5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1092870-nh0exz.htm
Size 1KB
Sample260930-dwvd5adf44
SHA256 5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2
MD5 3a134f40128e3382caf68c7037564ce6
SHA1 d53f727b1b15ed1d2286e65613578331cb2a01f7
SHA512 7dc021062e3dd4f2601fa8291c6c7370bcb1b579bc09aac01ed304c2dfe255c0a67248a2e7b90940563d9c914749f0488d85f55208a5f48bf413f651b735d21e
TLSH
T1FD11CCDB03E23DA45493333764434B8EDF380175E7724F753475211A138A29AD4239F4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4572	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{BE658E4F-4FE0-4858-9C3F-47B69D5A7159}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 936	948	msedge.exe	89
PID 948 wrote to memory of 4572	948	msedge.exe	90
PID 948 wrote to memory of 5216	948	msedge.exe	91
PID 948 wrote to memory of 5216	948	msedge.exe	91
PID 948 wrote to memory of 5248	948	msedge.exe	92
PID 948 wrote to memory of 5248	948	msedge.exe	92
PID 948 wrote to memory of 5248	948	msedge.exe	92
PID 948 wrote to memory of 4428	948	msedge.exe	94
PID 948 wrote to memory of 4428	948	msedge.exe	94
PID 948 wrote to memory of 4428	948	msedge.exe	94
PID 948 wrote to memory of 1208	948	msedge.exe	95
PID 948 wrote to memory of 1208	948	msedge.exe	95
PID 948 wrote to memory of 1208	948	msedge.exe	95
PID 948 wrote to memory of 4648	948	msedge.exe	96
PID 948 wrote to memory of 5864	948	msedge.exe	97
PID 948 wrote to memory of 4648	948	msedge.exe	96
PID 948 wrote to memory of 4648	948	msedge.exe	96
PID 948 wrote to memory of 5864	948	msedge.exe	97
PID 948 wrote to memory of 5864	948	msedge.exe	97
PID 948 wrote to memory of 5196	948	msedge.exe	99
PID 948 wrote to memory of 2364	948	msedge.exe	100
PID 948 wrote to memory of 5196	948	msedge.exe	99
PID 948 wrote to memory of 2364	948	msedge.exe	100
PID 948 wrote to memory of 4340	948	msedge.exe	102
PID 948 wrote to memory of 1284	948	msedge.exe	106
PID 948 wrote to memory of 1164	948	msedge.exe	107
PID 948 wrote to memory of 3992	948	msedge.exe	108
PID 948 wrote to memory of 1612	948	msedge.exe	109
PID 948 wrote to memory of 1612	948	msedge.exe	109
PID 948 wrote to memory of 4568	948	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1092870-nh0exz.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd314cc188,0x7ffd314cc194,0x7ffd314cc1a0
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,3008443551645418833,5837812212450267545,524288 --field-trial-handle=2248,i,11621726677507118925,17074224903019271036,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,13384887288323986147,13047170832467125500,524288 --field-trial-handle=2248,i,11621726677507118925,17074224903019271036,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:13
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,8557845200399606261,2796265381596589644,262144 --field-trial-handle=2248,i,11621726677507118925,17074224903019271036,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,10930449329483136360,17710322110183353634,2097152 --field-trial-handle=2248,i,11621726677507118925,17074224903019271036,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,10233910345466183333,12516572506182680349,2097152 --field-trial-handle=2248,i,11621726677507118925,17074224903019271036,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4368,i,11419420593630334653,10165739951040445114,2097152 --field-trial-handle=2248,i,11621726677507118925,17074224903019271036,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,17054267093867981845,4026383516211463271,2097152 --field-trial-handle=2248,i,11621726677507118925,17074224903019271036,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,16237332249480257282,8635188467760803307,524288 --field-trial-handle=2248,i,11621726677507118925,17074224903019271036,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,14913781785483440296,10395543004491651767,524288 --field-trial-handle=2248,i,11621726677507118925,17074224903019271036,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,10765249120149092624,17373201349729676296,524288 --field-trial-handle=2248,i,11621726677507118925,17074224903019271036,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,10765249120149092624,17373201349729676296,524288 --field-trial-handle=2248,i,11621726677507118925,17074224903019271036,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,549704587207088597,13609103966981420752,524288 --field-trial-handle=2248,i,11621726677507118925,17074224903019271036,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,14777996028204515614,6318679589369824924,524288 --field-trial-handle=2248,i,11621726677507118925,17074224903019271036,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,17903100271319918347,12585616645348702451,524288 --field-trial-handle=2248,i,11621726677507118925,17074224903019271036,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,12458945729109659124,14279105027015842896,524288 --field-trial-handle=2248,i,11621726677507118925,17074224903019271036,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,1018730853847858757,17634732688293860590,262144 --field-trial-handle=2248,i,11621726677507118925,17074224903019271036,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

09521b2c-22c6-477a-aeb0-7a9567fcdba8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\09521b2c-22c6-477a-aeb0-7a9567fcdba8.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 94095d9b0baf28908874aacf19b7a5a364cb84716c3a584506772b1d23d767f9
MD5 6c80df73961ecd83a33e78f0ddbaf56c
SHA1 5ec035477b23dd2393fbf35958315a3a758b5012
SHA512 d90581cdb8fb773592a0a17d7caea0a5892d9d9a242696f31cd0c220d99afbe91cc642fc405c5ab29e5212b4238d06a30335ec87a9e9f455165f69c0a6ddf95c
TLSH
T11641FC811FA880B1FB9C0030C5F4FE877B759B96548F1E1D3559C9F8AA763EC9193408
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e0ebbc7545c0b3320992fdaf88af2760b9a3f5ef4a9c570954d95c3db1ddac97
MD5 5a8c096bed5b9250bff382b1cd0636e0
SHA1 92d8bdd9a823ee38b6f669d9290af50e9bb1973a
SHA512 4f1334a4bea479e3c1afa23a4c99946e6bce4059cf387404130b05c49d2d18024cb28cac14e53458abcc91e7e1fb8c2286e51a443277425198b1d26f08067794
TLSH
T15741ACF3C3E5866E890156F0AB14BE2BCE1D0915832C3D5AC9E4EE2B93F24B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 90a33895f7758f0abb4a0b0f03076af1feb56557db97e56f9631f3c5bab0da44
MD5 981ec96fc769efc117be3d3bb7a125fd
SHA1 f910ce201d252087e9ed7796939a2438d65538a5
SHA512 ea4ba1fb7ea4173e4c3ce31e32b47375ddb99d9e8cdba228aae740b858211e49b00aad4a0f1a2db3fdd78712824c9fd8af14f0de0a76ca76cb78d6e7ccd3f68d
SSDEEP 192:sxR7RNbX/fPsJBzoA8p4Q/g6+WNIYFIFGYIgIJ:sxR7PX/fPsJ81/5Ivs
TLSH
T1F832A515AD68A93B8CCBE20DBB657F63D2FD1032A1951E48A7FC861C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a3e6c735ec8eea881d900a3959610e05f91fc8ba55f8b44fdaea93f3ab657cb8
MD5 3053b563154238fd2ea37232bf7da841
SHA1 864b7d6acadf526b83bb3b774aa0bcdcc1cc0cba
SHA512 8e2467bbe426756524022092179ec3d8625bf47eae7698bb16ae3875209bdae2e4ab6552964765cbcdab47e1cf600849fbb835edd53b254f5462d9d13cb2bdf8
SSDEEP 192:sxRoRNbX/fPszBzoA8p4Q/g6+WNIYFhFGYIgDi9J:sxRoPX/fPsz81/5I6WH
TLSH
T16932A615AD68A97B8CCBE20DBB557F63D2FD103261951F48A7FC861C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2331fa63867f71867351249c1c38d6f871cf30b84ea448b6ff58306f31463834
MD5 860c20e1371e0f13ed989d08d4a4644e
SHA1 0db4c325a3e34253771406d168dfdd54539b46e1
SHA512 d5509ee676cdeed9ac0506bcb90d049b1f1a3494244a2dc57cab1e120bb5b28db546f5f3bc317109ad56355e08c08077714be4a28bfe2bf1920563527bdec0ed
SSDEEP 192:sxRoRNbX/fPsaBzoA8p4Q/g6+WNIYFIFGYIgDirJ:sxRoPX/fPsa81/5IvW9
TLSH
T17832A515AD68A97B8CCBE20DBB657F63D2FD1032A1951E48A7FC861C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 84ebe763bd16ceba8f5cc7e410e405b173de1a62ac4ba6a381e8d0f3819c8210
MD5 35ba4decb476b68bc62fa83793fff2f1
