c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261001-527357-gzvgkf.htm
Size 34KB
Sample261001-l3cfwsvfnd
SHA256 c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d
MD5 966cbc85dbef6cabdbdc9c7e5496cc81
SHA1 a975b1e21c10dd0dc8fa0dc9ecc3984ca1aaf500
SHA512 4385a6988471168604246748dec63ed3bcfeecaffa1948583072d992edad73d6943a08af0c354e6fcfc007425da662357166b6909fa654e104b78c0e97c38a71
SSDEEP 768:3srOAOH3uia5QeAE4rYyH1UeH+NypaNJiA9Ky:39AOH+l51kYyHeNVJAy
TLSH
T15AF2E65356D19D37066392F5FCB8BD2C95CA8D0FC248AC04743CAA0C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4540	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{4900721B-8E66-4F8D-9D64-7F9583CA31D3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 2820	4172	msedge.exe	89
PID 4172 wrote to memory of 2292	4172	msedge.exe	90
PID 4172 wrote to memory of 4540	4172	msedge.exe	91
PID 4172 wrote to memory of 2292	4172	msedge.exe	90
PID 4172 wrote to memory of 2292	4172	msedge.exe	90
PID 4172 wrote to memory of 2992	4172	msedge.exe	92
PID 4172 wrote to memory of 2992	4172	msedge.exe	92
PID 4172 wrote to memory of 4908	4172	msedge.exe	94
PID 4172 wrote to memory of 4908	4172	msedge.exe	94
PID 4172 wrote to memory of 4908	4172	msedge.exe	94
PID 4172 wrote to memory of 4092	4172	msedge.exe	95
PID 4172 wrote to memory of 4092	4172	msedge.exe	95
PID 4172 wrote to memory of 4092	4172	msedge.exe	95
PID 4172 wrote to memory of 4164	4172	msedge.exe	96
PID 4172 wrote to memory of 4164	4172	msedge.exe	96
PID 4172 wrote to memory of 4164	4172	msedge.exe	96
PID 4172 wrote to memory of 2008	4172	msedge.exe	97
PID 4172 wrote to memory of 2008	4172	msedge.exe	97
PID 4172 wrote to memory of 2008	4172	msedge.exe	97
PID 4172 wrote to memory of 3424	4172	msedge.exe	99
PID 4172 wrote to memory of 3752	4172	msedge.exe	100
PID 4172 wrote to memory of 3424	4172	msedge.exe	99
PID 4172 wrote to memory of 3752	4172	msedge.exe	100
PID 4172 wrote to memory of 3968	4172	msedge.exe	102
PID 4172 wrote to memory of 3476	4172	msedge.exe	106
PID 4172 wrote to memory of 4692	4172	msedge.exe	107
PID 4172 wrote to memory of 5488	4172	msedge.exe	108
PID 4172 wrote to memory of 6076	4172	msedge.exe	109
PID 4172 wrote to memory of 6076	4172	msedge.exe	109
PID 4172 wrote to memory of 3968	4172	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261001-527357-gzvgkf.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff96b82c188,0x7ff96b82c194,0x7ff96b82c1a0
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,17035105199346599781,8567824809000980104,262144 --field-trial-handle=2404,i,14544667574977801159,17183046025099364589,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,7153055697626038080,9958006117734851508,524288 --field-trial-handle=2404,i,14544667574977801159,17183046025099364589,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,18346899081688031851,17609974040758770366,524288 --field-trial-handle=2404,i,14544667574977801159,17183046025099364589,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:13
