b0980ae8812f8f56e2f6a60d14c8f2f018f4147daa3e4ff8851d98a113652f94

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zone_contents/index.html
Size 1KB
Sample260928-pmbffavvft
SHA256 b0980ae8812f8f56e2f6a60d14c8f2f018f4147daa3e4ff8851d98a113652f94
MD5 61a9dc44f96cd06d18aba24f0dae6ca4
SHA1 9830740b9547bc487f4e337be56d185e0c2e9ef9
SHA512 8999b3ec54d6a4433a1d19832dadf1a73178899f7b74e1336ed81d91ccd9a73816ff3ac268547f3a9f78f0b179bd054524ad863d53a294a4afbc89ea4f29b396
TLSH
T1C8116AAE0580A06B43A4D740398B7B3D674713E598807D8292B2A52BC5D0FF45E8D3EB
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3164	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{BD2ACAC1-8D31-4B03-AA1D-7BE68AE14B5D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5688 wrote to memory of 2964	5688	msedge.exe	88
PID 5688 wrote to memory of 3432	5688	msedge.exe	89
PID 5688 wrote to memory of 3164	5688	msedge.exe	90
PID 5688 wrote to memory of 3432	5688	msedge.exe	89
PID 5688 wrote to memory of 3432	5688	msedge.exe	89
PID 5688 wrote to memory of 5832	5688	msedge.exe	92
PID 5688 wrote to memory of 5832	5688	msedge.exe	92
PID 5688 wrote to memory of 4804	5688	msedge.exe	93
PID 5688 wrote to memory of 4804	5688	msedge.exe	93
PID 5688 wrote to memory of 4804	5688	msedge.exe	93
PID 5688 wrote to memory of 1744	5688	msedge.exe	94
PID 5688 wrote to memory of 1744	5688	msedge.exe	94
PID 5688 wrote to memory of 1744	5688	msedge.exe	94
PID 5688 wrote to memory of 5672	5688	msedge.exe	95
PID 5688 wrote to memory of 5672	5688	msedge.exe	95
PID 5688 wrote to memory of 5672	5688	msedge.exe	95
PID 5688 wrote to memory of 5160	5688	msedge.exe	96
PID 5688 wrote to memory of 5160	5688	msedge.exe	96
PID 5688 wrote to memory of 5160	5688	msedge.exe	96
PID 5688 wrote to memory of 5776	5688	msedge.exe	98
PID 5688 wrote to memory of 812	5688	msedge.exe	99
PID 5688 wrote to memory of 5776	5688	msedge.exe	98
PID 5688 wrote to memory of 812	5688	msedge.exe	99
PID 5688 wrote to memory of 6104	5688	msedge.exe	101
PID 5688 wrote to memory of 4932	5688	msedge.exe	105
PID 5688 wrote to memory of 2764	5688	msedge.exe	106
PID 5688 wrote to memory of 2492	5688	msedge.exe	107
PID 5688 wrote to memory of 5684	5688	msedge.exe	108
PID 5688 wrote to memory of 5684	5688	msedge.exe	108
PID 5688 wrote to memory of 2796	5688	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\zone_contents\index.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffb188bc188,0x7ffb188bc194,0x7ffb188bc1a0
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,16699907657541599209,15923069530284453797,262144 --field-trial-handle=2352,i,17721502331313338470,4876911083880183020,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,1690462935048459620,14178973419154602310,524288 --field-trial-handle=2352,i,17721502331313338470,4876911083880183020,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,11695350801344111973,1353107241905810903,524288 --field-trial-handle=2352,i,17721502331313338470,4876911083880183020,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:13
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3644,i,590836761731652229,11997081570374869443,2097152 --field-trial-handle=2352,i,17721502331313338470,4876911083880183020,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3660,i,3847434518417494354,14274955321703604932,2097152 --field-trial-handle=2352,i,17721502331313338470,4876911083880183020,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,2832335563467499355,3808538030013682190,2097152 --field-trial-handle=2352,i,17721502331313338470,4876911083880183020,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,12065339174073577021,17575869937686106401,2097152 --field-trial-handle=2352,i,17721502331313338470,4876911083880183020,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:9
