6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-nszwtn.htm
Size 34KB
Sample260930-sffclavv6p
SHA256 6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b
MD5 764f5df3b8d286714635f98cdaff2174
SHA1 6f65b07d81db9dcfdfe1482f1ba7a14977d87aa2
SHA512 323c8e03eabf4884fba35ca5253c79f370c09e0156bea23ca0e2c10d948e608a65b47dc8cca9450afb3a81a9c61ccb77d3ff7acd935d3658b61c415597cf2e13
SSDEEP 768:9srfAOHdia5Qe2E4rY0H1UeH+NypaNKiA9b:9QAOHdl5TkY0HeNVKJ
TLSH
T1DFF2D65356D19D37067396F4BCB8BE2C95CA8D0FC248AC04743CA90C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3992	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{39F54808-BF88-4D50-BAC4-6A836FCDCF5B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5352	msedge.exe
5352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 4164	2104	msedge.exe	88
PID 2104 wrote to memory of 4636	2104	msedge.exe	89
PID 2104 wrote to memory of 3992	2104	msedge.exe	90
PID 2104 wrote to memory of 4636	2104	msedge.exe	89
PID 2104 wrote to memory of 4636	2104	msedge.exe	89
PID 2104 wrote to memory of 3632	2104	msedge.exe	91
PID 2104 wrote to memory of 3632	2104	msedge.exe	91
PID 2104 wrote to memory of 3408	2104	msedge.exe	92
PID 2104 wrote to memory of 4740	2104	msedge.exe	93
PID 2104 wrote to memory of 3408	2104	msedge.exe	92
PID 2104 wrote to memory of 3408	2104	msedge.exe	92
PID 2104 wrote to memory of 4740	2104	msedge.exe	93
PID 2104 wrote to memory of 4740	2104	msedge.exe	93
PID 2104 wrote to memory of 2824	2104	msedge.exe	95
PID 2104 wrote to memory of 2824	2104	msedge.exe	95
PID 2104 wrote to memory of 2824	2104	msedge.exe	95
PID 2104 wrote to memory of 5288	2104	msedge.exe	96
PID 2104 wrote to memory of 5288	2104	msedge.exe	96
PID 2104 wrote to memory of 5288	2104	msedge.exe	96
PID 2104 wrote to memory of 2728	2104	msedge.exe	98
PID 2104 wrote to memory of 2728	2104	msedge.exe	98
PID 2104 wrote to memory of 2360	2104	msedge.exe	99
PID 2104 wrote to memory of 2360	2104	msedge.exe	99
PID 2104 wrote to memory of 3544	2104	msedge.exe	101
PID 2104 wrote to memory of 4536	2104	msedge.exe	105
PID 2104 wrote to memory of 1384	2104	msedge.exe	106
PID 2104 wrote to memory of 1868	2104	msedge.exe	107
PID 2104 wrote to memory of 2644	2104	msedge.exe	108
PID 2104 wrote to memory of 2644	2104	msedge.exe	108
PID 2104 wrote to memory of 6072	2104	msedge.exe	110
PID 2104 wrote to memory of 6072	2104	msedge.exe	110
PID 2104 wrote to memory of 4808	2104	msedge.exe	111
PID 2104 wrote to memory of 4808	2104	msedge.exe	111
PID 2104 wrote to memory of 5352	2104	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-nszwtn.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffaa0b5c188,0x7ffaa0b5c194,0x7ffaa0b5c1a0
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,5417706963830867543,13226961039253149517,262144 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,9050922526645653742,11672369250116210830,524288 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,2065971652859811588,9081923274473644870,524288 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:13
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,2330439134328190473,8223317260364906161,2097152 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,8392145839021085425,12616483573250564252,2097152 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,10182370936346481487,6882819188553676514,2097152 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,17658095416367286690,3359622261661001672,2097152 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:9
