hxxp://forum[.]opnsense[.]org

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 23:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://forum.opnsense.org
Sample261104-3xxcjset2w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1220	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{EAFCC969-9B2F-47A8-81A8-EACDECAD7CE4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 6120 wrote to memory of 5268	6120	msedge.exe	84
PID 6120 wrote to memory of 1220	6120	msedge.exe	85
PID 6120 wrote to memory of 2900	6120	msedge.exe	87
PID 6120 wrote to memory of 5804	6120	msedge.exe	88
PID 6120 wrote to memory of 2900	6120	msedge.exe	87
PID 6120 wrote to memory of 5844	6120	msedge.exe	89
PID 6120 wrote to memory of 5804	6120	msedge.exe	88
PID 6120 wrote to memory of 5804	6120	msedge.exe	88
PID 6120 wrote to memory of 5844	6120	msedge.exe	89
PID 6120 wrote to memory of 5844	6120	msedge.exe	89
PID 6120 wrote to memory of 5920	6120	msedge.exe	86
PID 6120 wrote to memory of 5920	6120	msedge.exe	86
PID 6120 wrote to memory of 5920	6120	msedge.exe	86
PID 6120 wrote to memory of 5392	6120	msedge.exe	93
PID 6120 wrote to memory of 5392	6120	msedge.exe	93
PID 6120 wrote to memory of 5392	6120	msedge.exe	93
PID 6120 wrote to memory of 2828	6120	msedge.exe	99
PID 6120 wrote to memory of 2828	6120	msedge.exe	99
PID 6120 wrote to memory of 4660	6120	msedge.exe	100
PID 6120 wrote to memory of 4660	6120	msedge.exe	100
PID 6120 wrote to memory of 5520	6120	msedge.exe	102
PID 6120 wrote to memory of 376	6120	msedge.exe	111
PID 6120 wrote to memory of 1792	6120	msedge.exe	112
PID 6120 wrote to memory of 2508	6120	msedge.exe	113
PID 6120 wrote to memory of 4692	6120	msedge.exe	114
PID 6120 wrote to memory of 4692	6120	msedge.exe	114
PID 6120 wrote to memory of 5452	6120	msedge.exe	116
PID 6120 wrote to memory of 5452	6120	msedge.exe	116
PID 6120 wrote to memory of 1932	6120	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://forum.opnsense.org
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7fff05d2c188,0x7fff05d2c194,0x7fff05d2c1a0
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,3978245901915148407,8024779572967091462,524288 --field-trial-handle=2836,i,6256870599027142417,10783557205582583854,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,859027565098927037,2857473408118617235,262144 --field-trial-handle=2836,i,6256870599027142417,10783557205582583854,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:2
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,6326212522494060450,8764240787035491154,524288 --field-trial-handle=2836,i,6256870599027142417,10783557205582583854,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3260,i,16752927889047004126,8254524845036507238,2097152 --field-trial-handle=2836,i,6256870599027142417,10783557205582583854,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3256,i,1333538271232480717,14972513701305888601,2097152 --field-trial-handle=2836,i,6256870599027142417,10783557205582583854,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4844,i,5031265913654415732,9849893698706997788,2097152 --field-trial-handle=2836,i,6256870599027142417,10783557205582583854,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3400,i,15483593635716205172,5598509730414483973,524288 --field-trial-handle=2836,i,6256870599027142417,10783557205582583854,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,1647092511500251344,15309278496665934489,524288 --field-trial-handle=2836,i,6256870599027142417,10783557205582583854,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,9309354669013260125,16787870545570794338,524288 --field-trial-handle=2836,i,6256870599027142417,10783557205582583854,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,9309354669013260125,16787870545570794338,524288 --field-trial-handle=2836,i,6256870599027142417,10783557205582583854,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,17668831235998044317,4942429093745133786,524288 --field-trial-handle=2836,i,6256870599027142417,10783557205582583854,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,3604603811486350974,3943342601834819004,524288 --field-trial-handle=2836,i,6256870599027142417,10783557205582583854,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,3183803395284396342,1317415992468197045,524288 --field-trial-handle=2836,i,6256870599027142417,10783557205582583854,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,14692802945926828196,4978334466134811669,524288 --field-trial-handle=2836,i,6256870599027142417,10783557205582583854,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,15593931607270519165,14844687999644901532,524288 --field-trial-handle=2836,i,6256870599027142417,10783557205582583854,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6104,i,9148888819806005193,11016936547677747421,262144 --field-trial-handle=2836,i,6256870599027142417,10783557205582583854,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3075fe28-9ae9-41ce-ab30-fb1d49635a85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3075fe28-9ae9-41ce-ab30-fb1d49635a85.tmp
Size 26KB
SHA256 2ad9c4d3160a533f65a3b0a8db64727307ea307c7760e9c8ce84e19b61915ace
MD5 62081237c0f608dd172fdc3613e6a6ee
SHA1 0f43527be767b7b534e90fb83e3377edfd51af01
SHA512 f62dc75ecc9386a32cb7bcb6485dbe615af9b1d557862c3ab3f79689035b28ffe364d2ee0ec5c0d6e24b9b3592ce95a43b35ccf343258bb94f165ba3c1f9c28a
SSDEEP 384:nlMiFiZcI63sNY8TUNTUlIm25mg0buK2fMBOHLtuVnpqVl7O6R2FeoxgL/7IzKoG:l3FQ63twgSTHBOHLttVl7TRVl
TLSH
T199C24B32E894C9BBEDEB8FE6A74A7907DEF04163858C9AC0D9D86D1D009759D070BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82f973fa-000b-4ce3-afaa-68d47ca91803.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\82f973fa-000b-4ce3-afaa-68d47ca91803.tmp
Size 32KB
SHA256 29788633a06e87c2aba45026303a042063f88b0ad95281ed8bbc8f7b9a886163
MD5 db478d56c31ea4a8c6d54959fe0fa596
SHA1 dba874ee8bf63a12f5aaf811a4b181cb40f0f8f1
SHA512 9723360b53fac3333631c94cce5c39d1bf65692df96df043a25be6fc7331438dc631bfb9f39973a53d60f2c69d4003699667653960bf057f50c4820f2282dcfb
SSDEEP 384:nDiFzQkUSvGA3sNc8TUNTUlI465mgR09K2fMBOHLtuVnptVlRwry90L8QQgL/7IU:uFdf3dwgw1mBOHLtKVlRwrw0XgLc
TLSH
T164E2C4F198D78977E8AE4B93673E2D429AFCD153B5884A80B7C55D1CCC861BFD30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97d5674d-3a9f-475d-8111-e3c1be118edf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\97d5674d-3a9f-475d-8111-e3c1be118edf.tmp
Size 25KB
SHA256 4d13a0d962853f053ca39ae642dd5906840f7f837e0b51e429c02f86d2608a99
MD5 e46fec07b4619aa2eb1f438655ae68fd
SHA1 51df4b90a6e3ae0964a64f0bf5e84a1abf1a2a23
SHA512 296f0a370dfa389fe44b03f62c3797f9c062f481fa23064e24eb061fff55bff334cdc46636a6de54e7d7c57b5b8a797256d7e9aafa7f1e311b301e6ca17aa6c6
SSDEEP 384:n0MiFiZcI63sNw8TUNTUlIm25mg5onK2fMBOHLtuVnoVv7O6R2FeoxgL/7IzKoG:03FQ63RwgSPQBOHLtRVv7TRVl
TLSH
T120C25B32EC94C9BBEDEB8F96A74A7A07DEF01163959C89C0DAD85D1D008719D070BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b905d17-8050-4287-aed7-e603351daae0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9b905d17-8050-4287-aed7-e603351daae0.tmp
Size 26KB
SHA256 a28204a65340438f9f51132fa050f25a40007aadaf39370cf656575b9f306f7c
MD5 3ad28cf7e9119d668585590201d5e67b
SHA1 f2bc1e5b424ef72d01ce95f644ae7b9d59a6681c
SHA512 1fe0e9b0259d74a2c7ae04c3a59fea0443361cdb2a214df4e5c5432e082a9aab81482fc0a7daba6d25de2a6582e1ffe306aad1875026b473fb93275bd7344ec3
SSDEEP 384:nBMiFzQkUSvR3sNc8TUNTUlI465mgRm9K2fMBOHLtuVnprVlRwry90L8QQgL/7IU:B3FdR3dwgwXmBOHLtyVlRwrw0XgLc
TLSH
T1FBC25A32E898C9BBEDE64FA1A75A7643DEE05153C68C8AD0DAC95D5C00CB1DD170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

