6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1092870-n37m6x.htm
Size 34KB
Sample260930-cdhf6sttdw
SHA256 6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b
MD5 764f5df3b8d286714635f98cdaff2174
SHA1 6f65b07d81db9dcfdfe1482f1ba7a14977d87aa2
SHA512 323c8e03eabf4884fba35ca5253c79f370c09e0156bea23ca0e2c10d948e608a65b47dc8cca9450afb3a81a9c61ccb77d3ff7acd935d3658b61c415597cf2e13
SSDEEP 768:9srfAOHdia5Qe2E4rY0H1UeH+NypaNKiA9b:9QAOHdl5TkY0HeNVKJ
TLSH
T1DFF2D65356D19D37067396F4BCB8BE2C95CA8D0FC248AC04743CA90C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3100	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{49A73AF6-76B1-4323-A0DF-8707397D86F9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 3748	3604	msedge.exe	89
PID 3604 wrote to memory of 3100	3604	msedge.exe	90
PID 3604 wrote to memory of 2336	3604	msedge.exe	91
PID 3604 wrote to memory of 2336	3604	msedge.exe	91
PID 3604 wrote to memory of 2336	3604	msedge.exe	91
PID 3604 wrote to memory of 4960	3604	msedge.exe	92
PID 3604 wrote to memory of 4960	3604	msedge.exe	92
PID 3604 wrote to memory of 3172	3604	msedge.exe	94
PID 3604 wrote to memory of 3400	3604	msedge.exe	95
PID 3604 wrote to memory of 3172	3604	msedge.exe	94
PID 3604 wrote to memory of 3172	3604	msedge.exe	94
PID 3604 wrote to memory of 3400	3604	msedge.exe	95
PID 3604 wrote to memory of 3400	3604	msedge.exe	95
PID 3604 wrote to memory of 124	3604	msedge.exe	96
PID 3604 wrote to memory of 240	3604	msedge.exe	97
PID 3604 wrote to memory of 124	3604	msedge.exe	96
PID 3604 wrote to memory of 124	3604	msedge.exe	96
PID 3604 wrote to memory of 240	3604	msedge.exe	97
PID 3604 wrote to memory of 240	3604	msedge.exe	97
PID 3604 wrote to memory of 5432	3604	msedge.exe	99
PID 3604 wrote to memory of 6104	3604	msedge.exe	100
PID 3604 wrote to memory of 5432	3604	msedge.exe	99
PID 3604 wrote to memory of 6104	3604	msedge.exe	100
PID 3604 wrote to memory of 3152	3604	msedge.exe	102
PID 3604 wrote to memory of 4304	3604	msedge.exe	106
PID 3604 wrote to memory of 5876	3604	msedge.exe	107
PID 3604 wrote to memory of 2744	3604	msedge.exe	108
PID 3604 wrote to memory of 4024	3604	msedge.exe	109
PID 3604 wrote to memory of 4024	3604	msedge.exe	109
PID 3604 wrote to memory of 3340	3604	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1092870-n37m6x.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff88f7ac188,0x7ff88f7ac194,0x7ff88f7ac1a0
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,1557073954619329783,17744121165844588956,524288 --field-trial-handle=2560,i,567480832747966874,6239854196945133513,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,6644661851524280469,13237454899102473508,262144 --field-trial-handle=2560,i,567480832747966874,6239854196945133513,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,2188525415091777982,86219896456095281,524288 --field-trial-handle=2560,i,567480832747966874,6239854196945133513,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:13
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,11063980851233401161,7729619706492436558,2097152 --field-trial-handle=2560,i,567480832747966874,6239854196945133513,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,7434138121767884819,13305331879347539189,2097152 --field-trial-handle=2560,i,567480832747966874,6239854196945133513,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,11915093450426950794,12570878194858984183,2097152 --field-trial-handle=2560,i,567480832747966874,6239854196945133513,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,3986014324312727652,1598611874245694603,2097152 --field-trial-handle=2560,i,567480832747966874,6239854196945133513,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:9
