1773d71bab19a2d02989556432df321cc7f678a651051e55e0008a978a262e49

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-1.html
Size 16KB
Sample260629-n77hyaet9l
SHA256 1773d71bab19a2d02989556432df321cc7f678a651051e55e0008a978a262e49
MD5 0e50633e9d31ce385213ec1bc68b4358
SHA1 fbae3de256afdc358305b854544a5879752162f8
SHA512 731944e3b30f0dbd4f32c831b92d0592668424d3fc4e0b258801ccb9890f27bb6adfc8c0159d30dcb5c4687472190566c1fa47f68b7450a6607900c8ae50289b
SSDEEP 384:xPiDJsvc9bzJXsLWXXs/XqqHKlAkEdHBYmg:xPilsvc9bqwcTqlAkEZWmg
TLSH
T14872A632EB507227F90FD4A1F333BDA0AD208446C5639AB8FDA67366D9D54711720B6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2328	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1229488887-2539222828-3934045029-1000\{7D236B96-4BF4-47E2-B5A3-813ED70EBD8D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6124	msedge.exe
6124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe
5612	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5612 wrote to memory of 1808	5612	msedge.exe	87
PID 5612 wrote to memory of 2328	5612	msedge.exe	88
PID 5612 wrote to memory of 924	5612	msedge.exe	89
PID 5612 wrote to memory of 924	5612	msedge.exe	89
PID 5612 wrote to memory of 924	5612	msedge.exe	89
PID 5612 wrote to memory of 2016	5612	msedge.exe	90
PID 5612 wrote to memory of 2016	5612	msedge.exe	90
PID 5612 wrote to memory of 8	5612	msedge.exe	92
PID 5612 wrote to memory of 8	5612	msedge.exe	92
PID 5612 wrote to memory of 8	5612	msedge.exe	92
PID 5612 wrote to memory of 3776	5612	msedge.exe	93
PID 5612 wrote to memory of 3776	5612	msedge.exe	93
PID 5612 wrote to memory of 3776	5612	msedge.exe	93
PID 5612 wrote to memory of 3980	5612	msedge.exe	94
PID 5612 wrote to memory of 3504	5612	msedge.exe	95
PID 5612 wrote to memory of 3980	5612	msedge.exe	94
PID 5612 wrote to memory of 3980	5612	msedge.exe	94
PID 5612 wrote to memory of 3504	5612	msedge.exe	95
PID 5612 wrote to memory of 3504	5612	msedge.exe	95
PID 5612 wrote to memory of 5516	5612	msedge.exe	97
PID 5612 wrote to memory of 252	5612	msedge.exe	98
PID 5612 wrote to memory of 5516	5612	msedge.exe	97
PID 5612 wrote to memory of 252	5612	msedge.exe	98
PID 5612 wrote to memory of 2424	5612	msedge.exe	100
PID 5612 wrote to memory of 1524	5612	msedge.exe	103
PID 5612 wrote to memory of 2160	5612	msedge.exe	104
PID 5612 wrote to memory of 4296	5612	msedge.exe	105
PID 5612 wrote to memory of 5736	5612	msedge.exe	106
PID 5612 wrote to memory of 5736	5612	msedge.exe	106
PID 5612 wrote to memory of 6124	5612	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-1.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x2c8,0x7fffcd46c188,0x7fffcd46c194,0x7fffcd46c1a0
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,10179122785704285036,440519926992047754,524288 --field-trial-handle=2056,i,13638801253632181004,11676362891920957914,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,1718348003218276773,1289102276433912201,262144 --field-trial-handle=2056,i,13638801253632181004,11676362891920957914,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,7852207625020411019,2212993453648165364,524288 --field-trial-handle=2056,i,13638801253632181004,11676362891920957914,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:13
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3652,i,3815440972125755573,12702877054170748654,2097152 --field-trial-handle=2056,i,13638801253632181004,11676362891920957914,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3672,i,1967394319171368209,3621995017839095325,2097152 --field-trial-handle=2056,i,13638801253632181004,11676362891920957914,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,11402673251018390075,4786057848110572383,2097152 --field-trial-handle=2056,i,13638801253632181004,11676362891920957914,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,464400433483794246,17339282946397669725,2097152 --field-trial-handle=2056,i,13638801253632181004,11676362891920957914,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:9
