3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 09:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-s879iy.html
Size 171B
Sample260930-lh7rastthz
SHA256 3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc
MD5 e082ebc14f6b24945336f6450b985e45
SHA1 df12ad35c265b0198582e2dc94e0a93048e4de82
SHA512 8dac8fb7101ee6a50ec58409a7d51009d9a3f6b1266377cad6f7f9001bc6f6734ffc067e7cfd0f17a1d0e288803fa8c8d37925590f6421772323ce99a4a9a1bf
TLSH
T1E4C08C7D10C13C150270A93C1DD3B397EC93198E01422B41308180232F35620CED32D0
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5928	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{C6FEA46C-CF63-467D-99C7-81E4BBB4A333}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5792	msedge.exe
5792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3164	3908	msedge.exe	89
PID 3908 wrote to memory of 2484	3908	msedge.exe	91
PID 3908 wrote to memory of 5928	3908	msedge.exe	92
PID 3908 wrote to memory of 2484	3908	msedge.exe	91
PID 3908 wrote to memory of 2484	3908	msedge.exe	91
PID 3908 wrote to memory of 5944	3908	msedge.exe	93
PID 3908 wrote to memory of 5944	3908	msedge.exe	93
PID 3908 wrote to memory of 4488	3908	msedge.exe	94
PID 3908 wrote to memory of 4488	3908	msedge.exe	94
PID 3908 wrote to memory of 2860	3908	msedge.exe	95
PID 3908 wrote to memory of 4488	3908	msedge.exe	94
PID 3908 wrote to memory of 2860	3908	msedge.exe	95
PID 3908 wrote to memory of 2860	3908	msedge.exe	95
PID 3908 wrote to memory of 120	3908	msedge.exe	96
PID 3908 wrote to memory of 120	3908	msedge.exe	96
PID 3908 wrote to memory of 120	3908	msedge.exe	96
PID 3908 wrote to memory of 400	3908	msedge.exe	97
PID 3908 wrote to memory of 400	3908	msedge.exe	97
PID 3908 wrote to memory of 400	3908	msedge.exe	97
PID 3908 wrote to memory of 1396	3908	msedge.exe	99
PID 3908 wrote to memory of 1396	3908	msedge.exe	99
PID 3908 wrote to memory of 4852	3908	msedge.exe	100
PID 3908 wrote to memory of 4852	3908	msedge.exe	100
PID 3908 wrote to memory of 3764	3908	msedge.exe	102
PID 3908 wrote to memory of 4392	3908	msedge.exe	106
PID 3908 wrote to memory of 1236	3908	msedge.exe	107
PID 3908 wrote to memory of 804	3908	msedge.exe	108
PID 3908 wrote to memory of 1060	3908	msedge.exe	109
PID 3908 wrote to memory of 1060	3908	msedge.exe	109
PID 3908 wrote to memory of 5792	3908	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-s879iy.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x2c8,0x7ffe510dc188,0x7ffe510dc194,0x7ffe510dc1a0
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,10517322706678031699,14085062902043068287,262144 --field-trial-handle=2308,i,12531257085992127826,8182077267039783505,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,6721763091237990378,6146375600110682654,524288 --field-trial-handle=2308,i,12531257085992127826,8182077267039783505,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,11227521381602703057,1800873157476252852,524288 --field-trial-handle=2308,i,12531257085992127826,8182077267039783505,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:13
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,13090166307985888467,10166085846630488488,2097152 --field-trial-handle=2308,i,12531257085992127826,8182077267039783505,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,13812419448486873767,17407072022432517333,2097152 --field-trial-handle=2308,i,12531257085992127826,8182077267039783505,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,12262497911956117826,17299910397711117226,2097152 --field-trial-handle=2308,i,12531257085992127826,8182077267039783505,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
  2⤵
