5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-527357-x8sli9.htm
Size 1KB
Sample260930-yce6baythx
SHA256 5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2
MD5 3a134f40128e3382caf68c7037564ce6
SHA1 d53f727b1b15ed1d2286e65613578331cb2a01f7
SHA512 7dc021062e3dd4f2601fa8291c6c7370bcb1b579bc09aac01ed304c2dfe255c0a67248a2e7b90940563d9c914749f0488d85f55208a5f48bf413f651b735d21e
TLSH
T1FD11CCDB03E23DA45493333764434B8EDF380175E7724F753475211A138A29AD4239F4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4152	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{4F059046-D64D-4983-9B55-D0564E94E723}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
200	msedge.exe
200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4884	2904	msedge.exe	89
PID 2904 wrote to memory of 4152	2904	msedge.exe	90
PID 2904 wrote to memory of 4128	2904	msedge.exe	91
PID 2904 wrote to memory of 4128	2904	msedge.exe	91
PID 2904 wrote to memory of 4128	2904	msedge.exe	91
PID 2904 wrote to memory of 4248	2904	msedge.exe	92
PID 2904 wrote to memory of 4248	2904	msedge.exe	92
PID 2904 wrote to memory of 4604	2904	msedge.exe	94
PID 2904 wrote to memory of 1940	2904	msedge.exe	95
PID 2904 wrote to memory of 4604	2904	msedge.exe	94
PID 2904 wrote to memory of 4604	2904	msedge.exe	94
PID 2904 wrote to memory of 1940	2904	msedge.exe	95
PID 2904 wrote to memory of 1940	2904	msedge.exe	95
PID 2904 wrote to memory of 1176	2904	msedge.exe	96
PID 2904 wrote to memory of 4560	2904	msedge.exe	97
PID 2904 wrote to memory of 1176	2904	msedge.exe	96
PID 2904 wrote to memory of 1176	2904	msedge.exe	96
PID 2904 wrote to memory of 4560	2904	msedge.exe	97
PID 2904 wrote to memory of 4560	2904	msedge.exe	97
PID 2904 wrote to memory of 4308	2904	msedge.exe	99
PID 2904 wrote to memory of 2264	2904	msedge.exe	100
PID 2904 wrote to memory of 4308	2904	msedge.exe	99
PID 2904 wrote to memory of 2264	2904	msedge.exe	100
PID 2904 wrote to memory of 2792	2904	msedge.exe	102
PID 2904 wrote to memory of 4644	2904	msedge.exe	106
PID 2904 wrote to memory of 5344	2904	msedge.exe	107
PID 2904 wrote to memory of 4084	2904	msedge.exe	108
PID 2904 wrote to memory of 5996	2904	msedge.exe	109
PID 2904 wrote to memory of 5996	2904	msedge.exe	109
PID 2904 wrote to memory of 200	2904	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-527357-x8sli9.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d0,0x7fffae6bc188,0x7fffae6bc194,0x7fffae6bc1a0
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,13104890957235756924,12607631627571933582,524288 --field-trial-handle=2220,i,12780399848125913996,8430810062386096353,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,18365432424392872879,5774966685311343181,262144 --field-trial-handle=2220,i,12780399848125913996,8430810062386096353,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,15371325530181605257,11286423772156128045,524288 --field-trial-handle=2220,i,12780399848125913996,8430810062386096353,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:13
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,1251962881616932069,7309093267367813388,2097152 --field-trial-handle=2220,i,12780399848125913996,8430810062386096353,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3656,i,2822270803732721008,12565338271143387547,2097152 --field-trial-handle=2220,i,12780399848125913996,8430810062386096353,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,5606770111212020233,10344153497830735058,2097152 --field-trial-handle=2220,i,12780399848125913996,8430810062386096353,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4448,i,9847464023317410346,11480418727051073820,2097152 --field-trial-handle=2220,i,12780399848125913996,8430810062386096353,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,4858743301378598097,12185229124007617381,524288 --field-trial-handle=2220,i,12780399848125913996,8430810062386096353,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,16035471723319785116,12954392250234787807,524288 --field-trial-handle=2220,i,12780399848125913996,8430810062386096353,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,4112043463595022307,17900595551920925637,524288 --field-trial-handle=2220,i,12780399848125913996,8430810062386096353,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,4112043463595022307,17900595551920925637,524288 --field-trial-handle=2220,i,12780399848125913996,8430810062386096353,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,8406352794328232082,9549384458433229128,524288 --field-trial-handle=2220,i,12780399848125913996,8430810062386096353,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,5826184085408385285,4928933948217263122,524288 --field-trial-handle=2220,i,12780399848125913996,8430810062386096353,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,4930163869784992072,11508736230383749912,524288 --field-trial-handle=2220,i,12780399848125913996,8430810062386096353,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,16643580522356966398,13160540413901334005,524288 --field-trial-handle=2220,i,12780399848125913996,8430810062386096353,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:14
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5792,i,4841247451942352748,8926917847685229025,262144 --field-trial-handle=2220,i,12780399848125913996,8430810062386096353,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4d406705b8fbdda65c17fc4af1fdec8e6d42be041b307138f09f5cade940495f
MD5 0a1d13e9dea77d9e825d5a6d2ea6a425
SHA1 8b2350669a9cfb77191317d12457fa1cb1aa2585
SHA512 018591bb7678c3d971073ed5e622460661535cddd52ac1f25f0f656c760fa495f8ec2a8be2e787b4b7f56b3293b064a908292ba88e00fee09499f664c2e0ec2d
TLSH
T12861C680A6918CA1FFE41B3085D5DEFF3237B5C18597CF2A11B8F775A8A2725E881048
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599bf8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599bf8.TMP
Size 3KB
SHA256 3c7ed90629b08c399aae363c435fe98c61c694b68144e2e99cbcb7571e4f99d4
MD5 39337dedf7648250dd91cb136072f94c
SHA1 b2589a65bf682f4f52abbb218911537654c7f574
SHA512 0bafe7c0e8a0cf0ec4c2a4765dab63cb1bd240bf694a56d88979127a11dc29116dd7cdb6053d000b7a8d75ebe8745981b937c689fb5c9e201a3e3075e1814680
TLSH
T1CC61C680AA818CA1FFE41B3085D4DFFF3237B5C18597CF1A00B8F775A8A2725E881048
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 11e16fde1482a70ef591fc19b3dd27f7f95824fe47dc58c97276916a5a862be1
MD5 e5c7e956121366eb0fafc7ebec1ab55a
SHA1 6ae21c730e9dd12341e953c0e6b07588bfded925
SHA512 ee792b9cf8c7ab842754dd6c21d27818b20007e7b6a3216d54c04caa90ff9fe4393244aa45eed18dcc7626687c2c7ff4eff9df30d1deabb663aacf26d77b3d27
TLSH
T158419BF3C3E4866E890156F0AB14BE1BCE1C0915832C3D5AC9E4AE2B93E24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1f5021fb650489550f44b2521d6bd8d008bf661a29020c6cbe0cdb046f7b283b
MD5 fbe093c22375a6dee9290920ead35bfe
SHA1 947927537c82eeb24f46e7abfef52eabeaa10dac
SHA512 6c46d445a04aa04e3bd2adb0a2ec80ae162c0098164e2e1447345a3b67e007c9c5c4e9c8ab2b437e7c0d18966ee92730864779caa4064957c5431567a04ae950
SSDEEP 192:sxRYR+b3/fosWnzoA8p4p/g6+WNIYFIrG5IgIJ:sxRYu3/fosWOo/5IYs
TLSH
T11C22B515AE68A93B8CCBD20DBB66BF53D2F91032A1D51E48E6FC861C15E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fbdca65da8c7bf3a7fae5fc4d8fcdc583393d888d091fa89304b1a6f124d516e
MD5 7f52f165685da34a3f9637e24c2af105
SHA1 24eb41e491e3caef0d86cd76c188adad0283d19d
SHA512 fc8d5208d7f772e928e9e6e7cc2c5391d752e8ef0f2e26cddbee40429e2c48217d4c88c9c599bbac57c33477f15d8f73c7fd97b2fc8858790c4fa8c9fc0eaf06
SSDEEP 192:sxR3R+b3/fosInzoA8p4p/g6+WNIYFIrG5IgDfJ:sxR3u3/fosIOo/5IY1
TLSH
T12332A515AE68A97B8CCBD20DBB65BF53D2F91032A1D51E48E6FC861C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 33e1bc4b541c2ede31b6f3e013e8ab2ce070091e9d30148f42f66f5e3ebb0c7d
MD5 2c17042eafe2bbfc4dce261cb36daa26
SHA1 5c58fbf7301ccb9b327899f765054d0c7fe1fcd3
SHA512 c65d49621709de5c2c42bbed6aa08f07af85653c2fc28baefdb8d9775b64327125170e279c787ecc1051345c21484f58f51fab2ad305fc0384b9d1b4222cd467
SSDEEP 384:+0e2P7wfCtgwiFf4eKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVS29aSRngro+Ps:+l2P7KWgwef4e8F1+UoAYDCx9Tuqh0Vg
TLSH
