b673b2002ad64fad7d21b297dbedfd4dc99bc399031c782a12104
SSDEEP 192:sxRWRtbI/fCsBGzoA8p4f/g6+WNIYueiC+GIIgIJ:sxRWHI/fCsB7i/5Ik2s
TLSH
T18132A625AE68A97B8CDBD20DBB59BF53D2F91032A1911E48E7FC961C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e2b3782530a7bacd68d0051eb3fa6cfb1678ae8e6a56b325d4a8eaef7d4ae0e7
MD5 8a256d79da069fb08f5a01002f70380d
SHA1 f1dfa410efd0927105f80b461decec783fb056a3
SHA512 0d39fad09e7b3446318a5c07408a4c3defb6ab906881cc6f8eceab67059411edddfc3ff4c6be545bd397b71b030bdfc7412eafb297966aa7c55546ffa086545a
SSDEEP 192:sxRtRtbI/fCsnGzoA8p4f/g6+WNIYuwiC+GIIgDUJ:sxRtHI/fCsn7i/5IO2E
TLSH
T1FA32A725AE68A97B8CDBE20DBB59BF53D2F9103261911E48B7FC961C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 cc907585619b2e08ff73ea05931db94289c3480314008d1c87e65195bd78410a
MD5 2116ca24b2d49b842d5508f23f66f574
SHA1 17cdf17dd34b9e1a7bc973631e008e2c4582a711
SHA512 55e2f8e622cfd6677a0560cc20e1a91add5e8ca133abc4101781e826ff8b3450d77abd71e7ad0eaa80c1765e447922afdbbfd2d3f8b2f79040b3d9762bb26cd0
SSDEEP 192:sxRtRtbI/fCs0GzoA8p4f/g6+WNIYueiC+GIIgDOJ:sxRtHI/fCs07i/5Ik22
TLSH
T17132B625AE68A97B8CCBD20DBB59BF53D2F91032A1911E48E7FC961C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 f82ed3bbe51774434fcb796c8d7e2316a1f3c15e8273609f8bb98aa8e68f31bc
MD5 c78a86e271d11d43260ade55c85dbed0
SHA1 1aec0072fe4b2eb73acce4c494fd38cbd927fdf4
SHA512 e301ac25def87da83fa7e87fed7ec4edf2fdac9b900dcda825f51aadfa13ca6ba836fc9b568e7a9eaa554b9914b7b8bbd965b50f3ffe22b1d10018c95f87d24a
SSDEEP 384:/7fnhUVfCtg6UFfCwKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXb9kMR6arocbJ:/jnhUJWg6cfCw8F1+UoAYDCx9Tuqh0V2
TLSH
T149B2EA2F644CCB7E9FC00AADEC196F976D9802C796988D4047FE994C03D77EA911A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 41d90e5f729a7a877f22ea8f8b8a1a5b9032dec3db00a86b2473f5d677138e06
MD5 09d23c9fb91b2741b8ca9264bc20f9dc
SHA1 c927beae8c182db5fdccddc3cc2219cdff20d866
SHA512 d3130e884766176f65d0ea3c525f4393c78b9710aaf960942047ddd4bcd2d640364f98bc42332959b086f3920d6aa7ce1359448343848b6d0ddd0f106c0a8842
SSDEEP 48:KUcIfKJGkLyVNIdKWIYnyBMI7K5KcPMZqGMq:KUcQKJGKONaKWICSMoK5KR
TLSH
T12C914525753A0A00387D290881F2972F894135A77178E63B7FEE50A78E76E044EFCADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

65bee719-9583-4816-9d3c-66edbfca2da8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\65bee719-9583-4816-9d3c-66edbfca2da8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 11c7b04ed6aa6bc0d2a882b23b3406e9bb05d9442bce41276ff7939fe24f9ae3
MD5 99b749dc39d65efd5c499858cd75505a
SHA1 1d10d414abd0009895c8d599d817b1b9281d0773
SHA512 00c5ac30b1f382473ff1ef82aebb53e2d115b5e5daf0e400ffd813a1e79e8569f2b6fcae071f259a3c386cd748c7ac88b969f68bd18c7aa5ab0c5314ad09a6cf
SSDEEP 768:rv3PBSO5P6rNeMIYNa8S5oYklnA+I4YGHa1:rv3tiyTWRdAj4YUa1
TLSH
T155F2BF3599E4A9B39CF6A3C5B60677426EF45213E1885ED489EC2F0E01C76BF1313866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8077d65e3e0e066ec27a06ed08b4c33e01271d15f3b9f845a08a0f283e873355
MD5 891d728cdb29b70dd5226eb51de2a70d
SHA1 c3f660d2851301274def52c1a53634e94365e4a0
SHA512 127aeffb75f3e2382a7cc8ef62617fca18f43349533f752ee4c23fa5ea960b2abeec57cec73a2665430739296929ad71dba10c6e95bc983dce664e1aa3dbc1d1
SSDEEP 768:5Ev3yBSO5P6rNeMIYNa8S5oYklnA+I4YGHa1:2v3ciyTWRdAj4YUa1
TLSH
T195F2BF3699E4ADB39CF663C5B20667426EF45213E1885AD489EC2F0E02C76BF1303866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 445184110aee490b2eb2583783fb88fd4897b50163150f3e3848adb908b266a6
MD5 13eaaad8fc7716b2a3e363f4f4dc8a83
SHA1 080f3c664b42d79a5cf877bc79d7e6e7ce4cbecc
SHA512 627cc6271636875a069e730a4feaded04131e257610e884d2b7bd301c2e91676e64a2a2f82db097bc1917b93f288daef3a867efeb1f0505e81e7f8e56a433052
SSDEEP 768:NFQI33wgXBSO5P6rNeMIYNa8S5oYklnA+I4YGHa1:cI3DiSTWRdAj4YUa1
TLSH
T18D03BF3799D8D9B7DCFA57C5F60A7302AEF14263D185AAD4DADC2E0E01871AE1303C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ed00228a78323453e8eb8bab905af19346fdbf59e50cdb2616bd0ea611e5b861
MD5 03596ddfd2b27c9a47dd69cb30a6f40b
SHA1 6a44e71fab5aa26ca6530ae4af803a9496dbee11
SHA512 3364c36dd5ae731484923c3fee866ba3440bca9715b8de58d537126ad09920886eb5bd3ab4d5de41cf4e0dffc1dad6af9dccb2c1ebacb11362e47518561a8f5a
SSDEEP 768:do/UxvxjgC+238f3SO5P6hJMIYNa8S5oYklnAaMSH8L4:nZj3+23+PihHTWRdADS04
TLSH
T1C403C03A9D94A9738CF663C4770AA357AEE55263D0C16AF88AEC1F0E17C73AD5303452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30e3eaae-5f6c-454d-93f8-6cda817510ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\30e3eaae-5f6c-454d-93f8-6cda817510ce.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download