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,5717486111528491911,1364370916498549535,524288 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,8804471040289482663,1216546470094968332,524288 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,2630178265223135910,11449426543100461632,524288 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,2630178265223135910,11449426543100461632,524288 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,5512595646097130428,9515181301863449154,524288 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,1802521843360625210,13133240315062868294,524288 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,563492072635972262,8621362193696813040,524288 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,16291536602812381432,5721914071535905163,524288 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,6424151953538335482,12687497894914883572,524288 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4116,i,2711833577515530766,13322197305573182580,524288 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6708,i,17577924690737126562,12049605180078189837,262144 --field-trial-handle=2056,i,17841186204594713778,4223966793172897891,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0dc49ac55ef8b8dfdc0f1a06403947acd5ede81b78a4e55df2f19bc0d2206c2d
MD5 2b226609b17644b8e97c30fd06c658ad
SHA1 6994fbc61a006a428cf64a4985ae337ef36dfc30
SHA512 57fd2a7153cd7a6b33603a9e36e250425e74a27deb7dde029bab1adafaba8c4331bd05da6a19305dd453ebb58bf76be69f866ab1281e644df3676db963539293
TLSH
T186E020C446C6C37FD11C648741987B1C81C03B0ED6CC6E451B008489F042944EEC7DD4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 5a1412f0ac1ebd64bf2314f056fd92a3d75fc994113340e7f7e38a87358bf6e4
MD5 cd691e03a48c5e349fb419ba182a9e8f
SHA1 f085a6df69b2774e3b3183fb03817bd85005ed58
SHA512 5d4cf7b78946e5551d3a3aea99a167a2b3d483d20ecb02ef69146e51f486094574f36ebc580ecc2f21eb62e4651a5efd37ae8ee3910d3f3cacb183acd5af4f7d
TLSH
T1EC41EB828AC40044E7AE26F985EE3B7336B854BF4E731E012D68C876635776481C2BBC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 dfb32578219c3fa7ce2e526b2c9a4fbbf680234fd86c387985c35f722ff31b85
MD5 afa978535c52bfa6ebad2ca125b8a0bd
SHA1 33431c8c1a03ec58d3ac7fa570947d465c34d550
SHA512 074468bdd9b97d4ecb060a6a04b895971a266ae54feeba7b509c588fbc5990e22e0afe5acf0b79d5f3aa761095098705d9abee6bc6e3fed9b4eb2038260b7c56
TLSH
T18441B3F3C3E8867DC90156F4AB147E2BCE1D0915432C7D5AC9E4AE1B93E24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cd1a9f23f822187a77cc1bb3ca798e757008bf0feeac3892388eccd4c7237cd7
MD5 7bd20d0770975720567196be44fa2148
SHA1 48a65b1a26b446fc71545949d4702b14cf89f2c2
SHA512 8d9f80a2c2fbf5e00f687a01b27ca72b064b791fb5dc429ac275dd11355382d4642896c42bdafd788b98678a5020356e4d5809dcf00eebae36e720fd4fbc62d1
SSDEEP 192:sxRKR9bv/fhsrHRQ/zoA8p4W/g6+WNIYEI/+GeIgIJ:sxRKjv/fhsrBX/5I6ss
TLSH
T1C832C805AE28A93B8CCBD21DBB657F53D7F95032A1941E48F6FC8A1C04E76DD220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f043bece75cb577a13881268f2f48c4e0b52f7354bb3f182df178ebdbff54348
MD5 143e1a10bd63962b22351194387cf5f5
SHA1 52f1c1d6509be6149327f9cdb4074a27429cd9f0
SHA512 ccbc7c2cbbb361bc8c8d9335c188196c1458f03fc43565d18178e1a92bdf6a291b8e42f3d421725201f8400892ec48051f5058423eafb47f174ef6800f9900d8
SSDEEP 192:sxRRR9bv/fhsLHRQ/zoA8p4W/g6+WNIYEx/+GeIgDQJ:sxRRjv/fhsLBX/5I1so
TLSH
T15642D815AE68A97B8CCBD20EBB557F57D3F95032A0941E48F6FC8A1C14E76CD220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 062fba53d478b3c07e1341472a3d20b1a18830c456ed41a2cdec81cdb8fbd2e3
MD5 3db36e10c9709a81353a856b8c3d776d
SHA1 3e6f1f584c5428dc72baf191a83f249259e229e6
SHA512 300e86c5069efdde9aeca1e3475839457fd6584aa78715e5b1e1e7b456b72a6332655695729cc0e81e9bd84671f537ecf259ee38aa150077ffb0fa981b21d753
