af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260929-1092870-otsj1y.html
Size 214KB
Sample260929-3klqaatz5n
SHA256 af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20
MD5 ca2c96be8ad4c1b27afc858a639eb1f4
SHA1 34bcbb32e3946883cf26447531ab98af52bcab62
SHA512 3437202655e3eb3621e7f896424eace53f0c5f24acf844be2b9d563d88009e6cf5a37bcddba9c2cbaba921fa3f1b6b8b256eb36e35e548489e0a5a04be7cb99c
SSDEEP 3072:opm0WkXwgEweVFmk0RHyEoCmetxWnm6t6b9U9QfyA7cxGTdTbLayQsH:oglIYWRHyrCunm6t6i947gGTx3pQ4
TLSH
T13024023459202B0E3B9246B4B26575A40EF90CB3E95F96227BC801F5EFED1F29049CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4532	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{66ED8F03-E6BC-4280-828E-459BAAA88725}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe
824	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 4184	824	msedge.exe	89
PID 824 wrote to memory of 4912	824	msedge.exe	90
PID 824 wrote to memory of 4532	824	msedge.exe	91
PID 824 wrote to memory of 4912	824	msedge.exe	90
PID 824 wrote to memory of 4912	824	msedge.exe	90
PID 824 wrote to memory of 4216	824	msedge.exe	92
PID 824 wrote to memory of 4216	824	msedge.exe	92
PID 824 wrote to memory of 4512	824	msedge.exe	94
PID 824 wrote to memory of 3172	824	msedge.exe	95
PID 824 wrote to memory of 4512	824	msedge.exe	94
PID 824 wrote to memory of 4512	824	msedge.exe	94
PID 824 wrote to memory of 3172	824	msedge.exe	95
PID 824 wrote to memory of 3172	824	msedge.exe	95
PID 824 wrote to memory of 2036	824	msedge.exe	96
PID 824 wrote to memory of 5252	824	msedge.exe	97
PID 824 wrote to memory of 2036	824	msedge.exe	96
PID 824 wrote to memory of 2036	824	msedge.exe	96
PID 824 wrote to memory of 5252	824	msedge.exe	97
PID 824 wrote to memory of 5252	824	msedge.exe	97
PID 824 wrote to memory of 4796	824	msedge.exe	99
PID 824 wrote to memory of 4344	824	msedge.exe	100
PID 824 wrote to memory of 4796	824	msedge.exe	99
PID 824 wrote to memory of 4344	824	msedge.exe	100
PID 824 wrote to memory of 5712	824	msedge.exe	102
PID 824 wrote to memory of 1736	824	msedge.exe	106
PID 824 wrote to memory of 236	824	msedge.exe	107
PID 824 wrote to memory of 300	824	msedge.exe	108
PID 824 wrote to memory of 4880	824	msedge.exe	109
PID 824 wrote to memory of 4880	824	msedge.exe	109
PID 824 wrote to memory of 2520	824	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260929-1092870-otsj1y.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7ffb5f71c188,0x7ffb5f71c194,0x7ffb5f71c1a0
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,3914993833070723873,10109515093018953557,262144 --field-trial-handle=2328,i,8457719911102337024,4776330666827178229,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,10997877630649577905,16987032699145593819,524288 --field-trial-handle=2328,i,8457719911102337024,4776330666827178229,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,13998752064892139356,4759638488879153877,524288 --field-trial-handle=2328,i,8457719911102337024,4776330666827178229,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:13
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,6784562272998050089,15961403393365506925,2097152 --field-trial-handle=2328,i,8457719911102337024,4776330666827178229,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,15336021726576838679,16085991621643499867,2097152 --field-trial-handle=2328,i,8457719911102337024,4776330666827178229,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4384,i,15788844727021248689,16689637059682260423,2097152 --field-trial-handle=2328,i,8457719911102337024,4776330666827178229,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4408,i,12956732994355621684,7384542462541339801,2097152 --field-trial-handle=2328,i,8457719911102337024,4776330666827178229,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:9