SHA1 eb0d48f5d6cbb81b45ef35fc841d5b0230b4655e
SHA512 fe6cc25179ad793eb6b6aada4a27d16607da4bba84b2562bea6debbd3042207363fb8f084edeb6f170a91c141a19b560c24a1262ef857cbd8f0b3c3efb8df171
SSDEEP 384:+0e2P7wfCtgwiFf4eKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVS29aSRnqro+PE:+l2P7KWgwef4e8F1+UoAYDCx9Tuqh0V2
TLSH
T161B2D92F640CCB7E4FD04A9DAC196EDB6DAC02C796588D4047FE994C03C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 219278a260c3da113295b913c429594afeb6413b74dcf79312e387e9408b54c4
MD5 9094ba23d61d5f16d1a9229b7485548c
SHA1 cf74e7f74ac64cf5765aadb885cc6b5819c23912
SHA512 1bdf4fa1100e42a653c5e34588619234471d136eb06fa204b3c4447ee3975071cf1abf2e019d8b584bcddb0a4b7034504dfbc088e9c86f6f58708ad4525c5935
SSDEEP 24:KYe5WYsI5KihA1iSbs1yXrL7onYTIXKvhm1qS2xVtrmMtrutrjtr7DtroitrVtr0:KQXI5K0AkTy7OYIXKJmUxaI/KPaILyBz
TLSH
T1E09177617037160039BE794D90D9976F828232737418FA6B7FFB00658E5AE085DBD9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59e67e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59e67e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e4578a17a0af9682e3005424dc1443a15b42938d55afaaf12437f5655432828e
MD5 175675b8d3b2f0e6dfe3d897f587e950
SHA1 5c38df34f713ad747acfb8e8ba3bad8fca6369a0
SHA512 cb0d0201b6678538c6af51a2cf56e93192a8c13183e30b619b8048a54cc3195d98101c9500d92f75342b8d47e210a4d2ec05b4150e32cd9ef5abcb6f28d664d1
SSDEEP 768:v/UxvxjgC+/3hNf9clYvOyyEMbxyJugQVTJ7vvmeX1of4:CZj3+/3lV5yEmxyJJq17vrof4
TLSH
T14B03C036A8A59C739DF2D2807249A7D7EFF4067394C62A9889DD5E0E068B3BC5307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 52fc57d484ae1505d9b75359c99e8d9f7ef4fe822b35661c5401827f4b4fa888
MD5 a0d46a006d97b2bfc904b72e060998f7
SHA1 844f604938c09204212ed7f6c12fdb0a18b80ede
SHA512 bb8d4c5d059f688eea96759d12147a9b91fb11ae175105a340ec3522a7d89d034533739c37b1e5de38f842a88995d11f77b643b8f10364cbd6857ec30e244ae8
SSDEEP 768:sW3SNf9clYvOyyEMbxyJugQVTJ7vvmeX14YGHnUy:sW3OV5yEmxyJJq17vr4YUUy
TLSH
T1BFF2BF329CA58C739CF6D2C5B645BA83AEF4426394CA1A84C5DD6F1E124B7AD2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 5f30117f828b2e424815f23d45353c337367e8998d48de16e2700a3635941833
MD5 2fc9057b6f2f935b8229896a8afd602e
SHA1 e50f7e4533f5a97f95858f2dfe7cdf9fa34e2648
SHA512 a08eddf4cc412a1dda77f6f9529f3fbdf0cc1f45cce00df061a63a472ce363cff7576b880ffd7e11a6b2d9660f1ef29bd89487af18c2e7efdf7b11507ad1e366
SSDEEP 768:pFQ73awgBNf9clYvOLyEMbxyJugQVTJ7vvmeX14YGHnUy:o73cVyyEmxyJJq17vr4YUUy
TLSH
T1A7F2AF338CA5CD77ADFAD7C5B645B683AEF502A3C4865684D6CD5E0D124B2EC2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 4aea7dda5f49812cb38e37c3419c228e92d960b15f99e96ea61d9d2b7d8139f2
MD5 a98d2eeab6b0dedca1db2ef1ce99929f
SHA1 7b4ee30a52b185e8e147efaf8950cffd26ff58c4
SHA512 33f9af976153516995d91498c87564967a0773a9b8c769b69ee7deb8ae03a6a7f8b99dade8cc8c52df054702960c3458d5ee30e842042d74c25566e8d1d6d260
SSDEEP 768:p/UxvxjgC+k3oAf9clYoyEMbxyJugQVTJ7vvmevSSHtBk:cZj3+k3VVoyEmxyJJq17vUSbk
TLSH
T1B603C039ACA59C7388F692843649E787EFF5026394C62BA485DD6F0E128B3BC5307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7d12dc3-b1a8-4e9d-bb97-3b12cc0e907a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e7d12dc3-b1a8-4e9d-bb97-3b12cc0e907a.tmp
Size 34KB
SHA256 a53beb26562d07f20dae74f3de10d1a04cfd26a0b67e4fa23c4affdab0597bd9
MD5 e50a74a3029a797c487d9c05e51fb37c
SHA1 a0b89e73a2df7feee8877e60d89ef1bee52d26cd
SHA512 19131b59b26c29f4f54862f5d511f02864bf84b5c9719b920d4f2b6a48dd1c763dcbe452f33279c2c72b48ecdc842f21c7a6afb567ba6f7ef98f2fed46aa8b12
SSDEEP 768:DW3xNf9clYvOyyEMbxyJugQVTJ7vvmeX14YGHnUy:DW3VV5yEmxyJJq17vr4YUUy
TLSH
T12DF2BF329CA58C739DF6D2C5B645BA83AFF4426394CA1A84C4DD6F1E124B7BD2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e47e368-f542-49b0-8c7e-315c94d12517.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6e47e368-f542-49b0-8c7e-315c94d12517.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download