SSDEEP 192:sxRRR9bv/fhs2HRQ/zoA8p4W/g6+WNIYEI/+GeIgDqJ:sxRRjv/fhs2BX/5I6sq
TLSH
T18132D705AE28A97B8CCBD21EBB557F57D7F91032A0941E48F6FC8A1C04E76DD220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 cb2ffcf18f86910d35ae3a9ac7095e0fa227fc76a8303aba067b7c94e896fa43
MD5 ccbac8ea7079f1e9b40b0ae1cc167eb6
SHA1 c52028bfc16c2df119fb68ff3b66271a343b6e5c
SHA512 8e093fdb403f31d0374731f779922655f7ccca88c77c56c37c05493d63bb8af1952886b3db44f49ad1b40b7942fa440014ba8d95153be2ac9debd7782df2be11
SSDEEP 384:USupCD0fCtg82FfrLKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVQc9hnRXoroJeK:U/pCDmWg8KfrL8F1+UoAYDCx9Tuqh0V+
TLSH
T1E3B2D92B640CCB7F4FC04A9EA8196FD77D9802C79A588D4047FE995C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d1f6ce99a76e85a01a526b2f76dcbf72ec7274693b638fdf131b92c5f1dd563a
MD5 b487c349ef3f950d113e52a69ba27ed0
SHA1 560b1d69932b1f6ee8cfd5a0162d24489d062496
SHA512 77e01024ddf13962911c687e419a4088cbf40d7ebb064fdb292de8b36bd7d9d1cee95e450e9a00532d45e06abad697b9f34282289cac4b13f2edbdcb4e12c833
SSDEEP 48:KbwIDKFqcDyBGI3KP6Adm1YMuww9bEvwIiU9KR85O9lWtU3kwGyLfibfFlF:KbwgKFqyiGkKP6U5WK6IK3
TLSH
T18691FE81717F125538BD260990A6D72F8AC136B37058EA7A7FB910B64B2BE041CFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f49281bf-eaf9-4213-aafe-a9f971a9f2d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f49281bf-eaf9-4213-aafe-a9f971a9f2d4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 4ad85fe0834a2a80c217b475c5c671d72245012de3f960c0cf5634a8d60eb469
MD5 fcad051e23979961e2fc806816ee54c4
SHA1 cad78c0832a95119e22225a771fe512e6910e740
SHA512 3980976f69d535258d1769ef250547012112c016ba0c0c9fa2a46849cfab4b44cc7523648f4732b1b10cdc25ba5fa5c9ecf541f697dd4f5a907947143152fc33
SSDEEP 768:yp3E6GjUc7fZrKCp5XSwQs88uBkiT2g2sHmV:yp3YbtrHILNBZ2sGV
TLSH
T1D0F2BF35EC9498B7ACF69381764637072FF09107D8C8069889EE761E018B76E674BCA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 3a20b82ec6d280a9078f53732398a937ddd1b17ebc00f2521f0e687c76948b3a
MD5 04840f92b7a668b46a7020a5e7dcd3f9
SHA1 431f41abdde3dd4858279d37ce9855646c6ce3dc
SHA512 5f06e2bae973bfa09e6f553ad739cdf754083994328fca9f8b92de22a571bcac4bc93e5b6fd4646078df7a03a3fa21b845dcc9a5ce50f24c3397d5e491dbfefe
SSDEEP 768:ap3j6GDUc7fZrKCp5XSwQs88uBkiT2g2sHmV:ap3B7trHILNBZ2sGV
TLSH
T162F2BF35FC9498B3ACF69381764637072FF09147D8C8069889EE761E018776E634BCA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 f99fff1ad0983096448cb8cd1695aa41840737607b8b1e6eeaf48de7b72f1dd8
MD5 042d572f7b5b1caef87d379e536037af
SHA1 2b25e32ee0cdd5f15dafb5b7785e1f9c58a63d89
SHA512 937f870b0e1e16230e34aacb92d2b9f9e8fa7c6753d08c4ce050019c04f346402d2bfaedf998c58ea30de4b944764d6c14021a96d11fdd1d63d1484c7091ed3d
SSDEEP 768:R/UxvxjgC+W3Dggc7fZrKrp5XSwQs88uBkiTC85Z/P84g:kZj3+W3DgtrgILNBN5ZHg
TLSH
T10B03C039ECD46873ACB39385365A275BAFF06153C4C40B9849EE7A0E028B75DA707C97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 b163b978e0c79d51943317bf498a41ee1b29f0e34d1c2dcc30c4dbfea203cbe1
MD5 6d066df4a619ace7aaeca01eb0bef4cd
SHA1 6044be5ec5e6971b3631db25ec726073e6404baa
SHA512 53ef69a4b096ab13e9bd128c3b32cbe603057c51d68f58c14f93c8606e305377dfbc69d9be58de6e6586cfc0fca07a3d82e0628285bcc1335f7c31d02ff0e1e9
SSDEEP 768:AFQf3owg+6GDUc7fZrKqAp5XSwQs88uBkiT2g2sHmV:zf377trTeILNBZ2sGV
TLSH
T18BF2BF36ACD4C9B7ECFA9781B64A33065FF09157C8C44694D6DEA91D00872AE234BCA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

509ae906-1035-40c5-b4db-de5cf190b041.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\509ae906-1035-40c5-b4db-de5cf190b041.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download