  PID:120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,8546887657625500712,3581224580417822888,2097152 --field-trial-handle=2308,i,12531257085992127826,8182077267039783505,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,17022340757123397367,16156457631213074435,524288 --field-trial-handle=2308,i,12531257085992127826,8182077267039783505,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,7865623037556029398,4945797381866895564,524288 --field-trial-handle=2308,i,12531257085992127826,8182077267039783505,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,1618654590203009883,13226411302727064705,524288 --field-trial-handle=2308,i,12531257085992127826,8182077267039783505,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,1618654590203009883,13226411302727064705,524288 --field-trial-handle=2308,i,12531257085992127826,8182077267039783505,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,2226283503333178273,13210739592921788065,524288 --field-trial-handle=2308,i,12531257085992127826,8182077267039783505,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,11494423164869149815,2175206362908016332,524288 --field-trial-handle=2308,i,12531257085992127826,8182077267039783505,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,2706819130315978843,5488326918934955134,524288 --field-trial-handle=2308,i,12531257085992127826,8182077267039783505,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,5292169917573303180,371807225147348739,524288 --field-trial-handle=2308,i,12531257085992127826,8182077267039783505,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5820,i,15964712776835360773,12179613478581079936,262144 --field-trial-handle=2308,i,12531257085992127826,8182077267039783505,262144 --variations-seed-version --mojo-platform-channel-handle=832 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d38dc1c1699e9c1465c8cbd92d0f5c411a023ef4441dbafe7db1f3c8bf701972
MD5 ab983ea80c222b5a4441389c7608c51f
SHA1 2a8ad079298226d7299ffa8331d70fa9d12dc557
SHA512 d88af6ff75cfa91d575aba15bc29f48ac485865e7f946c10b49434ad90e627e6487a63e12a4b1e5498fa2e87c4a14e04a51260587fb9236f99e0f69b8242b962
TLSH
T1174187594FB0AC50FB68E178C6E00E873EB785D024C31E001766E5B86AE63BA4D98354
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5953c3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5953c3.TMP
Size 2KB
SHA256 b506551ccd96762ad81a1e902b13167e750266d7f1e8ad9e76e8131c61bdc790
MD5 b9109294788c98989076bc6d663e0649
SHA1 fcce1b5fdc35e3152d7a8100103d0acd7ee7810c
SHA512 c84fefb71425f3a07ec286b910cde03d533f16667209eebc809a14bedafc51811603fc9a0e1fc6d1a82c0f8dbc815428a0bbe878adbdfab11a5506ebdc58d78d
TLSH
T1BD4179594FB0AD50FB68E178C6E05E873EB785D024C31E00176AE5B86EE63BA4DD8354
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 222a35f6a4c6af8143503917a237fd97b4a996f73e34d122a48e08f63f399b11
MD5 b3bd7af84411fc6b2db68a2b71a7375e
SHA1 986223c285c0769544171282e28e096cb984ff91
SHA512 fa8bac87985edad2f8e7c1b6ac4bcd63cde72ce11d7fd0a8b0af2c9c8552299c9ddf0c9e2599fcdeb41010c38b082d31d2e4ececb8889fa1e3c949e478453a53
TLSH
T1DA41C0F3C3E8867E890156F4AB186E2BCE1D0915832C3D5AC5D4AE2B93F34B1D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 98817029e1147d512a56768bd3bdf92a75d0fb9294111f825f6922ec100dabe0
MD5 6158738464df60d2fe139bb83493492f
SHA1 89866212135de336cd62f75e0209205d9c934516
SHA512 ae7f7b20f75e2acdc26a2187727ca33d86e3a9dd5086948a42a79a0484335ca44125ce19162500ac5ed054eacf0d6a932534e54df13c8bde8088982575fabe21
SSDEEP 192:sxRLRiba/f4sc7zoA8p4r/g6+WNIYuMdQ+G2IgD/J:sxRLCa/f4sca2/5Itk9
TLSH
T10832B715AD68A97B8CCBD20DBB55BF53D3F95032A0911E4CB6FC9A2C04E76DD120784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1d98a3fc4638de96fc46e96596660c0fb57f60c624cf2941d494e55eea2eee8e
MD5 83900520c2d42301785ba5a19b3c62d5
SHA1 08a2e1c4a4241f07884572d016ca8a72d05a7386
SHA512 45d04ec9f54feaa6b551813e9b8955c1981ba37034a199b29e16020ec0f90084536edc10b17c23e8bf024f4c264b943df674ac8b4f0013d303fbc9fb0b4490de
SSDEEP 192:sxRYRiba/f4sz7zoA8p4r/g6+WNIYuedQ+G2IgIJ:sxRYCa/f4sza2/5ILks
TLSH
T11F32A715AE68A97B8CCBD20DFB59BF53D2F95032A1911E48F6FC9A1C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d0bf54d6c8fa08cebf6f6fb89aadc727c7aa5bb5c2c844069e804efbf3cbae25
MD5 9192e49c42610b830b14e332bd0ca120
SHA1 58d97d58c1419caa21602637bd6aa4c866ccc77f
