0e30c0ca8cfc422e14df688bb3d5d99de0828cf69c7b8fbce79357f12adfcd25

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
forshellAttachBCC/FILE/PHPMailer/examples/contents.html
Size 645B
Sample260730-fx5ycsdk4v
SHA256 0e30c0ca8cfc422e14df688bb3d5d99de0828cf69c7b8fbce79357f12adfcd25
MD5 8e28283b8e1fc5599df3042b107d60de
SHA1 5eaae70a785e842129bdd60e0e0e5faa70c8cfff
SHA512 3fc39632f5e07185789e27e41e8ac2d1896e86a256dd617e71bf5e78d6230c0da9544f1092913bc74b7b7c1f6793a0db725622edb9cb848363f776566485b457
TLSH
T1E6F0625EC005120AF78297843FB2BB962E40C30ED2AB44E471C68046E48E05AFCF329C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4220	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298621763422667"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{DA86150E-A5E7-40F7-AC8D-D74C4695AA95}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5804	msedge.exe
5804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 2012	4572	msedge.exe	89
PID 4572 wrote to memory of 4308	4572	msedge.exe	90
PID 4572 wrote to memory of 4220	4572	msedge.exe	91
PID 4572 wrote to memory of 4308	4572	msedge.exe	90
PID 4572 wrote to memory of 4308	4572	msedge.exe	90
PID 4572 wrote to memory of 5520	4572	msedge.exe	92
PID 4572 wrote to memory of 5520	4572	msedge.exe	92
PID 4572 wrote to memory of 1916	4572	msedge.exe	94
PID 4572 wrote to memory of 1916	4572	msedge.exe	94
PID 4572 wrote to memory of 1916	4572	msedge.exe	94
PID 4572 wrote to memory of 4292	4572	msedge.exe	95
PID 4572 wrote to memory of 4292	4572	msedge.exe	95
PID 4572 wrote to memory of 4292	4572	msedge.exe	95
PID 4572 wrote to memory of 1672	4572	msedge.exe	96
PID 4572 wrote to memory of 5388	4572	msedge.exe	97
PID 4572 wrote to memory of 1672	4572	msedge.exe	96
PID 4572 wrote to memory of 1672	4572	msedge.exe	96
PID 4572 wrote to memory of 5388	4572	msedge.exe	97
PID 4572 wrote to memory of 5388	4572	msedge.exe	97
PID 4572 wrote to memory of 1896	4572	msedge.exe	99
PID 4572 wrote to memory of 5292	4572	msedge.exe	100
PID 4572 wrote to memory of 1896	4572	msedge.exe	99
PID 4572 wrote to memory of 5292	4572	msedge.exe	100
PID 4572 wrote to memory of 5484	4572	msedge.exe	102
PID 4572 wrote to memory of 4348	4572	msedge.exe	106
PID 4572 wrote to memory of 1292	4572	msedge.exe	107
PID 4572 wrote to memory of 4888	4572	msedge.exe	108
PID 4572 wrote to memory of 560	4572	msedge.exe	109
PID 4572 wrote to memory of 560	4572	msedge.exe	109
PID 4572 wrote to memory of 5804	4572	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\forshellAttachBCC\FILE\PHPMailer\examples\contents.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x290,0x7ff897e4c188,0x7ff897e4c194,0x7ff897e4c1a0
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,7915937244684683813,16841655201301968693,262144 --field-trial-handle=2144,i,14344880578622605226,4227243132187245263,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,483105947023610748,12340185464133295970,524288 --field-trial-handle=2144,i,14344880578622605226,4227243132187245263,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,10593242794207739922,1831238305309150081,524288 --field-trial-handle=2144,i,14344880578622605226,4227243132187245263,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:13
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,4774652267250018270,18283435549607025106,2097152 --field-trial-handle=2144,i,14344880578622605226,4227243132187245263,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,9278633673050295722,16812781157054241644,2097152 --field-trial-handle=2144,i,14344880578622605226,4227243132187245263,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,1372812228821911633,1668130328262453788,2097152 --field-trial-handle=2144,i,14344880578622605226,4227243132187245263,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,9309383140257705502,15238255736921059879,2097152 --field-trial-handle=2144,i,14344880578622605226,4227243132187245263,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:9