0245f0c4-17fd-48c4-959b-dad6a1b0496e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0245f0c4-17fd-48c4-959b-dad6a1b0496e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

1cb16e86-602f-4c0d-af90-8f2efee61c32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1cb16e86-602f-4c0d-af90-8f2efee61c32.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e02a63e-3186-4735-a25b-f379f90d886c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e02a63e-3186-4735-a25b-f379f90d886c.tmp
Size 12KB
SHA256 6d8750cb36bff4fda573612124b794ab94f616c49765357e3a006ac6a6aecb22
MD5 bfe3641974c8d35ac3b867c2f2e3a0b0
SHA1 2e7327ee3ee63314c8b90eca2657e8a061ecdae9
SHA512 4bfb5522f6775c7217a12396d8e2dbc66da3d270a81041e0b1da06d1df06f4a8f9d19ad12f121eaef6fce8c99c7d8b8fa80452ade9542f2747da6c3b3c91d4e0
SSDEEP 192:sxZERPkZ/fesSQZZfuzodpmYHW6+WNGHs/YbIKRAYKaIgjEJ:sxZEmZ/fesSOZf17HbR/FlY3jI
TLSH
T11542D955AD38A93B9CC7E209FA25BF53D3F9103290945E48A6FCCA1C14E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a7c14af-9dd0-4cd7-b7bf-8212e84cb297.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3a7c14af-9dd0-4cd7-b7bf-8212e84cb297.tmp
Size 414B
SHA256 78457a96257307055fde12490cdc8d121564b83b8028a7d99d5e2e27adcfe406
MD5 1aa9d5e72a2537795eed0af3d3c0d609
SHA1 949de1bafbd70ac8e8270f4bcbf59975feb3a28b
SHA512 7c06e6c93c27072770761de09d2d2e682e3af378354906ca7aa82e22f87a0f27232c98ac4c277de24f4a3256c469c584eb5ecd132125936c3ef291ef2a079beb
TLSH
T104E02BE5C819BC3708FC172D54544685EA55134B2A80844F773D910D8FB5A36519696C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 4324b67140b404745fb163c78263c85c41b774418cea0274522e589ca313a6ca
MD5 10a8f93ffa61ad4bd50f3b0676aa84c2
SHA1 78a2ea20d59242cf9ce81766c684003b4e1906ce
SHA512 d1f14a290c597a8130b5b86f2567eec8736e33c1a1c40db9bfa1dba30c401e1a7a145870d65e1f41cec2e34396b5c65e46864567d493fea6bf29019a5ebdf4b1
TLSH
T1A5E026C864E8C33EB22C745B13A8534CC280362B9FC8AD2E2B40ED8970412C0A2E66F0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 38b2a0644bb14f6d14958c37587d2fc98d08182e05522789b899687ec44767e6
MD5 245ddacc0aebc015464d467257c24a56
SHA1 35f8db1432200f55f27d1b3566dbe4e7c170b22f
SHA512 f016681c6245687fe335e165e33ede0b9ef01ac3c61e6332142ea3c2e61e4dcfb8c709c69ee559ea5fa4acf2a0ae3854ead80b08a1fcf3d686818a41e506885d
TLSH
T19861FB894DB8976AFB9C3DBD91E10DCBB0B419D4A3831E4E0674ECF9E436B712D4A540
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f6ddcd52091dff2c3828197c5dac9ff74e65765ef6e7402404d809a8ed789d4b
MD5 2d37222509b6da5a3a8b583f9f372adc
SHA1 40de77522952dd1d28f41616223149abfe553985
SHA512 c5c1c3c79b5f14f7b374a2ee4fbfc193865becdd6694252c1d4a3a399e2071168cc149d8df3879850801b4c6a3f818926a36982b0121a8e2281c5eeaf01ab47a
TLSH
T17A61FA8D0DB497AAFB9C7DBC91E10DCBB4B815D093831D0E0264ECF9D836BB12D4A480
MD5 SHA1 SHA512 TLSH

Submit Download

ca96ef95-c141-4911-9da0-79eabd9a500e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ca96ef95-c141-4911-9da0-79eabd9a500e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

14dda469-727b-4b0d-89ea-83b275bbf89c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\14dda469-727b-4b0d-89ea-83b275bbf89c.tmp
Size 3KB
SHA256 a4681d0a5c1c3b682c78625c40054975e8da76f557e47b246cfe60e1365dc077
MD5 e3144a2ee988b440ffb9caf632d3efb8
SHA1 9f3fdae2a7282e3f46d5d29943116131ae1ff2d0
SHA512 05c1fec65ba4ce4f22e7770004c1149f40e614ffac1d29f8bc7d34911ed00c7802f44310b7c9353a5924c35d163c2671fb6bf307b9a8ab585b1a8baa65304858
TLSH
T185816AF383E48A7DCE1196F1AA14AE1FCE690920431C7A69C4E49F1793E3471F141B5E
MD5 SHA1 SHA512 TLSH