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,787902621953968762,1364110629844601651,524288 --field-trial-handle=2352,i,17721502331313338470,4876911083880183020,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,2995495331937721206,14492048774428770555,524288 --field-trial-handle=2352,i,17721502331313338470,4876911083880183020,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,13395280657887620055,3503403646971825545,524288 --field-trial-handle=2352,i,17721502331313338470,4876911083880183020,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,13395280657887620055,3503403646971825545,524288 --field-trial-handle=2352,i,17721502331313338470,4876911083880183020,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,15477044170138938837,5106517888163423044,524288 --field-trial-handle=2352,i,17721502331313338470,4876911083880183020,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,12247677077797754122,9733152281352383789,524288 --field-trial-handle=2352,i,17721502331313338470,4876911083880183020,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,8481852966625595137,11206785088230795112,524288 --field-trial-handle=2352,i,17721502331313338470,4876911083880183020,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,4166353578972382337,2429813824091072739,524288 --field-trial-handle=2352,i,17721502331313338470,4876911083880183020,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5568,i,4638851541014908810,3661046591444189006,262144 --field-trial-handle=2352,i,17721502331313338470,4876911083880183020,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1be9db7252cbe034c430708070ce59abd419a10d97e564906c8e351db34e7055
MD5 92e1dabff72a67ff36a755e35c2aff52
SHA1 eb0b6a096b56c9ea808c171353e2d9ead9a7af26
SHA512 08da3d0e6ba74eb7f70667796ca61f751e45f563110db05e396780c6140e4fff41e138af095e10d55772ffd3821a6e0346bd00084ecb20ec89dd2d8bdf1aa084
TLSH
T1A651524B93B24C25EBA2413D91E313CF3B3BC570655F2E020AA4C0B9BB4EB387220C46
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fcf4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59fcf4.TMP
Size 2KB
SHA256 6638c524821bbc91424c057d2dc593c9c9a546cb3a6411eb1a48c3e02f6ef696
MD5 3ecaa49efd37874eb9f0c2a9a440c31d
SHA1 c908cb10cc253258957eec8d8d814eaaa2e10219
SHA512 87bee94f3bd0b2cf4b15cd84f8b702dd60cf240df529a746d277b46e3435ef7c3a06d2ef155618aa9b7737fb0489145f718294686f87aefbc1beaf8cc7c449a8
TLSH
T1F551444B97A24C25EBA2413D91E613CF3B7BD570655F2E020AA4C0B9BB4EB387224C42
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 46e57dbbccd09002fbcc9a5a3e2bfe2eba87100ec19e3ae55f2386e4f87cb06f
MD5 5a84f5fd5ed9e9454a235ccaab649aed
SHA1 beb50c0f1d126bb481c3189237e82591b2b14eb2
SHA512 78f9587a380938e9a62efa30389dbd879d28aa22edeafed89168bca194400a9ea457a670f94a321a55690f637e276c8fd0c626d2edfc3a6e5d9a9318f67d4f69
TLSH
T1AF41A2F3C3E8867D890156F4AB186E1BCE1D0915432C7D56C8E4DE1B93E34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fc62c8897e8bf0866295d5e44462146628e7ed34efd7a3ac96d2c5f8f4ef91d4
MD5 90f230906ed570a50b78c2972cfb59ae
SHA1 1022c6eec35953fb58e83a1fcd51d932135808c5
SHA512 2f1a2da56489f5439615ff50d0fd8249101709009ebb7133af5cb446d922c2e2bf8d6b857e77c8823ef4e651083599ce6a3535b4099b6cf846faf0818236f1bd
SSDEEP 192:sxRERdbo/fosUvHR74zoA8p4f/g6+WNIYE5hGgIgD+J:sxREro/fos4f2/5IVe
TLSH
T1A032B715A928A97B8CCBE21DFB557F13D7F95032A0901E48F6FC8A1C04E76DE221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1d54d8ac2892db418e3b14d5a0aa7b131735915513c895a2400ddcf4d83f7a19
MD5 a9e0920317633e9ecbbfe3494bfb3bd9
SHA1 dd999f0c9e98aa347c2f33962ebbe85c37494406
SHA512 9bb61e08f154bae701380b763757d450a362eff4c5079b6f426e9ace72615972043f302430fee33da2efbb282c71870d3263102f6b491b5be141c8638a9a9791
SSDEEP 192:sxRERdbo/fosCvHR74zoA8p4f/g6+WNIYEIhGgIgDcJ:sxREro/fosKf2/5IWE
TLSH
T1D032A615AA28A97B8CCBD21DFB657F53D7F95032A1901E48F6FC8A1C04E76DD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2b22d283748674f127c124e7eed3493cc327be9c2500bda5b7b6d371e3f55bd3