SHA512 3f7ec2112aea445cf8a0760ba5a716772299eae008d710fd7d9440e6a85fef5274407bbb521b27948dd6bbd3aa90ec714a08c30ee59cdd9f946002022ec78985
SSDEEP 192:sxRLRiba/f4sC7zoA8p4r/g6+WNIYuedQ+G2IgDZJ:sxRLCa/f4sCa2/5ILkP
TLSH
T15832A715AD68A97B8CCBD20DFB59BF53D3F95032A0911E48B6FC9A1C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 fcd47a9b5a4833f002bce6f8a9bae157e8de0aca188f2ac7daa668c91392c161
MD5 a118a87e5b0d56c07e1011db97c0074a
SHA1 ba408524b59e0554a007df9d6edb327d2381685f
SHA512 61f3645b0fa3b45437f0032219f849607fd33a56d5a634a8cc426074d28243d201cae1f5d43b03268f5795844ffc4764798edb101a3620fb44af31848d3b181b
SSDEEP 384:/7fnhUVfCtg6UFfCwKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXb9kMR6Qrocbh:/jnhUJWg6cfCw8F1+UoAYDCx9Tuqh0Vk
TLSH
T10BB2EA2B644CCB7E9FC00AADDC196F976D9802C79A988D4047FE994C03C77EE911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 413fbb482ee78fa30bd29a423e232b6554f03f6adcea96128c135396c4529c27
MD5 1f889d5f14d7435814011057e7747f7b
SHA1 efe38452b95fa93d00c142bf5c284bbadb4aa936
SHA512 96a5c90a7e401a625c787ff93d89d0f2d140a3bb7ec4382dc0a5674e71a64cfe0e8777311c9fdef6d704e974a943a2e3c564599754ebc2ab67b0acd0f0e8ad54
SSDEEP 24:KaYroAqIlKIhw1GSt+pyXvYXAE+IlK0hA1GSROvCpzqfu0LwUwgIs6jIV+wKWDhw:KodIlK+wI3y1RIlKiAIWdIZKGMUbyp
TLSH
T1CE91F511713A0290387E651980F5A65F8A937253317CEE2B7FED10664E36E489DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 2bb0a7e3ff83761c7102f0b5f4d1a2449b5be27bd7d7d53b20bd10abc7feeedd
MD5 76a8acff5229a381bac29a7e819fe948
SHA1 a3ce060b1b0cdfb1969debfe48d1b036c9db5beb
SHA512 498c948d02de7615dce3789e05a55cbd3ba15c32973123bf1d54d5ddd2ff7b9f13a3e9414513ef7203bbae02fe7a7a7b557483e029454559a072cb1ce270ef2a
SSDEEP 768:hc3iaX1SO5Cj1rMIYNa8S5oYklnA+f2sZS:hc3ia5AFTWRdAI2sZS
TLSH
T1AAF2BF35A9E49DB39CEA93C5B20A73527FB05123D2C96AD8C9EC1F5D06872AF0307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 73e7353f467cc7fc1403f50b59241b9a001240eda7d6f3ad648dff6e5564d17c
MD5 84c837513e836f433c6debc0eed2f335
SHA1 f820ed9bb42275db586de11ec032a71662ff7715
SHA512 fa83854ea6fbd5789cc6e6d2bd6d9e1df587d40c9f783da1b7e4895d918d30f7e09acd0a03bc8a4c33149b0a06e15457832da38efbc9f11647057b76c738c06f
SSDEEP 768:5A/UxvxjgC+13k71SO5Cj1rMIYNa8S5oYklnA+f2szV:fZj3+13k9AFTWRdAI2szV
TLSH
T14A13C039A9E4AD739CEBA2C4720E6353AFB01523D1C56AE849EC1F5D07C72AE4307856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 edbea4ee4cb4a8456765c2e62db0efb2ca6044b997bf93699a55f7a50c45c1c0
MD5 332d9688a605d51b9a985603f50b94e7
SHA1 a457a0b80d5cc1b726a8b325350dfba1a627cd5e
SHA512 7301aca98dcc7a8144f9fa7d0aa6368d6c405332485029f65c19945cab25be48686ce3da683a1024895f7d798960517d37568aee96d14c9d6fc8a5ca0ab4e5b4
SSDEEP 768:5wc3jaX1SO5Cj1rMIYNa8S5oYklnA+f2sZS:ac3ja5AFTWRdAI2sZS
TLSH
T14AF2B035A9E49DB39CEA93C5B20A73427FF05123D2C96AD8C9EC1F5D06872AF0307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 77f0742b59206cefd35b420e329f565d4b4bc48e6aa27e6b20ec84edf602a4aa
MD5 02d22371c06715958ce16d658fd87232
SHA1 f9d1602a492d1d041faf046dedd9126cd70e6248
SHA512 cb0faffc360f869162eada6cb553a7be1fdb6645cf798865d89cacc796caaa7b561e2f29f27cc19a51565f87f59ebd74c281b843b21fb12472e33bda15127229
SSDEEP 768:qFQG3NwgIaX1SO5CjPDMIYNa8S5oYklnA+f2sZS:RG3Ma5M9TWRdAI2sZS
TLSH
T11603AE3699D4D9B7ACEA97C4F60E7302AFF04123C585AAE8D6EC1E5D02971EE0307C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bff59033cbb796ac570b8f5f7cdeb3d99c6c862df98c56c34779339e199fb2a2
MD5 2f866d483fc0c3b9b7d14f3d057be94a
SHA1 4989f15cf0d28819c35cab39b03e7c75deaf6b7c
SHA512 697e9a8d6b6513388aaa11fedb9020cf77441fb7737fc63537f7ad55bc52aa38f2024d81a26f4ec4a539de386f54a07759cbe7109da15db160971e72f520d1a5
SSDEEP 768:do/UxvxjgC+231fwSO5CkJMIYNa8S5oYklnAadPSH8L4:nZj3+23lIVHTWRdAqS04
TLSH
T15303C03AAC94A973CCF663C4760EA357AEE55123D1C56AF88AEC1F0E17C72AD5303452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b9d5a28-98d9-45f7-86a6-5c1f22b505ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9b9d5a28-98d9-45f7-86a6-5c1f22b505ad.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download