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,9644550299003318712,746861053235934407,2097152 --field-trial-handle=2404,i,14544667574977801159,17183046025099364589,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,5363893875003975153,8511176425385952168,2097152 --field-trial-handle=2404,i,14544667574977801159,17183046025099364589,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,15481959417401847528,5791278253846150582,2097152 --field-trial-handle=2404,i,14544667574977801159,17183046025099364589,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:9
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=2772,i,18086695134986471612,72775132574491943,2097152 --field-trial-handle=2404,i,14544667574977801159,17183046025099364589,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,16207580335667795127,11719058498726453635,524288 --field-trial-handle=2404,i,14544667574977801159,17183046025099364589,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,6869477316299436823,1752271246285973124,524288 --field-trial-handle=2404,i,14544667574977801159,17183046025099364589,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,4753679047461696821,2802365299854418152,524288 --field-trial-handle=2404,i,14544667574977801159,17183046025099364589,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,4753679047461696821,2802365299854418152,524288 --field-trial-handle=2404,i,14544667574977801159,17183046025099364589,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,9718940030447199183,10196057481905750520,524288 --field-trial-handle=2404,i,14544667574977801159,17183046025099364589,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,6606860861507415116,1012665304513341032,524288 --field-trial-handle=2404,i,14544667574977801159,17183046025099364589,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,5817608695908650270,15076462954737563651,524288 --field-trial-handle=2404,i,14544667574977801159,17183046025099364589,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,3336798199316605889,17221659603605563012,524288 --field-trial-handle=2404,i,14544667574977801159,17183046025099364589,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5308,i,8486139747624018065,9010554050499717932,262144 --field-trial-handle=2404,i,14544667574977801159,17183046025099364589,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 43b1718f7912077cd88e209454fdefc3a600d59a62a77798df8cee8cca47bb19
MD5 02c683c185cdee27cd4137f6270bd7de
SHA1 5d18a32c04bf96f11e1872d37a8fd4c56765f362
SHA512 30f27b888d6fc3375b71464a8a9ef6b69a2bfdcf5ff561c6b150551d22949085063736bcbb8e65227bb8e01ec89788e3ca194768ec26180d5ae978decd440859
TLSH
T17351B7835183C051FBDA823EB7DE9C9737380AAAA1439D2583DED077541E73A039C2E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5973de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5973de.TMP
Size 3KB
SHA256 2f793b1d775b062f8f7130c5a39e4034b297724de8be0bcfbee3d18afe750229