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,6128184691438940644,5324515221320300470,524288 --field-trial-handle=2560,i,567480832747966874,6239854196945133513,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,11739325578576284418,12049751429307295005,524288 --field-trial-handle=2560,i,567480832747966874,6239854196945133513,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,14101994581977195235,16185667333830286017,524288 --field-trial-handle=2560,i,567480832747966874,6239854196945133513,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,14101994581977195235,16185667333830286017,524288 --field-trial-handle=2560,i,567480832747966874,6239854196945133513,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,36461018978523267,9917347933454018991,524288 --field-trial-handle=2560,i,567480832747966874,6239854196945133513,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,15347373153719907658,13831317288774681517,524288 --field-trial-handle=2560,i,567480832747966874,6239854196945133513,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,6574484243417886103,7298683541062774707,524288 --field-trial-handle=2560,i,567480832747966874,6239854196945133513,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,8486871026738559761,422353327552932905,524288 --field-trial-handle=2560,i,567480832747966874,6239854196945133513,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,7053191875515721209,849756988738875507,262144 --field-trial-handle=2560,i,567480832747966874,6239854196945133513,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

23bb7274-1824-43b5-8ef6-64d49dc3cb0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\23bb7274-1824-43b5-8ef6-64d49dc3cb0f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 53fe8e8ef6ac39c7bb0b246c9aa7629b0ebcd2be1a881e343868df82f3f1c76c
MD5 9be922b8c4b88515c5d3735404c4ef8b
SHA1 8f7408362c27ce53560f5669526ca89f8e1e5321
SHA512 6ffb3c5884950e5fab854048f7ead3a296de0c4af43d6508649e782c484afe9988fa0c6c1c9703dbc317cc7004ff9e01f6d7ef1ca58a75152879b5601c990038
TLSH
T10E712C4EA759C049E7AC0938FAD0108B3B3083B2AC8F1E12179BDAB5F476BD84AD0C41
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59769d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59769d.TMP
Size 3KB
SHA256 8436f9598905cd5d732bad96a0ed5571ad11269a238ac5e03c2fa140effbc6ea
MD5 aa804adb07c11b0dd641deb02bba8d49
SHA1 85b9e62bb87530affcfd50001ae6201e6f73beb5
SHA512 aecace40a2884df159d7f10a46d60a0618f24426b9094edf4d0daf0c21c28c2027bdfa156a6f31352b4e2f656a6c56e803a470bf76b677e156b86949e30d7510
TLSH
T1F0712D4EA759C049E7AC0938FAD0108B3B3083B2AC8F1F12179BDA75F476BD84AD0C55
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 45b1ea426adb3539fd095db07a39605192892e11fb22183ba81d68f3d3861ce8
MD5 2008fb2b4cb0cdcbbb6b1cdf5c8650a9
SHA1 f757db9aaa1bda5298d1fd4a417cd603bb77509f
SHA512 d943e193806cc1e663ae8aee7b1368f198272e098d21fda9a5d9e649d8b0dae5d256d3fa0dcb2a2cefd649f0b987a2fc995f5a460eba636a483a5072e7d0274c
TLSH
T1E841AEF3C3E4866E990156F0AB14AF1BCE2D0915835C3C5AC9D4AE1B93E24B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2c505f2b78ad3b1cc3e845f640859cd271a5a0f1fe1e6e4cb46ba34e21c7005c
MD5 84038c0fcb7ddbc786f515b5a2c9cb0c
SHA1 7a6a0171fcbf1a84596a9f2a96bf57dbd095d44c
SHA512 d6794c611051206f9b10d745e5a642f70e9030096423da6fc44331407619fe4d6b017fc4baba712668a7d4ed48aeb1a8e5c31839cfacf13712f1a9807ab31027
SSDEEP 192:sxRRXRPbU/fXsxw9zoA8p41/g6+WNIYokUyGMKIgD6J:sxRRXJU/fXs6w4/5IQ3K6
TLSH
T1CD32B615AD68A97B8CCBD20DBB65BF63E2F9103260D51F58A6FC862C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ca1abb366d10f0149f3d1357cf60c1cc22d9ee7dd895f08a7987e42fc8c15bcb
MD5 a45210a0534c5904f6f101222b5f78e1
SHA1 6876016a0f9a1e211dc428d63602b5aa85bd32df
SHA512 b96e324b41529c594a64df2798146830fb41577a7b61108ec8dbf66aa1a1370e5bcab829508400b4418aa82ae1ef13746f6e2622fd3b41b312d31c6be46f7bc4
SSDEEP 192:sxRRXRPbU/fXsaw9zoA8p41/g6+WNIYojyGMKIgDoJ:sxRRXJU/fXsxw4/5I2Kw
TLSH
