5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 13:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-sldkz5.htm
Size 194B
Sample260930-q5dh7ashrc
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5968	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{7B6B0C17-3CBD-46E9-8C6C-65562C7FD865}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 4964	3948	msedge.exe	89
PID 3948 wrote to memory of 1176	3948	msedge.exe	90
PID 3948 wrote to memory of 5968	3948	msedge.exe	91
PID 3948 wrote to memory of 1176	3948	msedge.exe	90
PID 3948 wrote to memory of 1176	3948	msedge.exe	90
PID 3948 wrote to memory of 2516	3948	msedge.exe	93
PID 3948 wrote to memory of 2516	3948	msedge.exe	93
PID 3948 wrote to memory of 3772	3948	msedge.exe	94
PID 3948 wrote to memory of 3772	3948	msedge.exe	94
PID 3948 wrote to memory of 3772	3948	msedge.exe	94
PID 3948 wrote to memory of 5924	3948	msedge.exe	95
PID 3948 wrote to memory of 5924	3948	msedge.exe	95
PID 3948 wrote to memory of 5924	3948	msedge.exe	95
PID 3948 wrote to memory of 3444	3948	msedge.exe	96
PID 3948 wrote to memory of 3340	3948	msedge.exe	97
PID 3948 wrote to memory of 3444	3948	msedge.exe	96
PID 3948 wrote to memory of 3444	3948	msedge.exe	96
PID 3948 wrote to memory of 3340	3948	msedge.exe	97
PID 3948 wrote to memory of 3340	3948	msedge.exe	97
PID 3948 wrote to memory of 4760	3948	msedge.exe	99
PID 3948 wrote to memory of 4760	3948	msedge.exe	99
PID 3948 wrote to memory of 4864	3948	msedge.exe	100
PID 3948 wrote to memory of 4864	3948	msedge.exe	100
PID 3948 wrote to memory of 1128	3948	msedge.exe	102
PID 3948 wrote to memory of 2820	3948	msedge.exe	106
PID 3948 wrote to memory of 2360	3948	msedge.exe	107
PID 3948 wrote to memory of 5604	3948	msedge.exe	108
PID 3948 wrote to memory of 1280	3948	msedge.exe	109
PID 3948 wrote to memory of 1280	3948	msedge.exe	109
PID 3948 wrote to memory of 2292	3948	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-sldkz5.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ff93465c188,0x7ff93465c194,0x7ff93465c1a0
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,13796177590004109223,12006483766191595615,262144 --field-trial-handle=2156,i,798861772500377504,4439502941219924588,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,18365133659453548963,7111150724306738823,524288 --field-trial-handle=2156,i,798861772500377504,4439502941219924588,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,6806351976673920795,9096691412221502878,524288 --field-trial-handle=2156,i,798861772500377504,4439502941219924588,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:13
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3304,i,13951180915555053694,13996014909200755336,2097152 --field-trial-handle=2156,i,798861772500377504,4439502941219924588,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3320,i,8586382501298216415,4245164105524953089,2097152 --field-trial-handle=2156,i,798861772500377504,4439502941219924588,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,14365735887906778694,8079490389871049917,2097152 --field-trial-handle=2156,i,798861772500377504,4439502941219924588,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,6518759501373209333,5314342605505072165,2097152 --field-trial-handle=2156,i,798861772500377504,4439502941219924588,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:9