MD5 5d8f0d2b05c0e6d57af9a05369e7e35a
SHA1 f1312e046248dce8ae5881bb36905668f8b17d6a
SHA512 5cab82a303272adeb632dde3da82dcc45227d713baea4a8d5a834edca068ff792a8b99a7b7d6bd64dc88e74515e1da6970633c07fefccb212ccdda9f65ee9202
TLSH
T1D251B7835283C051FBDA823DB7DD4C9737384AAAA0439E2583EED077581E73A03982E4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 66796934da3b17ed2598d3609ec2c828c79b1004924cc3a5ee42ebc2c7f9e59d
MD5 788e856c565a12adb0c4fc025a1dd837
SHA1 4ce85d5f1b9dea8bf9765799321f485a47c52f4a
SHA512 24b2b525e73167b3ddf4d5108c4c697250c0ca02d34d58e86e1e4a2ccf26cd6d66c833e6a372fcf565462e7bbc4a7bf12b13cec4fc21e503bc31c9732d2cfd77
TLSH
T14741CEF3C3E4867D890156F0AB14AE1BCE1C0915432C3D5AC9E4AF1B93E24B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1207bb9b62d1fe1561b7a3a23110c74aaf877b51ac6564d8fcf85a5a697b29ee
MD5 1535f6af07b1e34e29e30e25e874f6f9
SHA1 55283b660df2c606dd2e1392b071abc6aa43d80a
SHA512 315ac9c8ab4d75560e1d81f00cd1a89a393a44e6c9f8404d1f2e10cbbd29991118b2555aad55a05e528e4b6cbdbcac46311c6e3d644cb791cb495cf9faecba39
SSDEEP 192:sxRkRQbJ/fecsMJYqrViCzoA8p4q/g6+WNIYxvqUdG8IgD4J:sxRk4J/fJsMJYeiPn/5I7U7Y
TLSH
T13D32A515AE68A97B8CDBE21DFB55BF53D2F95032A1951E48E7FC8A1C00E76DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d9632273eefe34aeae8073f4e0d94ec877b36c096bb6a236c3909ea680a8ab25
MD5 29aa5072cd1a9ae60a1d0b5a1e67291c
SHA1 fed4943226d421956a28d94a2259f1884d969b4c
SHA512 07c4569cc1525ac288dc3cf92186a16b1597d1c8f75b371dee3de0f310855176b358194c475f66fe061191d24fc0d8cc880b6198c533b2d79e3eff8205c9ca33
SSDEEP 192:sxR3RQbJ/fecsk9YqrViCzoA8p4q/g6+WNIYxsqUdG8IgIJ:sxR34J/fJsk9YeiPn/5I2U7s
TLSH
T1CD32A515AE68A93B8CD7E21DFF55BF53D2F95032A1951E48EAFC8A1C00E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fa5ab08ce02d3a3b621ab61f770b42b36e97af98437039f5366ca58fba9c873f
MD5 318959acf39596a98e1fdbeff6ee8be5
SHA1 478459c9611b65538201c08091c3f729f1f360c2
SHA512 112bb46e1ce1deeec3eb3756bea5de0602c87ed56667e899ad064828ad2c6f397014dd3783140b6a1365118afd3a5f1a20356235693c8b2287580a30780587fc
SSDEEP 192:sxRkRQbJ/fecsM9YqrViCzoA8p4q/g6+WNIYxsqUdG8IgDCJ:sxRk4J/fJsM9YeiPn/5I2U7a
TLSH
T11232B515AE68A97B8CDBD21DFF55BF53D2F95032A1951E48E6FC8A1C00EB6DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 090f362136417a8f27f9c87c93bee0399743bbcd262cb8d8478fc1253d34ade2
MD5 1e2d5ecff45a9eaa21115e4087329a4e
SHA1 993cc594a5d0d59f33407f42744e6584522bd580
SHA512 2f643324cde0decfe2e87ffa9e4bacdd754dd206da8d08a714b22a2b064f3b49579800b508283efddd401cd9115b2ea033d6a92a2347bf7e8b560351623c3ada
SSDEEP 384:z/ZDnwZfCtgbRFfkWKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVnL9K6RMorrowY:zBDnwFWgbjfkW8F1+UoAYDCx9Tuqh0Vb
TLSH
T1C2B2CA2B644DC77F8FC00AAD9C196E9B7D9802C79A548D4047FE994C03C77EE922A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dcabe2df28e89d91001e495eb6c13df36ab3a184f691aecc87a4af40f410395a
MD5 ec69378c13d9fbf79e71f73e3a019d3d
SHA1 8e4b09546c242109ed858507ae5155e891b5f380
SHA512 3e91912e82ba91579e6553c432f0f39e3000aac193f847d752a3dcf249fefc3ba0f5adcadcf7af1c5069cc1b923e920dd541b235d6fe6977e6bae31bfcfa39ac
