5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260929-1092870-u39mx.htm
Size 194B
Sample260929-x3bedavhpg
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3292	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{0EB04D7C-8B4E-4499-AEE1-755CF7E4C810}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5620	msedge.exe
5620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 4780	4124	msedge.exe	87
PID 4124 wrote to memory of 2808	4124	msedge.exe	90
PID 4124 wrote to memory of 3292	4124	msedge.exe	91
PID 4124 wrote to memory of 2808	4124	msedge.exe	90
PID 4124 wrote to memory of 2808	4124	msedge.exe	90
PID 4124 wrote to memory of 4944	4124	msedge.exe	92
PID 4124 wrote to memory of 4944	4124	msedge.exe	92
PID 4124 wrote to memory of 928	4124	msedge.exe	93
PID 4124 wrote to memory of 928	4124	msedge.exe	93
PID 4124 wrote to memory of 928	4124	msedge.exe	93
PID 4124 wrote to memory of 5584	4124	msedge.exe	94
PID 4124 wrote to memory of 5584	4124	msedge.exe	94
PID 4124 wrote to memory of 5584	4124	msedge.exe	94
PID 4124 wrote to memory of 3204	4124	msedge.exe	95
PID 4124 wrote to memory of 4384	4124	msedge.exe	96
PID 4124 wrote to memory of 3204	4124	msedge.exe	95
PID 4124 wrote to memory of 3204	4124	msedge.exe	95
PID 4124 wrote to memory of 4384	4124	msedge.exe	96
PID 4124 wrote to memory of 4384	4124	msedge.exe	96
PID 4124 wrote to memory of 3000	4124	msedge.exe	98
PID 4124 wrote to memory of 3000	4124	msedge.exe	98
PID 4124 wrote to memory of 4728	4124	msedge.exe	99
PID 4124 wrote to memory of 4728	4124	msedge.exe	99
PID 4124 wrote to memory of 4264	4124	msedge.exe	101
PID 4124 wrote to memory of 5736	4124	msedge.exe	105
PID 4124 wrote to memory of 3912	4124	msedge.exe	106
PID 4124 wrote to memory of 5104	4124	msedge.exe	107
PID 4124 wrote to memory of 2916	4124	msedge.exe	108
PID 4124 wrote to memory of 2916	4124	msedge.exe	108
PID 4124 wrote to memory of 5620	4124	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260929-1092870-u39mx.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x27c,0x7ffac12ec188,0x7ffac12ec194,0x7ffac12ec1a0
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,13439588122152518650,7316328492198560978,262144 --field-trial-handle=2228,i,7287222807494777254,35969959149928480,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,6059973841616421112,15413532353709503618,524288 --field-trial-handle=2228,i,7287222807494777254,35969959149928480,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,4285474975390660011,1299836235176820607,524288 --field-trial-handle=2228,i,7287222807494777254,35969959149928480,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:13
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3328,i,16961900283887633028,8516782605913927378,2097152 --field-trial-handle=2228,i,7287222807494777254,35969959149928480,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3332,i,1273990104603824269,5110921265949263832,2097152 --field-trial-handle=2228,i,7287222807494777254,35969959149928480,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,5802834893599089279,14617949173216371238,2097152 --field-trial-handle=2228,i,7287222807494777254,35969959149928480,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,7710667794182418414,1740303946759618405,2097152 --field-trial-handle=2228,i,7287222807494777254,35969959149928480,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:9