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,2367071045015128982,188214668905646910,524288 --field-trial-handle=2156,i,798861772500377504,4439502941219924588,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,12580404500777763226,7202667036276323307,524288 --field-trial-handle=2156,i,798861772500377504,4439502941219924588,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,6831375039070998428,16804478640098216120,524288 --field-trial-handle=2156,i,798861772500377504,4439502941219924588,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,6831375039070998428,16804478640098216120,524288 --field-trial-handle=2156,i,798861772500377504,4439502941219924588,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,17467116194170880128,6515573115253856056,524288 --field-trial-handle=2156,i,798861772500377504,4439502941219924588,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,11976716058306232764,173400735749136091,524288 --field-trial-handle=2156,i,798861772500377504,4439502941219924588,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,16535022295834372078,1463562077404521067,524288 --field-trial-handle=2156,i,798861772500377504,4439502941219924588,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,1128123305297924763,12957348904676404367,524288 --field-trial-handle=2156,i,798861772500377504,4439502941219924588,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6692,i,6273519021971973757,15123979567543803256,262144 --field-trial-handle=2156,i,798861772500377504,4439502941219924588,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 be5d019cb7dc20c700a1dea9c9f09c7f382fdb30760d02005b7bef7ee280988d
MD5 aeadaa60ce3edd9938e2306fd1b26160
SHA1 e40aec6816b7b6fc932447e3bdbfe92409fc0870
SHA512 995e5cbaf33b0944bb01b583a5c3c2193e01596be2637a02b3b629200d45fdfd380f5535b0c4bba9a74e6dcf6b1d8c4858dc2b3cb6e283fff0d10feda6fbb38e
TLSH
T168514F85A2B884B5EFA84476E3F21AA33A74FB7D58C31E720F94DC7A87E63CB0104144
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c1769c744f22825a3f66b837037a3c73074c4c09185fce25677495c00ef070ba
MD5 1b0fc752a3aef3b3457c86f154975e24
SHA1 eda04eb1129f94a26b5d467e27ad5e7ad27622ce
SHA512 82378f4af5f313edf3339a9c46b01f99e038b331c39688b95e13a276da94bc9918ff25776ec4cf238171d8e350d0de2010b1cccb3573ada841bde01ef95c522f
TLSH
T15531C0F7C3E8967D890195F0AB186F1BCE2D0915831C3D5AC9E4AE1B93E24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 947aefc6be97d008d261bc88ec6020912279c9bb71dc6c3c5030735a4328cfa9
MD5 5f3537a5c56ff5064f030f901f7a2c37
SHA1 ca03e2f3beda023cd62c3dda663a22354b14b5bf
SHA512 b9df8fbb0ba55621eb19bd4be5634d24a2eed2cdf94eb3b556595ee99abb5a97555022909b15ec741cbd489d7905867c448fa32d5849727c3831cad625097a8d
SSDEEP 192:sxRjRUbB/fkscKQ7R73YzoA8p4w/g6+WNIYlacinvGgIgD6J:sxRjIB/fks9y73hF/5IH9a
TLSH
T1D732D615AD68A97B8CDBD21EBB657F13D3F95033A0811E08B6FC8A1C04E76CD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 794d07c6ab7dae234e5ba5f0418221ecaaa4246cc828a424eb0f305ac9f13f2b
MD5 4372015bc9d5088b267c1b59db68b860
SHA1 b05b628c8887153f4445776ed1ba0c97d57025e4
SHA512 f565cfb6bb1a92d709aad9269011b0957cee2e7f5bf6fe58c8ed4f199118d57e791c7cce9d239a9527abead536a401598714e4694d39a2a008860cb10a3e248e
SSDEEP 192:sxRcRUbB/fksiKQ7R73YzoA8p4w/g6+WNIYlac+nvGgIgIJ:sxRcIB/fksDy73hF/5It9s
TLSH
T1BA32B5156E68A93B8CCBD21EBB657F53D7F95033A0941E48B6FC8A1C04EA6DD520780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 941b701b47992bf0c8f04c04114754b43c096d3650fdb292009d20af975a4ee5
MD5 c207eaf63dcb0386cff49401bc5ceded
SHA1 091e41e9fb16fa832d84b622fd8f2f9e7b9cdf67
SHA512 33353850bf4e611fa87e2b4250b7c04f89a19bf0fccd722b59100d9dfcfb42c90ebbf87f6643ef2a9ef4fec39f6f274d71525b2bee87bdd9a41134ca9c90aa4f
SSDEEP 192:sxRjRUbB/fksDKQ7R73YzoA8p4w/g6+WNIYlac+nvGgIgDoJ:sxRjIB/fks2y73hF/5It9Q
TLSH
T11632C615AE68A93B8CDBD21EBB657F53D3F91032A0941E48B6FC8A1C04E66DD520780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 bd513b92c792b5edea85df23a54dcc2f6b3490eacc04c86ec5fcacb9a3557ad4
MD5 ab6c21bff779aad2a4cdb818297f3aac
SHA1 d8422adc2b714d9abd857ac95383f031285c0e5a
SHA512 e7e1e626de8172d411c5282a2f0bac3d3800f10718731b0411e92b78e90fa48652f3473c9b46159aabb0a1611a2c16a7e997b8f83661d1879c1f3b4fb3e6f154
SSDEEP 384:kWdRdcVfCtgSQFffTKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV4A9+mRfTroe2P:ksRdcJWgSwffT8F1+UoAYDCx9Tuqh0VL
TLSH