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,13732668661375847045,6239577239386299601,524288 --field-trial-handle=2056,i,13638801253632181004,11676362891920957914,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,13109449020857523941,8665409932625112038,524288 --field-trial-handle=2056,i,13638801253632181004,11676362891920957914,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,17225740782834250282,1683931499763051303,524288 --field-trial-handle=2056,i,13638801253632181004,11676362891920957914,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,17225740782834250282,1683931499763051303,524288 --field-trial-handle=2056,i,13638801253632181004,11676362891920957914,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,3598837212156469155,16462102399831291777,524288 --field-trial-handle=2056,i,13638801253632181004,11676362891920957914,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,15105825372282005705,6727930845751482952,524288 --field-trial-handle=2056,i,13638801253632181004,11676362891920957914,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,1466266020759333657,7080426191407626208,524288 --field-trial-handle=2056,i,13638801253632181004,11676362891920957914,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,3107580738689357024,12829659666503481267,524288 --field-trial-handle=2056,i,13638801253632181004,11676362891920957914,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,11875132797387897498,8573337322537690408,262144 --field-trial-handle=2056,i,13638801253632181004,11676362891920957914,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cb1aab8db3451c27a0408de501bdfd071fd12e9f93c1f2aaf9c046596e28b26
MD5 b4d0e8cc98fb3fe09aebe9fdb614dc5d
SHA1 afc36507487a49b70badcdb587148f252e710eb2
SHA512 154aedb398b8943957e46ff27fd0eb9f43cc01f2292d8a1bdeb97bdddf07ae2281035e2034d2fb77782fb803a31b706f32fba288b5f8022ccc12122e16fd8793
TLSH
T1E3D080743A049904D5C1207178559353B234C460797BD3065151F07EEC67395639F0AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 911883306108596d1d74b6dd641b4bb8a855820a2bfdeb5121173a42913bdec6
MD5 99ccd7bf19b1d252f1dce2743aac7ef4
SHA1 6bc224e13cea9f7f331306a238ec02d763b7c138
SHA512 896c23dad6acc93b23eae4e7b42297b17047dc5ba7c3bf2b6a5adaa5d71b202b54cc8669d69ea7385955d69edd1eb8676e84a07b21183cbaca58db3fd4737cb3
TLSH
T17DD080703A149804D5C1207178559353B224C460757BD3065151F07EEC67395639F09F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 ae368d76f28c4627493e84c90f0ca6ef985334b5edc05a7ea6b26ef15805a291
MD5 5324dd56bacdba8c013c01f5ab2dd6c8
SHA1 462945c437a7a0675b308c6877afb251dc370914
SHA512 15a035f7458779c7b36dd5070ce172f3a7e2af909fedb5cf70677f936a9229819e722a5c4e579422dd2b956f6407c0043cfe0a9e0c5ee4371341a445d7df1751
TLSH
T14D3157645AFA1605CBA45E7911E37275FF30A4DA1D03FF1FB187A67C0A5970091BD040
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 937ca0b0903f6cd69e676519c0b0427a25d89986c1b081a0e456efc7b30a5d73
MD5 24593fe4b15fcae037d645645d15e9f9
SHA1 d804fc26d5deafa86dcc78b2a2e459cb1a1121c0
SHA512 2d6afe613b9f5da5c709be0d2a78d715fe654468d6a0ffdfbc09c0deafad16397a0a87f326b686c2fa2f1d921a550da93b9a5d04a05c20e2f9b19cef96ae5d55
TLSH
T161519EF7C3E8866DC91155F0AB147E2BCE2D0955832C3C56C9E4AF1B93E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f21f3c50-4a36-49b8-b7fc-4e9007d88deb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f21f3c50-4a36-49b8-b7fc-4e9007d88deb.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f45231e0db7043ad94b03c71b50c62fd745ada716cf4ab76da389955ff7f5412
MD5 84a3c871d837789bafc4bd18b59e34d1
SHA1 2f22ca00f9a97e499906fc24365572ce435060cd
SHA512 980127df347503303ee1775ac045098172bc022112c25ebbdb53fea9f3efa8677c6919c42c399ed7f44948210dff4896369d81acda7311282eaace8e3a730add
SSDEEP 192:sxRDROyM/jK1Ml8wFy/fkszFYSzegozoA8p4G/g6+WNIYob53kKJG9IgDZJ:sxRDsby/fkszFYCxH/5Il3G/
TLSH
T1B062D916AA24597BCCDBD209F645BF93D6F81573A2905E44AAFC8A0C01E76DD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ac99880d264d791d7dd04323b41f8fc93597c809425d7ab5381a3e11e0510827