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,1525831356514363778,15747822439804600600,524288 --field-trial-handle=2228,i,7287222807494777254,35969959149928480,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,9887446384186521076,13953851757663622604,524288 --field-trial-handle=2228,i,7287222807494777254,35969959149928480,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,5985459886021929746,9584818658229009703,524288 --field-trial-handle=2228,i,7287222807494777254,35969959149928480,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,5985459886021929746,9584818658229009703,524288 --field-trial-handle=2228,i,7287222807494777254,35969959149928480,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,4404954684236020447,8128459324793261418,524288 --field-trial-handle=2228,i,7287222807494777254,35969959149928480,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,5382637328966773744,9191822318237869255,524288 --field-trial-handle=2228,i,7287222807494777254,35969959149928480,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,11237237178453532358,9333919716710914858,524288 --field-trial-handle=2228,i,7287222807494777254,35969959149928480,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,6805466200518015588,4952091239074110268,524288 --field-trial-handle=2228,i,7287222807494777254,35969959149928480,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5692,i,7928243688974958938,18441637188780906651,262144 --field-trial-handle=2228,i,7287222807494777254,35969959149928480,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 63f873f060634c1dd5031498ef271a81009f4ce73126d1219327f67759eaad36
MD5 f3e04d99aa1fc5e5af66416ea1b84226
SHA1 e5017709505485d423c89fcee2b0a0c0c856daec
SHA512 d118532e30ddeb02bf4e23e7bd33023f39a96a22834d9eb089ee55877880056fe858ea2af74d6ffe7ffa98fc60d611d88532d04448ece01f1e9bec058e5b127d
TLSH
T19B51C6E97C68347CDBDE99B0A5E4958B33344B794D832E039AB4E4BACFD6F514344484
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f052.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f052.TMP
Size 3KB
SHA256 8b3d1e3a381b97811c4d6361d1a01be8343a0a49e9243712ed4cef8ccf0c0163
MD5 71500e484485808b56ff1b47312804a1
SHA1 7d4249eeb0ebd2c75722d12fd1bb70063c6fecf1
SHA512 0f7f8ee8995e7563f21beeee35ed20785b7fb4c8646313ff6bdf77063c1b91f8c831408b01cacd5c15ba3a9c6e543efe94d1fb86a7775d2d60fa6838f0115fce
TLSH
T14451C6E97C68347CDBDE99B0A5E4958B33744B794D832E0399B4E4BACFD6F504344484
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7421ec61ab98e1984d1b2ee539c441643cd718787d7f8e4db31d757b53da84c8
MD5 1c52069e732a24f8f2f7cf7fe3f6c97e
SHA1 afa169979274bb28a13240257bed676373ed8b56
SHA512 7e048d921abe3abf9f3c5f935268e450c5d3e55984857ea910fc4d0794255ab969a63464900ca5a2c0a5a23460dc577136ac6bd86af5466db565580cfa90942d
TLSH
T15441AFF3C3E8867D890156F4AB186E1BCE1D0955532C3C5AC9D4EE2B93E24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fde0cf41a641c7d00bcd69e1306dc79b7c96b38e9d640e535f6b060f2cc82a77
MD5 0a9b215724ab4a7764b8d843e5f77e87
SHA1 1cd212404f9725b26e6aaa714aef888025e03b73
SHA512 445da015fea3b422a6f63bd348b8645c804db96c87aff3e77835be2aa4f3b011bf5a44ca061515591ee4ee3b7df3566839e94b9a30b73dff910228bb5da5c60b
SSDEEP 192:sxR9RObZ/fsvseyYhazoA8p4m/g6+WNIY28cZGllIgIJ:sxR9uZ/fsvsebXH/5IPOps
TLSH
T15632A815AE68A93B4CDBD21DBF65BF53D6FD1032A0905E48E6FC861C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d1b7addb366287fe172167709aa27a37833ebbb32a0ca737c10014b1931bd45a
MD5 d9bab9a59fb6988f706bb50be3cbcd64
SHA1 bc8457a8cafd895db9afc55434c7f8a68d4a7afc
SHA512 dd5a5975915036ccb8466a3c209c482781fcafc8ab7d41d0efd811351cbbcde71475a1b449533aa673d291ba81bd356e4c7c7d97ed25c5af47339a804784466a
SSDEEP 192:sxRKRObZ/fsvs/yYhazoA8p4m/g6+WNIY2ScZGllIgD+J:sxRKuZ/fsvs/bXH/5I1Op2
TLSH
T10532B915AE68A97B4CDBD21DBF65BF53D6FD5032A0905E48A6FCCA1C04EB6CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 273f038769e851d4551daa27f5c91e1bc5bb647ee58fe476578e018a805ece04
MD5 3c7a80d0fa75abc903ed995c7836c268
SHA1 ebff2495289fda422ef404f331e370b6ef308413