SSDEEP 24:K5XYjo7I3KPhW1aSupbyXOJ6lDLInKnhW16S+JHk7kcaIdK4hA1GSdKtyXPgPG:KEkI3KpWsbyJvInKhWEt9IdKuAYfyr
TLSH
T1A991B33132364240387E350C82F4BBAB9A9231A23035A96F3BED55659E7BE558CBD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a357bc55-8693-41f1-885f-cdd2ef349671.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a357bc55-8693-41f1-885f-cdd2ef349671.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 3c943f21b0e7e31b131061a96dc584cb5356198cf2f43d89e5abb0b4da8d9384
MD5 828e8c102ef59d1e21974a8dbdf16aa9
SHA1 fd3a5a42a0bfda45278cbdf113d2a6cc7d024154
SHA512 e1f0a3d3064c28e71f95b991a3ba2d97efe822258e3d07761a344b76926149150472e76b127b23e3a86e48f9867ad04c75703a89dce688b316a8c64731bd91e1
SSDEEP 768:t5302M9TOfRfWfjwyJYe1ELsAvC8/YEKWY4YGHLH:t530CfRfWfjZYe1EQujYGY4YULH
TLSH
T1AFF2AF72ECB8DDB71DF596C6BA462F03BEF4811396C84A44D2CD270D44C76AD230B86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 39b853fcdede3f8e5a14482f6e5b1c5dba2dca0bc3effcdbdf9724433caf572b
MD5 fda668855f15bde4a2d7a6dd13915b0e
SHA1 eabba3c5d66d24d83c1cf7ad9822c0380dce9908
SHA512 b76cb89bc750a7bad5378b2ee65b4a6fd9b072f991991aa387a394f909c0f9556bf4a34c5bda5b4c9c8ff1b7574965be907a3fc59031708d33f4de0e2cfea4f9
SSDEEP 768:z/UxvxjgC+03dwM9TOfRfWfjDyJYe1ELsAvC8/YEKWYy3H8:GZj3+03dcfRfWfjEYe1EQujYGYg8
TLSH
T1AD03CF32ECB89D731DF2A685B64A1B43FFF4411395C45AA486CD2B0D05CB3AD534F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 9b2f428222acb10d55de92a49deb10661107ff55a2cffe8a79bf802ab21db290
MD5 fdf7507bb22ba4a4f8504f6a0ef39689
SHA1 dad5272347749db8101ae6fae1e6a2a1623cd46b
SHA512 758fae6aec2d9ef15fa98bde5abda30da90b7f5f870cf97bf484105a103e3bd1a5c28c62d23d21d702897252c5b9f52f775a9fdcd1be3b059eb6f0de5651910f
SSDEEP 768:P53B2M9TOfRfWfjwyJYe1ELsAvC8/YEKWY4YGHLH:P53BCfRfWfjZYe1EQujYGY4YULH
TLSH
T1CCF2AF72ECB4DDB71DF596C6BA462F03BEF4811396C84A84D2CD270D44C76AD230B86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 1310006d2eac446c67f25ddbfa6cf2d05a6f351e1b12541fec3f6b0587f2b0a5
MD5 ea68f35af3f8423e4ea85ec139329885
SHA1 6b133f4f7fa96ecc124497afbac472f5409eee1d
SHA512 642624155be806716e115ad931f027045e59b08808b4d7895a3b966c16bbe41b8785beeba02b719a0802baf2cf95e6f96dc226c6c4a1a5db3545def74f7eeb58
SSDEEP 768:gFQKa3twgi2M9TOfRfWfj/GJYe1ELsAvC8/YEKWY4YGHLH:TKa3mCfRfWfjsYe1EQujYGY4YULH
TLSH
T121F29E73DCA8C9776DF59BC5FA462B03EEF48153C5C89A94D2CD2A0D00876ED134B86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 42616ef172cea74352fb82f95ed31a53846dc213739d94e560fd2cb79ea59c0b
MD5 672aa6755cc96038a6b56762e825b5d4
SHA1 dc41daf8f354d77db0ce1a7c285891e1a0666c41
SHA512 e8ce5cf2ab3395374fb3ec4dba38ffb2fa04af02760e3b4b9c644e8426091e21392ff8950ed42864573d7c05fe54792c80e0053639ef5c835a64ff471363bb2e
SSDEEP 768:h/UxvxjgC+i3/a9TOfRfxKJYe1ELsAvC8/YMTBSHrkw:0Zj3+i3dfRfWYe1EQujYkS4w
TLSH
T1B303C032ECA48D775DF2A288774A5717FFF4811394C42AA886DD2B0D06C73AC630F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download