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,3032104575351164476,2930996379937682184,524288 --field-trial-handle=2328,i,8457719911102337024,4776330666827178229,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,86362552295110607,5110866129783886646,524288 --field-trial-handle=2328,i,8457719911102337024,4776330666827178229,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,12543532108307729341,8971985681872592825,524288 --field-trial-handle=2328,i,8457719911102337024,4776330666827178229,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,12543532108307729341,8971985681872592825,524288 --field-trial-handle=2328,i,8457719911102337024,4776330666827178229,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,16805347626827525823,17833851494469049008,524288 --field-trial-handle=2328,i,8457719911102337024,4776330666827178229,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,2997506124857881106,15122846663146501078,524288 --field-trial-handle=2328,i,8457719911102337024,4776330666827178229,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,15365212197804629401,8255880627220324828,524288 --field-trial-handle=2328,i,8457719911102337024,4776330666827178229,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
  2⤵
  PID:300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,12545203206620373884,8379373430432300415,524288 --field-trial-handle=2328,i,8457719911102337024,4776330666827178229,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:14
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,9129308715002501981,16286140023065377137,262144 --field-trial-handle=2328,i,8457719911102337024,4776330666827178229,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 071d8f3feab47c833ecd0f657581835bc6d7f06896159ded12042f994e520df2
MD5 455757aa9ae4c393e0b72f8f0c952997
SHA1 e584c57d0a24a33aad8391112267dc22039adfdc
SHA512 bd5cbe401a0e7e5273bc0140c3a3bbf8338b9f96f85dde0e1abf58a38b2cb1492263ecc40369a325dbd57297f1c909398228e1ece842bcaf50d91d68d968ceab
TLSH
T1275198A4979BAB54FBA616B143C4A4A7FA348F899FCF5F033460EC78614A3D44A42084
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a9a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a9a4.TMP
Size 2KB
SHA256 b8d56a4db3066ed86792504fc15abd979a3a5b1789e1cec5ed958f430092def0
MD5 1fd2196ba92b5aa24a3721f346c1f31b
SHA1 c0151a39edcedaab0acf2d2f024184b0eead4791
SHA512 9cc0e1fa7115878b69e5a90ca48b2529d0fdacf9a2e27f75e8515d59e9fe82cb0ac4957bb2258d280875dad9aed265ab8754ba7d80293a337ef763ae252f0d33
TLSH
T18A51A7A4979BEB54FBA616B143C4A0A7FA348F899FCF5F0334A4EC78614A3D44A420C4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e8c95d5ef29c92b879b4143703a2804a6779db36cd03d60336e702527a777f7d
MD5 c663ae63f3652ccf84f0c0f456aa59bd
SHA1 ca29a95231fb552131c9cfdd9a6dc49d0488c178
SHA512 62ecc48fa9d33692c7b2e2e360ea99f1dc8e1f6c099a1325e289209d032adb182ed32b566c493e8400f58e63fe71e069e2febd80f4b08120188136558c165359
TLSH
T11A419EF3C3E8867D8A0156F4BA186E1BCE1D0915532C7C5AC9D4AE1B93E24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8f706fbbc8a2621a03d93e7d7aa314d0688fcef460dd0f221f53c39374a7a30a
MD5 ca660f7dfea2e91089e2742a4ddf22cd
SHA1 e42ee727f2321ec70eabec6e6d52fb16bed21a34
SHA512 dac0676a7cf6234a85bc4475ac5d16a680eb2e4dfa2e8fc7962ef5405c28f8eca5632aec667c7bd636c5290c5ae0adcb0823245dbeb7e669e5caae49ecf507e9
SSDEEP 192:sxRoRgbR/fsusiSyYhyizoA8p4Ly/g6+WNIY28cL+GhIgIJ:sxRo4R/fsusdboWy/5IPLTs
TLSH
T19032B855AD28A93B4CC7E21DFB657F53D6FD5033A0941E48A6FC862C08E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f1ba703fd80c46497fb2d929b9c6bf8016b2c19cbf092a12a7ce6cf042a8154a
MD5 bdc56fa7d0b799470c8c31e9e04c3ae8