MD5 d63f2cc79e8fa12aea41233c9280d834
SHA1 4713a9323e369c2cac7451ce34b9ed060649049f
SHA512 4d0959db1b72114dda06b7b84b6a248a3796938ad73e6ebbe19061a2c0220549b5427929d715261e11c945d7157fd024f99bef43e4a0632784a75c30165f8981
SSDEEP 192:sxRoROyM/jK1Ml8wFy/fksKFYSzegozoA8p4G/g6+WNIYob53kKJG9IgIJ:sxRosby/fksKFYCxH/5Il3Gs
TLSH
T16152DA159A28597BCCDBD209FA45BF53D6F81573A2905E44AEFC8A0C01E76ED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b302e6c5206185e1841fdb26a1e8ca97c566cbcb26b5b25f599cf4d9f7508935
MD5 12365ceb3b437e2eb9cc1daf07acc99c
SHA1 14af2fae81700608fec4f657d531ba55fc49fa59
SHA512 1c0b2e5241c1e94d71bc24184ef91655fd83083d8915572cf121f137f7b2c52876df932a3216b9bac9e1339d6709d5a79f2a4a4dc2bbbdd5436024d4bcdee353
SSDEEP 192:sxRDROyM/jK1Ml8UQXFy/fkszFYSzegozoA8peG/g6+WNIYob53kKJG9IgDZJ:sxRDsq1y/fkszFYCxF/5I13G/
TLSH
T1BE62DA169A34997BCCDBD219F645BF93D6F81573A2901E44AAFC8A0C01E76DD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 38f1326bbec52585cfbcee3ff7b15d157a9251e5e3be49e6ff14ea92eec20aea
MD5 d76b3093ed5774a7dbf2e06b72053744
SHA1 f83e0ffa7c72ba0a0c371b087caffc0ae7c4865e
SHA512 2afcf943dc37cd81082923632403c4a422c732acf0d2dd133cc336e3110f04b1413a3c81199df3b2b17da81cac893119c21457873603a27faf3e73f259be456e
SSDEEP 768:pMOUgbWgB1fsd8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhj/EtrolsybF:pMOUgbWgB1fsdu1jaULEGNx
TLSH
T1EBC22C2F540CC77E4F805A9DEC29BED6ADD802CB9B988D4447EA890C03C77EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5de9b2140e8782cbf91d3d94b9296f036b564001646d775e1c296c3a70543bb5
MD5 9c6d8fc1cca0d73a2c2f2a95a90ed32c
SHA1 dfead6594bfdf507414f0910c97ba4820597f07c
SHA512 42141f595078cb5599350b1d271cb99dff2a1a60b5406eabaa7b0472d1b4d8a3405af9cb1a0734f27cc1868b9c607c37e1c72ba5fc0d5d3de710c002a8136c0f
SSDEEP 48:KMwIzKBKEnyVvIlKfdI5Kec0DylxIVKii:KMwgKBK2uv+KfdqKecyuxWKii
TLSH
T156912515B1B62F00383E291E96BD942F564235D234DA656B3B6820F52F6BE004FFCADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

1126a89c-c4f3-43b0-9efe-7b967fa74408.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1126a89c-c4f3-43b0-9efe-7b967fa74408.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 befd2a0009a2d43438af8d961ac3da3311caa9436ad0c22c4f64738221bbad8f
MD5 594654d34518f27a32f3e704e166f77b
SHA1 ab1c0b576756e686ce4c64f9d22f8eb68c37a471
SHA512 949a1f2c89e32f8178fd2c1e84758f57f993b6dd28fa7103c72281669b29650102bd2cb13dac9776a4b279ce669dab2a4f043ab0048e130c57f0e5023cc7d6bb
SSDEEP 768:Aj+9J3YL0z4HSZv//lftC2OViZrq9i9e2IW6zn12bfJEV:/9J3H//lftfrpq9iA1ByJEV
TLSH
T10AF2CF729C6589639CEBD749BB47325ABEE6C21795C82F8448DC5F0D02CB2AD4317C3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 04aba1a3720bce6fcb83cee5709709997f46d31c5284fc2684c690d15e915bb4
MD5 f08cd528fc78b34573442a4d3e2ab991
SHA1 84464005d08b1caec8fd882d4d1dcb8e7880cb8e
SHA512 440557d83f38983a6f489fa5f2c9d46d03f696c6efae97d3e301f618dd527a5165c66ca57c00962b86c510d898b79982f368c3a9b2b80301a7cb81902da03a11
SSDEEP 768:hF1j+9J3BwgBLqz4HSZv//lfSC2OViZrq9i9e2IW6zn12bfJEV:g9J34//lfSfrpq9iA1ByJEV
TLSH
T1CC03AF738C94C9779DEBDB45FB463256BEE68267C5C82A8449DC5E0D029B29C4307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d87bbdd4-6018-451c-bc20-7d0f554323f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d87bbdd4-6018-451c-bc20-7d0f554323f2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f726c8c3-c618-472f-8c5b-a4f1cd9eed38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f726c8c3-c618-472f-8c5b-a4f1cd9eed38.tmp
Size 38KB
SHA256 60cba1591f84b06511fffd3154e42c4f634c88d2b8ce49add196a2559d508923
MD5 ced6313f589784cdc67e185b17bd68ea
SHA1 05f9905e9e5e93633a384637563f1d14a6042e72
SHA512 8dce7ade4cb2f83df69583daeb212d4fd691aab992d1ebe72201804d6402c703204ee7581101a72276f3381ba402b2f8d43a047c72160387eec321341fb524ee
SSDEEP 768:erv+4UNbdS3kt4HSZv/jC2OViZrq9i9e2Iiy+8rML:ebsbU3y/jfrpq9iAdDrK
TLSH
T14303CF32D8689573DCFAD745BB8A3617BEA5815799C80BC488DD2B0C029F1ED6317C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download