SHA512 0b51f617712ed41bff21074217470bb7460c6602b01dd1cc6e64c32d2c4f63e49c5d6663d0cd72e0ad9419351f121b4509f52f44925e6922a9259c99b3260fb7
SSDEEP 192:sxRKRObZ/fsvs6yYhazoA8p4m/g6+WNIY28cZGllIgDcJ:sxRKuZ/fsvs6bXH/5IPOpM
TLSH
T16C32B815AE68A97B4CDBD21DFF65BF53D6FD1032A0905E48A6FC861C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 195cfe206e4ef56e4deda34d2adf36f2dcafde427aeec76b137deb28efcf97b4
MD5 54e2050a1570366cbf5cc540882e30c6
SHA1 129997cbacfb5ec4a7fc14682bbff1820ecdac05
SHA512 081afc58a49d4a8bdfd6adf5f1ce4ab4edc0afcbf528e09916c9db1b6ea82aafc62699f4cd534a506cee53191e44d625ec21f85f021a8cffb678e97f96bbbb35
SSDEEP 384:LbnaaCTfCtgp/FfvDKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVPH9NvRWproHrw:L7aaCDWgptfvD8F1+UoAYDCx9Tuqh0Vh
TLSH
T148B2DA2F644CCB7E8FD00A9DAC596F977DA802C796588D4047FE984C02C7BEA911E4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

df3c1132-0019-4f1f-a57c-cbdc7cc5e59f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\df3c1132-0019-4f1f-a57c-cbdc7cc5e59f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 a8905b6a1cfe04a9cf0dd4d8b5eed74d0a39e34496ad619a14a6e3ff9f4e9d8c
MD5 b17c5c89c9c5bad8397354b2c64b2830
SHA1 7320f2ef7c7b44a1ce92c1d1f7e8a27348356358
SHA512 ef163aed60e31c55d1d11d93c26cad8dc7b76257f50330ec6955ce762c2270da0ac344207057e70e63969efe147093d76b829b37d919238eef1dd1be9218dae5
SSDEEP 768:n/UxvxjgC+A3S37gm1IIg3bDmGA5b65Q92RQMPb6ZVvVa:aZj3+A393dAF65dQdVvVa
TLSH
T13A03C036ECA4AD735CB562C03A4BB357AFF84523D0C996A409E96F0D06C76DD430B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3f16d4e63fb146e336b4dd28ed662aa5efc53cabfe563e0621d2a8053125eaf3
MD5 54c2e42c652abe1ad3d4e21d0ad0fb0e
SHA1 85eb97affb83e1722869b3ac4f73f0a5a96da958
SHA512 9b96902d90c5c9eb212ce9f768c3891fe4cb4f3c3d4e60da05531f4e8e99776f375fe36e2c6b68292a5431503ea24616641d176ef0263b047bd6e6165e6937f8
SSDEEP 768:713SG7gm1IIg3jDmGA5b65Q92RQMPb6ZRshuq:713M3FAF65dQdRsYq
TLSH
T171F2CF72ECA0DEB75CB952C13A87B3017FB88523D5C8868059E9AF0D05879DE430B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0a2f90e921b1d9b7f3e15e294d831f2b709220204a04ba6528b305addcf1179e
MD5 41c7e314f08d3bb86cd02f0104e43572
SHA1 2174a3ce9bdfb09af2b79f1540b0cafcff33326d
SHA512 86d55781e4d9cf94d1934a20dc10641b37967e4a9ad3a4ab796ae2e3f9f6d1d85b5b4d0c9f30609636565ba9395dd2484ba212bd282cbab675c8457cb0eda1c3
SSDEEP 768:m131G7gm1IIg3jDmGA5b65Q92RQMPb6ZRshuq:m13L3FAF65dQdRsYq
TLSH
T1F4F2CF72ECA0DEB75CB952C53A87B3017FB88523D5C8869059E9AF0D05879DE430B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 beadb8bc82f0c9685cf2e66a64ea30800eab2bcd857e274ca3819d3135de1809
MD5 84574a9660007eb3216d5860d9db34d0
SHA1 2ea0abcce4e8c9de80e484491e8a4270852bf767
SHA512 bbce04a39a73a6f641daaa8f8ae9e01f07eace13e4cbb1ef1e41994e777763ffbb387da5b800b943f6007c0a0405e6b485de70a47bcf97c3cfaf19ea7301eb72
SSDEEP 768:wFQg3Vwg3G7gm1IIgGDmGA5b65Q92RQMPb6ZRshuq:jg3J+AF65dQdRsYq
TLSH
T10F03BF73DCA4CEBBACB957C47A86B301AFF44123C5C9D690AAD9AE0D01875DD030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4209c896f2875ee78fde80771cfd25d539a23c652c04116069d28178c0c6b4d4
MD5 dad38fddc70907c1a88b327a6e5f1e19
SHA1 1673b090052061c709a33d0fa3bf087e14aba89d
SHA512 25751a966274460ee95e10aa04efca6b9a43b276a007799137d63a1116de0467cfcead353ff8fbde639b45dc27ab777010ff891deb6732fa7c4f4c27ebe026ac
SSDEEP 768:U/UxvxjgC+B3Sp5qgm1I+tDmGA5b65Q92RQMPb6WFj0O:BZj3+B3QW3AF65dQOFQO
TLSH
T1E403C036ECA4AEB3DCF95180374BA35AAFB84473C1C955A049ED6E1D06C768C830B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35e4ffd8-1564-4ea4-981a-e157e5799c80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\35e4ffd8-1564-4ea4-981a-e157e5799c80.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download