SHA1 02ccadd2900a8796857effd8428c78c37d9aaf17
SHA512 88a6f6bb14d2388a982f0b0a14ea775562b4a317126a5cf7ddd1f29aa4dda67e3a25727e4197680f3eeeb9cc82e3076005f1e204534d0d720b0861e9ecc36be4
SSDEEP 192:sxRrRgbR/fsus/FNyYhyizoA8p4Ly/g6+WNIY2DcL+GhIgD5J:sxRr4R/fsus/DboWy/5IKLTv
TLSH
T14332CA55AD28A97B9CC7E21DFB657F53D2FD5033A0901E48A6FC862C08E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 314dce6f13e81546fbd7f59e093c2d5a90de561c69178abba713b10bddbc5de4
MD5 336391a293bf8803e314f58da7c14da3
SHA1 b1e896214954a59985ef93126d72f1622e8d497d
SHA512 71448e3062ab2088e0446e8ac54204c28e977af316ac11b13abcb2f67347381bc8cc2e836980b5e5ed578a95549c1f1c273e2af7001f4cd287f2463955920683
SSDEEP 192:sxRrRgbR/fsus/FSyYhyizoA8p4Ly/g6+WNIY28cL+GhIgDnJ:sxRr4R/fsus/gboWy/5IPLT1
TLSH
T1DA32C855AE28A93B4CCBE21DFB657F53D6FD5033A0901E48A6FC962C08E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 6bf53eb91ab2373537aeeb35a26d1ef5db4ba4b1aba9e651e1e85afb1c6119fc
MD5 13cc5194aa7ae4c0ed548a6e85344e13
SHA1 71c7fbbfa49e1b5b9a753e01dbc74482546057e9
SHA512 010442305175f4624bdac12cb3b7601ba8ceac44f31ac7073eb206feffa2011d4622a62ffb7a883fea33ad1cf6e6d56c229e5171f7dbe6a459157b3e586840ce
SSDEEP 384:LbnaaCTfCtgp/FfvDKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVPH9NvRWeroHrr:L7aaCDWgptfvD8F1+UoAYDCx9Tuqh0Vr
TLSH
T182B2EA2F640CCB7E8FC00A9DAC196F976D9802C796588D4047FE984C02C7BEA911E4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

e590881c-b332-40eb-ae0f-56facd0fd518.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e590881c-b332-40eb-ae0f-56facd0fd518.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a090f50f9cfcc70256d074783cda66cab28db82f8f07f69cc5ed8dcd2ceffd98
MD5 0e18c9b84d597b18c71ee83a437bf1da
SHA1 eb00a4b09adbabbfb221b7f1349271989b7e9b72
SHA512 4d59ca8130afe02fdf37ec844bc7a5e638b4f03761d5cadbc41dce9dfad04de43ee42884399ee39a0a7aaa8043cbdda32f916d027c853844d467f3d0fc73185f
SSDEEP 768:mX3UEhgm1IuBcIDmGA5b65Q92RQMPbXMhYGHd7t:mX3UZoAF65dQ0MhYUdt
TLSH
T174F2BE72EC60DEB39CB8A2C1765373156FF88163D1C886C094E9BF1D0597A9A431B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 ee1c98c74dbf60ec2cad4d6b8bbe2165b628dc85291b28f7473344d3686b9225
MD5 8187211f4389cc839468c8b82e22772c
SHA1 34287f43ac2b4d0cf91d7ddd243fd38f24473f28
SHA512 597dad96b8ff0d0876e0fba5f25ff64741f50a7dc28ab8ede95890e32f4c18999cd931f258c3a2e057e8983b11ab945238b45e2a4e5965dcc465c890523c427d
SSDEEP 768:SFQU3KwgTEhgm1IuByDmGA5b65Q92RQMPbXMhYGHd7t:pU3+zAF65dQ0MhYUdt
TLSH
T14C03BF73DC90DEB7ACB9A6C17A577305AFF88163C1C886D0A6D96E0D00979DD030BD6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 66c113043b8e35db8550ea5f655ff7556a0951af9047cf3c2248970444647608
MD5 c1212d4f07df94b9dc1f29d88c28e0d7
SHA1 229f844b2fdc1e7d0283dfec35353b76bef0e2ef
SHA512 190ba531b239cf3612cd95f63274e20d60d9cbe01252287bdf5f185a8392a5b2d18e9e3d3077a50001ccb7cfc56f3a9b390ce53b0d1506e7784128c78d9f102f
SSDEEP 768:HX3z+hgm1IuBcIDmGA5b65Q92RQMPbXMhYGHd7t:HX3zfoAF65dQ0MhYUdt
TLSH
T197F2BF72EC60EEB35CB9A2C1365373156FF88163D1C886C094D9BF1D0597A9A431B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8c425b903da330b73bca8034b1105122adad61f29d478a5f2394403053067d06
MD5 b6d02d74c4ea2ba70d59bd7faeac3495
SHA1 63e32f63c6fee8a758fd7854d1710b2fae7c523d
SHA512 c0f2e1176a314b974c4a1ace486b42348645082db1791848ed007ff656edb6052b2258288ee8a190fb014d8e65adafe8176bbc1fe2ff29d98b055f2bea3b5b74
SSDEEP 768:U/UxvxjgC+B3iOiJgm1IitDmGA5b65Q92RQMPbVFj0O:BZj3+B3L63AF65dQKFQO
TLSH
T1AF03CF36EC90AEB3DCF95280364BB35AAFF8456391C556E049E96E1D06C768C830B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46e21dac-8f76-4d68-a59b-e693e5267b54.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\46e21dac-8f76-4d68-a59b-e693e5267b54.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download