MD5 bbde32f9588b1589bb26cb8841e01c72
SHA1 06c2bf1ae3d7bf43dc5fb66441f671642a7cb841
SHA512 43db8a2ca9e385858dcef01280585c41b917329cc2ea97c375599b1cf8b8926b93b4671e8a1496f4e3303374cc2d7e4b0f7deca923559cc115ba41a03c528329
SSDEEP 192:sxRTRdbo/fosCvHR74zoA8p4f/g6+WNIYEIhGgIgIJ:sxRTro/fosKf2/5IWs
TLSH
T11B32A615AA28A97B8CCBD21DFB657F53D7F95032A1901E48F6FC861C04E66DD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 f1239fbc98eefcefd1dc608fccc7dd0d2d7169f4225ba05f51e08d25ec8df46a
MD5 d56e3e90cc72545b141b0628e2f3450f
SHA1 821e4123973c2c51fa0e8a13e5f17b059aacbe47
SHA512 9daeb06aaa877b5374f9855e1cc5934a190a1ec0a4961ce038c0dd231129267148c06f5a2a5f64cf24362ed50793492f119df9907926c842cff1045f31f786f4
SSDEEP 384:USupCD0fCtg82FfrLKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVQc9hnRXtroJet:U/pCDmWg8KfrL8F1+UoAYDCx9Tuqh0VW
TLSH
T1E1B2DA2B640CCB7F4FC04A9EAC196FD77D9802CB9A588D4047FE995C02C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dfb3d91dad2160adbba76eea193a39bcd67b324d622aac29e91f154a96f02837
MD5 53cd73a9651e43f1d565ed64faa2fbf8
SHA1 1a9efce32245137e19f72d9ad7d51ed1ef4d1f60
SHA512 5ad0794ce23a44cc76234bc13c313027319bd5c8e99be0a4cfe9d70e97446f53f303bab1cf44d7555c212e5ef664c69d596ce2f51ac9b1928ee14e49558a912c
SSDEEP 96:KkYwKpeO6aduIKbq2JhEPjhf/xKD6s8LxKU48BxgA:qXOLXs
TLSH
T14B919505B5BE02403CBF695985B4866F66423273305DEA7B7BAD10E24E6AE0D5CFCDC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a953c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a953c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 2e47098de9c603017edfc0e17c3fb980ece76fec80ae0f1002f527db6595c79e
MD5 dad400a5b43d046a08eb4590d6119e74
SHA1 2db07adc7cd424830fd5dcecb417c40e2029c22a
SHA512 50a19f6701f60ef101072196bfe34d9d51f7d55dd54204472565b6b71404b8b3a062cd15b21e6f624c92bb4cc47f47217f923ef7d2e983504a240e034f3e1592
SSDEEP 768:Ox3CwJAc7fZrKip5XSwQs88uBkiT2D2sDW:Ox3CwJtr1ILNBm2sDW
TLSH
T16BF2AF35EC9098B3ACF7E3867A4637026FF05057C4C80B9489EE661E029776E534B86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 74b801eadcae3b2b34c895c97b3be3d54288234d44fa07d0acce0a5dfdf4fb45
MD5 d17fab21f270b75bc00267ddb5946895
SHA1 703d8aff6d7d02d463f9a6f19ee94925d94f7558
SHA512 bee40a9677e22a091b70b9e9ea421570f29c039d8ef7ee1d4ae829dcaf98e0fee43080312682e6aa101e6936ef9f43b9bc0999353edd3d54b74660625a8b4d0b
SSDEEP 768:qx3twTAc7fZrKjp5XSwQs88uBkiT2D2sDW:qx3twntrKILNBm2sDW
TLSH
T1A0F2AF35EC9098B3ACF7E3867A5B37022FF05157C4C40B9489EE661E02977AE534B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 b21fb14a4462417771628714fa22e8fe4b29093859cbf278d286ee46a8af24c9
MD5 2c76fa74d701674118a8f8814ff71d66
SHA1 ffbde32139a62fd44ee40145dacfdb23a28f8d3c
SHA512 5e766aad36baf3ffa5bad7902238fb9a5eb530db75a1f037c2c0255166082672ed22106881bcd262b23a049df271d6b8ff184e7aa3078e1175d4e18a6a45f3a7
SSDEEP 768:hFQ83LwgmwJAc7fZrKs5p5XSwQs88uBkiT2D2sDW:w83cwJtrFnILNBm2sDW
TLSH
T158F2BE32DC90C4B7BCBBE785BB4A37026FF05057C8C45A94DADE651E02972AD134BCA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 347e4ef4bcd1c9792c8c9168a241504be04365a5f540c94f19a39e39d94d439e
MD5 442b60b90151f068ef4c5b040cd23d30
SHA1 c16cac6e2e071f77f3711363b8394b4795c8df78
SHA512 07498a7b19c065e1143e1f58a44bc1f3b76eb7d1a8c633f016469f490c3d05ef56b6d13c2519d547ac91765fcc6dd28f62baf65fbb2d428548ed91535e5be541
SSDEEP 768:R/UxvxjgC+W3gw3c7fZrK6p5XSwQs88uBkiTC4/P84g:kZj3+W3gvtrtILNB9Hg
TLSH
T17603D039FC945863ACF393853B5A275BAFF05063C4C41BA849EE7A1E028B75D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51ba0c10-5456-48d3-bbff-649d3569079a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\51ba0c10-5456-48d3-bbff-649d3569079a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/6104-173-0x00000201D89D0000-0x00000201D8D8B000-memory.dmp

Download

memory/6104-164-0x00000201D89D0000-0x00000201D8D8B000-memory.dmp

Download