T11AB2E93B640CCB7E4F814AEDDC196F976E9C02C79A588D8047FE994C02C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8cfdb7126ee785497d73c1fb9551decd4cf2c1f256aeee2118510fdf9543982b
MD5 b25ac2d988b3939f50025b550d9bf4bf
SHA1 54780b86b38b7e78c8fa94bfe3469e73823fcf80
SHA512 5dbb5da41c1f3bed9111818275a12bd7bcd4f59153a0d30fd05847066b14eb2ae094736eafea30ad88a95da2c743da5ccb1b9578adde94b339bc18a03b3d671f
SSDEEP 48:K0dcRtfLPwbD2jISlwK9l1Hwx1gYmnddyLNsh9P7/gbTmzIS1gK911XgxlwY23XM:KMGEKLa2KmoKHKYTSKIgil
TLSH
T1D291AF11B57B064078BD29888168C72F524232B63019FA6FBFBD10B68F6AE145DFE5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bf40e2c9-77f3-4d72-8909-e00dfdf6aa11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bf40e2c9-77f3-4d72-8909-e00dfdf6aa11.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f906dbd1-cfd6-43d6-8471-4177ca0225ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f906dbd1-cfd6-43d6-8471-4177ca0225ef.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ea68e60-85b6-4346-9d2c-9de843b79196.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4ea68e60-85b6-4346-9d2c-9de843b79196.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 4925dc8957d8aebf5417910c9a3e92e76c36134ef744b24c147a3d6fd0b22149
MD5 66673f0f43399cc84de5d9df52fb0f1e
SHA1 4b6cc3eaaf94fe6baa6610e680f22aea97a81baa
SHA512 a30a7ff5bf1861d4e00ea5e1a00757f2dbd40e902092db111afbc0e68f680b003b2cd308fbf86f2f398a0744028bcb7cfc00c816c5a1de8b67bb7c0361a6798d
SSDEEP 768:NI3CtYwSFaju2EsnqMwQi5BgK5/CwYcZB2slpK:NI3CthNVmBg8/dn2sTK
TLSH
T158F2AE32ECF08EB75CFA8245F2867346AFF49257D599099484DE5E0E069B9EE030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5a5f680555cf8b1dff9c621c0cfe074bf7fe5f57bdd1a4f5c9133e4448047a28
MD5 b0eb76b3aa1f9bb5daa9560fcf55d511
SHA1 48b2b8fae00aa4ccbfa8bce3992a5cea3dbdeedb
SHA512 38af6a4e2e0879e9d55bd4e3f484e76114be0ee896b53a3094817897d00ee390a2178fc60a9f9d2b3472500968ccf6a49543ffc1302b6976f416298d45b82057
SSDEEP 768:n/UxvxjgC+l3ythwSFaju2EsnqMwQi5BgK5/CwYcZBoNC:aZj3+l3ytKNVmBg8/dnoNC
TLSH
T10203BF32ACF49D7758F69254F2466387EFF45663C4C508A849EE5E0E068BAED430BC4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 9ccaebcf939314b178af5799f8b69b1793e8a78ca9f77313fbaaabe260831e80
MD5 73ebd651189a3a965517a231f83c05fa
SHA1 732b41694a1bad6b3915a4ce5d7747d2e2ce698d
SHA512 568d71487ea9716d8fdd3d79de3c3234ba1df09372f163a1bf7551f19e219aad997fd4821dd7c9bb518c1bd7f3959b7cbaacec52729355cd3cf9e5707153d7eb
SSDEEP 768:7I3ntYwSFaju2EsnqMwQi5BgK5/CwYcZB2slpK:7I3nthNVmBg8/dn2sTK
TLSH
T1E7F2AE32ECF08EB75CFA8244F2867346AFF49257D599499484DE5E0E069B9EE030BC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 1647361d164b655b6428c6ee8f383b2c222eb3ba6bc9cc708e9b00bcca6d3eea
MD5 28ab57a26d10a6c466caf2b76b512f90
SHA1 e4ccdc7969cb2d4db6875b68635b5e0ac7fae3cf
SHA512 485ade9e9a1ffae113543c4090195f314e706633a344b7fc77da022ef9fdbe89d30052327f6e885423515834483574510afc79a63260776aeba7247646e1460e
SSDEEP 768:AFQ93dwgktYwSFaju2EG2nqMwQi5BgK5/CwYcZB2slpK:z93YthZ2VmBg8/dn2sTK
TLSH
T1CEF2AE32DCF0CABB6CFA8684F6867342AFF052A7C49A859495DE5E0D01978ED034BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 6c453d8b4c720ebe5a063dc2f64c278624a5f886c96e6fad2f149f0f18d0a044
MD5 5da0164ccd0dd92421e3d8b479aed1fc
SHA1 d9f8fb09bf67d478bd61851c9e9686f9c30aeac6
SHA512 c1971621dcdca4812adde433f21a3dcc563015240e0dec0967e814d2d440566aa9de7cf8a2b05fa33e9228822816e57b467aa8d83331f7b0ee3c914e8a6a9f88
SSDEEP 768:O/UxvxjgC+Ft3SqPSFaju2wnqMwQi5BgK5/CwYclLA8Dea:DZj3+Ft3SacVmBg8/d5A8Sa
TLSH
T12403C036ECF49E778CFA9244B74A638BEFF451A3C481099489ED1E0E06979AC530BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f1c3255-50fa-4c37-92b1-9ae125659128.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2f1c3255-50fa-4c37-92b1-9ae125659128.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/1128-172-0x00000233D4B40000-0x00000233D4EFB000-memory.dmp

Download

memory/1128-163-0x00000233D4B40000-0x00000233D4EFB000-memory.dmp

Download