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,1961368900659694544,17104559815011222199,524288 --field-trial-handle=2144,i,14344880578622605226,4227243132187245263,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,2265740204331056263,15350692414904627485,524288 --field-trial-handle=2144,i,14344880578622605226,4227243132187245263,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,5793945273873251011,4826956055551103908,524288 --field-trial-handle=2144,i,14344880578622605226,4227243132187245263,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,5793945273873251011,4826956055551103908,524288 --field-trial-handle=2144,i,14344880578622605226,4227243132187245263,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,13143869216788321713,9676424099907413500,524288 --field-trial-handle=2144,i,14344880578622605226,4227243132187245263,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,7239959109286953514,16751702669131319181,524288 --field-trial-handle=2144,i,14344880578622605226,4227243132187245263,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,7610661420772511614,9710371971777881699,524288 --field-trial-handle=2144,i,14344880578622605226,4227243132187245263,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,8892151275443845135,12662980682436919157,524288 --field-trial-handle=2144,i,14344880578622605226,4227243132187245263,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6492,i,8007181245366214775,1027078833466302942,262144 --field-trial-handle=2144,i,14344880578622605226,4227243132187245263,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 58d1e9b689c3c471c335f820f7008908a5c9ad2968ec463d39d83b156c21d7f0
MD5 dca800e25a8a463171fa7eb7332fbf42
SHA1 c87b61d427beb94e80e667f6e7289280066a8ba6
SHA512 d7ab0a12ab1d1ebd53e1422b34faaf8b996d9c3beb14cc60a94c78d1219d4c7ba56c1dafc442ceaa2270e79939e4be86b2273da80c2f1d44227d69fd18626e3f
TLSH
T10751957173263FF2DBFA497132E1625832FDC44902BB1E25B0906D345C6AF99E9D5063
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596a2a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596a2a.TMP
Size 2KB
SHA256 fa6d53e408c3b27dc805f81b6aa772240f446990882d8858bd36fe3b2cd1d116
MD5 963f05ae1f9a7b015bfdf7e441dd2f34
SHA1 4635fe8d67f8de772ee6cd1906b36537f2b58421
SHA512 1e70f98b5e48139297e7fc400a09f46f06056cbea43f9ee05830ab8c39faf73e4a5d7b6b7c8971cf70d8a7b2ac9f7380a995b6d3843e1d05983f891b8b314c44
TLSH
T1FB51957133263EF2DBFA497132E1625836FDC44901BB1E25B0906D345C6AF99EDD5063
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6cc90c860db38bbf4be4285c14d7e1189b45ac8cf4d5dc845a851684010f2a6e
MD5 dc5909c9e1e9342ce6e72970704d71c8
SHA1 62f2bbf5de352568904698dcac95621a121ba94d
SHA512 a39d6c3d64a16748e758ff6e6a2d7f4d67cf7754fd2976c11eb2b47d6c94235606c23477e0b9d9337be0276391e35b320e147027ad89728bf81858eb1f241b1c
TLSH
T1C741DFF7C7E8853D890156F0BB146E2BCE2D0914832C3D5AC9E4AF1BA7E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b0ac46094f1245e4ffaa356172fb4f624b56611c5e3e9bdf34c3ceaa8f107e8a
MD5 2042812292d3e27c86ae4e6f05d21111
SHA1 b64f9c3c082bbf4053c926d477a7f99b2a9023e9
SHA512 f11f7a27218ab820ae924f733729692fc343563af31e7bb27d0ec54b3727b12373ee28a2fbfdc2cb8deabe43c4bd9abe0807c832c75a4496e4e56b4c8d184530
SSDEEP 192:sxRgRXbR/fysTtDde5lSyzoD8p4z/g6+WNIYC0uOWG9IgD1J:sxRgFR/fysTtc5lz6/5IKrD
TLSH
T16442C8166A689D3B8CC7E21DBB557F53E6F95033A1942E48B7FC8B0C04E66DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5578002ca76d87258793b54451b7cff4386068397038aeadf144b6b90e834050
MD5 cd5d667f61051821c7b9d8dc490310bb
SHA1 c14a1a4e87559b50cd79adf1c88461d5ecf784bb