T1FBB2DA2F640CCB7E4FD04A9DAC196EDB6DAC02C796588D4047FE994C03C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 eb5098284ae544da497519a4e360909e30c294ea5109203c7b2b37911f6345f7
MD5 f295a30d2a58ae13e94d59ce0fc8f19d
SHA1 176a644b14690644afb0dc755184fe8a599bfd65
SHA512 a704b4bc1ccf8727aa00084c27261bc4caf2d5e9d60310a14f1a5ade77f3e393fbb7e8fe57cdce066b0105b8a6fed6bd664410cfb179d04ff70273966fe622d9
SSDEEP 96:K0qoKXK+quIKLqItYRdrXDkTX+PxVkKZBxjkF9der95Sj:mD/oTW
TLSH
T1E9910F35323A1350783E391C84E5A71F968235A73528FA2B7BA950A28F37E091DFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

e2de3287-4b65-4fb9-8044-8ed16297b9e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e2de3287-4b65-4fb9-8044-8ed16297b9e0.tmp
Size 10KB
SHA256 fd0bc1fd6f53e3ed24d5d0a174bfd50b839d60cc31f541201750c56e397f40ee
MD5 cbcbbab4662eb50e03333c81033cbac9
SHA1 0cbc08d1e54a49e56f5b5f3d5cfc2beb7058a435
SHA512 bdc890cc41b52d3a237b61a8070d48683fcd7d8115d501c8c4c7e4359ac9ea5803a43eee935882b6652a4f8beb6d1d5e2875d9c27fc8c7d59401e532184c4e87
SSDEEP 192:sxR3R+b3/fosZnzoA8p4p/g6+WNIYFErG5IgDBJ:sxR3u3/fosZOo/5Igv
TLSH
T11632C615AE28A97B8CCBD20DBB65BF53D2F91032A1D51E48E6FC861C15E76DD120380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0033e1d-8759-4a25-a240-aa9fe785d5aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c0033e1d-8759-4a25-a240-aa9fe785d5aa.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 02e52564d74321a45965c512118848716abbd02a458e4c1878783dca1b24a5f9
MD5 dbe01f0b875f851ff171d24686ca1fdb
SHA1 b2368e5f5bf745ff1d7c4b4be6498f47a872ab42
SHA512 14e79ad8833ce129c7242a70920fd9dbcad1ae1dc7a9c15e01fd8d7093938b0b66d0e321516bca05749b03c9901124949033fe3c2feaac7a577c3d19dffec8c6
SSDEEP 768:48l3vEf9c/+DMyEMbxyJugQVTJ7vvmeX8P2sNN8:48l3mPMyEmxyJJq17veP2s/8
TLSH
T1CFF2BF329CB58CB35CEAC2857289F743AFF4066395CA5B94C4DD5B0E118B6AD134BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e4744d9af1b389df21e34a55f22d981a012a4d70bf7624d3d3c1b95f5dde7bf5
MD5 8b980c6ebd795917e78f7999d7aebb50
SHA1 1e888ab0fe749c0185cf4f918398c15425928c08
SHA512 83e0eb7c74674767df30fba5fb10fc67c80f89126ce3a39975f9ad4666bf23b87c2c07f7dbdb3e18fa56e38f2b5099a66a39ca6de6f76a789fafffee13d1f2be
SSDEEP 768:JU/UxvxjgC+w3FEf9c/+DWyEMbxyJugQVTJ7vvmeX8Prrz:JBZj3+w3gPWyEmxyJJq17vePXz
TLSH
T10303CF35A8699C7349B7D284724AF783EFF4056394C61AA8C8DD5E0E168B3AC534BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 523fd367a1062b570c27b387774ad486cd1868910cf5626638a30366abc56cbe
MD5 3f3966041a316e62c7c01c582cabbcef
SHA1 577e12f781a7111cd6ae8c1cc69b87fd0c884b38
SHA512 fd9af0bd41465db9c18cf2a83e2b3b8b87ad0c22165a6022216e5f5aae47c09a5bc497b217a6a9b9cf56ba8b0744728c44a620f0717aa6481d8390ecaf18d37d
SSDEEP 768:J8l38Ef9c/+DMyEMbxyJugQVTJ7vvmeX8P2sNN8:J8l3tPMyEmxyJJq17veP2s/8
TLSH
T15FF2BF329CB58CB35CEAC2857289F743AFF4066395CA5B94C4DD5B0E118B6AD134BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 6aca48da05ac2dd10b178ba8b166714c648e050202951587429d05f70bbaa380
MD5 5a26b97e42642e45e337b575d353b120
SHA1 49d00fc7a9f026f196a5052a4f3a72d8648d5237
SHA512 669d383ea28439286eb5bc25cfcc64ebcc4abde32b94af14ee5c9d382bac823e4dd7e529a7466589af124769f0514d4d24730918b2456a74f1c0469d4b7777c4
SSDEEP 768:wVFQR3WwgQEf9c/+DgyEMbxyJugQVTJ7vvmeX8P2sNN8:w0R3oPgyEmxyJJq17veP2s/8
TLSH
T113F2AE329CA8CDB79DBAC785B649B243AFF40263C4CA9B94D5CD5E0D118B1ED134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 9dfbb848a6ef62206397032e4facc252dbff722fd68f7d9a5215c4cd7a8ea79f
MD5 18c68a02cdd768be813b3cbdca6814bd
SHA1 a460f9fb1626ac60b560663398bb957d1700aa88
SHA512 2215c69222c6db2db6d1e5fbc36dca4cba47479cf9e4c534917cba24319d5d8ebe4c9a99839e2ebb965b908abed990bfa5f7bbe7664ec18b83d05acbfcd66270
SSDEEP 768:p/UxvxjgC+k3KYf9c/syEMbxyJugQVTJ7vvmev8vSHtBk:cZj3+k3zpyEmxyJJq17vavSbk
TLSH
T1BD03CF35ACA59C7388F792843649E787EFF506A394C62BE485DD6F0D128B2AC530781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62aec79b-5459-453d-9209-5f75bdc43165.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\62aec79b-5459-453d-9209-5f75bdc43165.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download