Submit Download

6b1315e6-b126-4af4-86a4-963f55658abb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6b1315e6-b126-4af4-86a4-963f55658abb.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

859c7130-cd28-42ac-ad71-0658be5804d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\859c7130-cd28-42ac-ad71-0658be5804d4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 bf3ac412aff5ca3dd271a92cf3b380155ec03e14099286ebe7cad5b0c305b6c3
MD5 455e7ea62f7073293cadf40021968ace
SHA1 73a1a5043bf6b4f7b7c468bf819a319f94b00f6e
SHA512 a249960dfb56711cbbc90fd3947bfe9332e53755cb184204e3712e6aad8b993dcb2b6193654e191df8ffdcc4a8a28dcf1ca3c0977fc40ed9da144662b50b6fc2
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXIzZr:OtfFvpopPxrB4RhfIlr
TLSH
T1BAB2221571BA021138FE690C81B58B2F064232B33159E63B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c20d88e3-8d4a-424f-b6f6-53cb68b18101.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c20d88e3-8d4a-424f-b6f6-53cb68b18101.tmp
Size 12KB
SHA256 ea6bf1170b2b763486aa6f8a5b223ca7e54819295f3be7a229dbeb75d594080e
MD5 794b9ed9d75ceff255d87a4c00acceca
SHA1 2904f7c1a8dfbfcccd3b348c9797a379450abe47
SHA512 dd9243fc0a1fb3831cd5623ae898bbbcc9a28123c41b420e77ed25985967799c82df942df42d56792bcb7a3ecb7fb9f6254a9cfa05a15e49f3a53e1799a2a075
SSDEEP 192:sxZERPkZ/fes0QZZfuzodpmYHW6+WNGg+XYbI2RAYKaIg5zEJ:sxZEmZ/fes0OZf17HbYXFpY3VI
TLSH
T10842D855AD38693B9CC7E209BA65BF53D3F92036A0945E48A6FCCA1C04EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3df2451-cd48-465d-b9f1-4052f3a2201f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d3df2451-cd48-465d-b9f1-4052f3a2201f.tmp
Size 12KB
SHA256 f91aac903ad26f6464738a471847b47dd722f7119617d64f2b4e40ec040ca131
MD5 19a9792faebc2f13c0864c37c55fc824
SHA1 6576d5ed9d05a8b858d19e4c73edd33361e5c813
SHA512 830462360408c4b47474cac2a936d4d42c59ac6bf214b31ba7d2a4d2571cd9337040c5eebb991dddeb1d53d0de284314a9f2df3bb5dae7e0eeb65b2896e535b1
SSDEEP 192:sxZERPkZ/fesUQZZfuzodpmYHW6+WNGg+XYbIRRAYKaIg5zEJ:sxZEmZ/fesUOZf17HbYXFIY3VI
TLSH
T14E42D855AD28693B9CC7E209FA65BF53D3F92036A0945E48A6FCCA1C04EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbe152dc-050f-4c2c-86bf-bc15f270dffc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cbe152dc-050f-4c2c-86bf-bc15f270dffc.tmp
Size 26KB
SHA256 dacf8a450a0b3ee481d0040b30df5a16c1ad7a1cd355e13346079032265cacb3
MD5 7904bd97c810028b488ad32ad955aab0
SHA1 7e1ce46136d7d67dfcffd6303c4900a33b37c26a
SHA512 82cb647a6eb49664f7afa48fa8649aa0bc30a1418e270f8a81c555b583e3abbc2b960609b980a613bf90d5ceb8cf6a8732076215bfa7bf216855544f8f99e742
SSDEEP 384:nIMiFzQkUSvR3sNc8TUNTUlI465mgdm9K2fMBOHLtuVnprVlRwry90L8QQgL/7IU:I3FdR3dwgwJmBOHLtyVlRwrw0XgLc
TLSH
T133C25A32E898C9BBEDE64FA1A75A7643DEE05153C68C8AD0DAC95D5C00CB1DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 02b6b005519889c397bd256cc191b09511b21464f3629e4736c70a01b38ea3e2
MD5 a7d075766826970c85e359c879e14851
SHA1 faea5644b4698f90ccd4c2bc6189038d66dcd532
SHA512 5de3b422e7c801f02a58a2d8750519962e61a3fecf3acdfce465e8a2c8cbfc5b6e59ce077b824acde886743aab023a9b94845d846e4512070ce66384ddd5ac07
TLSH
T16E415A58BAFA1158B3B76E5A9BF2A86D447EB8772E16D45E10110E4F0A33B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download