SHA512 0745b1dfd94c33c11097fdc694fd3b09e535c4610d3ad909d67fc040e1a1c614b56fa2d83a1eb92c687dac97d2422eab9c9ed7423a1875baaa177380c9161571
SSDEEP 192:sxR/RXbR/fyseyDde5lSyzoD8p4z/g6+WNIYCyuOWG9IgIJ:sxR/FR/fyseyc5lz6/5IQrs
TLSH
T17E32C7166E68993B8CC7D21DBB55BF53D6F95033A1946E48F7FC860C04EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 dbd9ca3ff93b97db951e681da95025c96b45330d5f01b716231dd776084e47fe
MD5 f271bb012193174b61beaec29b063d7d
SHA1 97004ea2733bfa9ebb2dc91fd99904daed892275
SHA512 6f70935b4d20e6435028132eb862d86c051adf4b80f725c0151eddc5e19cd3b26494d1c0303d78fee079400303777abeea5fbbef4fa446e964087c97475d25fd
SSDEEP 192:sxRgRXbR/fysTyDde5lSyzoD8p4z/g6+WNIYCyuOWG9IgDzJ:sxRgFR/fysTyc5lz6/5IQrp
TLSH
T12D32C7166E68993B8CC7D21DBB55BF53D6F91033A1906E48B7FC8A0C04EA7DE221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 e48c462be56fcb162a25ac506a1a3ccb903a81b7d2b0ea3e828f7b8a36acd14d
MD5 95511a282ce81ab07be863ff55e96b19
SHA1 73bfa657f5bec84f56d344a55b4d411c5f7178f3
SHA512 d5ef07b38fd7763c48bcc1c610d65d1555e682e65ea336a8164e129fd0666981adef4e65aae44746ff6b1645536c2482ab8b725bacfb9722edf3d18a6928dfbc
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvUroZS+:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0V8
TLSH
T1A6B2EA2B600DCB7F4F800AADAC196FD76DA802CB97589D5047FED94C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ad62cdb0-e93c-430c-a317-272bc39d39ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad62cdb0-e93c-430c-a317-272bc39d39ff.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f01b914-8fce-41ba-8e7b-e5004c826991.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6f01b914-8fce-41ba-8e7b-e5004c826991.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fc69a531f8a6c74cd8386b0049d28033fe4f28cdd7db61c14ed52c05b0c76522
MD5 bbcb6d0cc37b5b918bf3b55a56dd70f0
SHA1 03c3312c1a5a6d63a87f41194f8e90a9970a4b24
SHA512 40f7e4c0f4ff7b0857ec2c56d2ba793a4e0f1b78411a4d0859bbcbb655b41344c0aed06a7bb65762e36415236c23bc91159c4c66225cb637713184ffdbfd171a
SSDEEP 768:BN3ZCFCtQRxp8+p3bd66j+4BRv86aLIWd0TAV5XNa:BN30v8+p3Z6n4yj0Tkda
TLSH
T155F2AEB2ECA999278CF5D644B28637436FF46553E2C05ED8D8ED6B0D059726E030BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 562b0b7ada065d7d61cc1a0f20f7069560e9ce2cadadf87856ae2ea511c7689a
MD5 9ba76e3840f1e57280f4076afc5ae19a
SHA1 9546ee41fc5b51592b17aaf6756d64a2c8cbada8
SHA512 06bf4836367ad75aa9193a7c1cb2bd3c9370508cb729ba180b7779f6fd0eed0d0268188be362df83909bdc04743c8ead7c430b3bc4d8a11fd8d7cb731bcbabb5
SSDEEP 768:cFQp3ZwgjCFCtQHp8+p3bd66j+4BRv86aLIWd0TAV5XNa:Pp3e8+p3Z6n4yj0Tkda
TLSH
T1D7039E73ACA8C9379CF59B44B2893743AEF55193D6C09AD8E6ED5F0D01571AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 72e7b64495d99f716ab953656e3207e9a561d1e066e6433ac2052f95574cdba8
MD5 744c9bf9eb54415056fa8694acc04c84
SHA1 042e6a70091fdccde2ef872dec91cdf8d9c75e50
SHA512 47fb24a86e2b22f68c193c588f409130456e650e645c724910aa50facff9d626dd817eefc0cfadcce433cec842568bc32822370113b05f11b969afc28dc18ab5
SSDEEP 768:MN3/CFCtQRxp8+p3bd66j+4BRv86aLIWd0TAV5XNa:MN3ev8+p3Z6n4yj0Tkda
TLSH
T1FDF2AEB2ECA999378CF5D644B28637436FF45553A2C05ED8D8ED6B0D059726E030BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e0dbb54d41204a693d43cea563cb5f9e7f060b28e909dbbd4905116b5ad91962
MD5 2c209e7b605f18a3f76dc6f6f0043e81
SHA1 36f0d9b51a36dff9249e5a5ab4f24418f25eb28d
SHA512 58b1cd8d1c2d7a9700096865853ca0c2d2da4fb67c446a62c4cbf6ed2089e20264a28f7a61d591664b01b5c2ee1d9d5e7a7d39cd6b0c41b80adb4c1bfc1776a3
SSDEEP 768:Irv+4UNbdD3IcFCtkNp8+p3bd66j+4BRv86aLIih2bwCl1:Ibsbp3jL8+p3Z6n4yj0ww
TLSH
T13B03BE73E96899339CF6C644B24676437FF851A396C10AC4E5DD2B4E015A29E230BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

640925a8-0bd4-476b-9906-a0b4e771db11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\640925a8-0bd4-476b-9906-a0b4e771db11.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download