T11432A715AE68A97B4CCBD21DFB65BF63D2F91032A0D51E58A6FC862C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 c650e34edf7484a041973f780469c90e6dccef37e5f1d68b113dd02de0b50599
MD5 bb1ace5aef0c6f095a965bf89216bf32
SHA1 0781c21980300594491db0a51cdce0d299f9a626
SHA512 bb8962e63d758f95f9335e3de056b93fcc6580e3d2957eaca5d13745c323dc64dd7bdb87a1135170c1bc242ab054e3a67a89f70f987e6791e074facbc35bac3b
SSDEEP 384:pFZwWWPfCtg/NFf1pKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVt5931RUBrondl:p/wWWnWg/Xf1p8F1+UoAYDCx9Tuqh0Vs
TLSH
T1CAB2DA2B744CCB7F4FC04A9D9C196FDB6D9802C796588D8047FAD94C02C77EA922A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b320c6a2-d4cb-417f-85e7-74eb363bb7a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b320c6a2-d4cb-417f-85e7-74eb363bb7a2.tmp
Size 10KB
SHA256 b5a01ca046cb6f236eab68555f820bd76ca5e29ad91e1bd06c15f70e6d2164f3
MD5 e489ebf22fea7717c850dbe3bb78b15b
SHA1 fcc50c96082f74eb66d3d6b1d4ecf47ecaf13180
SHA512 65aefd0077ca7160db98dedc3becfb9b834c060c2c7a0b426d7003c5e80b1759f62ee4b45e813d16e35d791c124a7c4b4699990cee9af4db8bd423790d8ec603
SSDEEP 192:sxRR8RPbU/fXsrw9zoA8p41/g6+WNIYojyGMKIgIJ:sxRR8JU/fXskw4/5I2Ks
TLSH
T1B222B7156E68A97B8CCBD20DFB65BF63D2F91032A0D51E58A6FC862C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6d35838-46fc-468f-a075-9752f5ab50d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e6d35838-46fc-468f-a075-9752f5ab50d4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 7d16f399baa1e49ca1891569baf2aaf387a5d20ff82212946810a962633e0d1a
MD5 ed983b24693c003f84e9e239162ae742
SHA1 6b657cbef464447a58daf1422d7fa8cd29d29dc8
SHA512 e5ad7d1641f5b013d53728f114133c61deadf2dbdb3113c6d6c7130c3ee5c9600f98c40b9a9112e7ea19ab55628347f1d477c8d9a0dadc8d26005854bf710547
SSDEEP 768:Aa3iyI4OE+3L/9OA9at01j0iq00+IaiS2syRm:Aa3iyCECHq00Na52s2m
TLSH
T158F2AF71ECB5CE776CF6A284B30673865FF44623C6C99A9088EE2A1D00476AE1707C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 e5eee460ebf76957b5c986ecc7329fff67949b045b44ebc0475c724b1ad5a522
MD5 0e866b83a4d6f8321f9dbc153c8de517
SHA1 cc13a87de9fcfcfa21895cc4f0480dc42cd9bf48
SHA512 0b4323aa04cc66fb3cb636bb7f7406b9cc1762e61a2a2216dd5fd010948f04d0532a1a419dbe44aae6ffdfadf020ab6bd30b83ed9e531b2bd720453dea553094
SSDEEP 768:pFQ93ewgjyI4OE+3r/9OA9at01j0iq00+IaiS2syRm:o93wyCkCHq00Na52s2m
TLSH
T113F2AF72DCA4CAB7BDFAA784B70673469FF40263C6C9DA9095DE291D00476ED1307C62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a69603aa977d85d28adac8ecf880cdeca9b0920d929f73f1739af960481c4ba1
MD5 a0b9b6d08b5abd01df3774dee6504248
SHA1 d0e2f5039266f9f0fd9f39c8369aa9e96c2def1e
SHA512 207cb6aed83f9b7761fc2144ac852731ae2670e1dac685202c0898b00d69c3c0111d213da421cbde0df5fb3dca83444d7e1f6dbbe61457614c2a4052eff37960
SSDEEP 768:t/UxvxjgC+P38yF4OE+3Q/9OA9at01j0iq00+IaiSOF:QZj3+P38yf5CHq00Na5OF
TLSH
T14003BF31ECB59D73ACF6B684B20623979FF40523C1C99AA449EE2E0D05877AE1707C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5cbacdb33f5c61b2b13efc7247b032e13f636da25843b416d5670f97e9f1205b
MD5 3423ee83e7f53cf7b72ab872892e5035
SHA1 7854bf63495194bbcce45510e12e58e981f94ebf
SHA512 07e5192fbc3d8c9c3524fcef4722cb023dcaba7ce7e4a7dd157b81b4a4e0d98fa55458d00b2e3cbc647a93d87bce6a8cd4e0db8aa4ef3c6067aafd4e62db043a
SSDEEP 768:Ba3XyI4OE+3L/9OA9at01j0iq00+IaiS2syRm:Ba3XyCECHq00Na52s2m
TLSH
T1FAF2BF71ECB5CE776CF6A284B30673865FF44623C6C99B9088EE2A1D00476AE1707C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 a0d3b95760318f15ffc81e59030ef5151324ece8355b08de84e3f32d2f27accb
MD5 cdf27c0f7eb0fa07e27e1dfd9ec6eadd
SHA1 f6a8e49cde41ace1fab873411ddf46f0b17287d9
SHA512 795ea49eaf4fa6a4fc18d348956cbad9f2a4314e5affa1ff8db2a0e0238f1b8f69565203fe42a10ac6d49a0618e61515f5e4caac51b9d75c56a3870f271225ae
SSDEEP 768:X/UxvxjgC+H3VUEOEA/9OA9at01j0iq00+Ia2ZSHxRz:KZj3+H3V7CHq00Na6STz
TLSH
T1CA03C031ECA19D739CF7B384730A63979FF44663C6C96AA049ED2A0D05876AD1307CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download