ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-odcwo6.html
Size 116B
Sample260930-jf5stawsdv
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4516	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{51543200-CD8C-4849-A31C-8F3F0F02F319}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5448	msedge.exe
5448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4260	1948	msedge.exe	90
PID 1948 wrote to memory of 5332	1948	msedge.exe	92
PID 1948 wrote to memory of 4516	1948	msedge.exe	93
PID 1948 wrote to memory of 5332	1948	msedge.exe	92
PID 1948 wrote to memory of 5332	1948	msedge.exe	92
PID 1948 wrote to memory of 460	1948	msedge.exe	94
PID 1948 wrote to memory of 460	1948	msedge.exe	94
PID 1948 wrote to memory of 4700	1948	msedge.exe	95
PID 1948 wrote to memory of 5468	1948	msedge.exe	96
PID 1948 wrote to memory of 4700	1948	msedge.exe	95
PID 1948 wrote to memory of 4700	1948	msedge.exe	95
PID 1948 wrote to memory of 5468	1948	msedge.exe	96
PID 1948 wrote to memory of 5468	1948	msedge.exe	96
PID 1948 wrote to memory of 2844	1948	msedge.exe	97
PID 1948 wrote to memory of 3536	1948	msedge.exe	98
PID 1948 wrote to memory of 2844	1948	msedge.exe	97
PID 1948 wrote to memory of 2844	1948	msedge.exe	97
PID 1948 wrote to memory of 3536	1948	msedge.exe	98
PID 1948 wrote to memory of 3536	1948	msedge.exe	98
PID 1948 wrote to memory of 1160	1948	msedge.exe	100
PID 1948 wrote to memory of 1160	1948	msedge.exe	100
PID 1948 wrote to memory of 820	1948	msedge.exe	101
PID 1948 wrote to memory of 820	1948	msedge.exe	101
PID 1948 wrote to memory of 5676	1948	msedge.exe	103
PID 1948 wrote to memory of 1276	1948	msedge.exe	107
PID 1948 wrote to memory of 1504	1948	msedge.exe	108
PID 1948 wrote to memory of 796	1948	msedge.exe	109
PID 1948 wrote to memory of 804	1948	msedge.exe	110
PID 1948 wrote to memory of 804	1948	msedge.exe	110
PID 1948 wrote to memory of 5448	1948	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-odcwo6.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2dc,0x7ffd49aec188,0x7ffd49aec194,0x7ffd49aec1a0
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,9486959403840887048,15335587752392031821,262144 --field-trial-handle=2440,i,11264338135861645913,12644149102148932775,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,930729796692850824,11761909324811285741,524288 --field-trial-handle=2440,i,11264338135861645913,12644149102148932775,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,6824792454967805506,4204195995444899603,524288 --field-trial-handle=2440,i,11264338135861645913,12644149102148932775,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:13
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,3784026786518116899,2754895810226093712,2097152 --field-trial-handle=2440,i,11264338135861645913,12644149102148932775,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,15725246725344644138,663863226183966051,2097152 --field-trial-handle=2440,i,11264338135861645913,12644149102148932775,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,8329542532651693276,6359823674033635685,2097152 --field-trial-handle=2440,i,11264338135861645913,12644149102148932775,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,2937865478802712534,13251019180195583903,2097152 --field-trial-handle=2440,i,11264338135861645913,12644149102148932775,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,13381172141415004298,7200524812873283545,524288 --field-trial-handle=2440,i,11264338135861645913,12644149102148932775,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,6055212971783703135,3555957774300615887,524288 --field-trial-handle=2440,i,11264338135861645913,12644149102148932775,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,3245750328758403365,7773151286341086788,524288 --field-trial-handle=2440,i,11264338135861645913,12644149102148932775,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,3245750328758403365,7773151286341086788,524288 --field-trial-handle=2440,i,11264338135861645913,12644149102148932775,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1248,i,15100792028254336663,7768390504341850429,524288 --field-trial-handle=2440,i,11264338135861645913,12644149102148932775,262144 --variations-seed-version --mojo-platform-channel-handle=1240 /prefetch:14
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1252,i,17834367127514335611,1254033504990680379,524288 --field-trial-handle=2440,i,11264338135861645913,12644149102148932775,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1256,i,3920054230746697682,2416505534012013250,524288 --field-trial-handle=2440,i,11264338135861645913,12644149102148932775,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,16281878260216458569,1366169261075083739,524288 --field-trial-handle=2440,i,11264338135861645913,12644149102148932775,262144 --variations-seed-version --mojo-platform-channel-handle=1248 /prefetch:14
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6488,i,17251571364154074504,15859973583042281571,262144 --field-trial-handle=2440,i,11264338135861645913,12644149102148932775,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 fe24e986efda960186ab2fa35e43ef0dc9b0065117cbcf14c74609fa1eb2b603
MD5 665a0f944996c2d422ebeb8d43fe69de
SHA1 ba89c5f962467ec414f940cd68b5419a9da0b084
SHA512 4279404c11650037156696977d1a107e67a3e365600b16377f78a9258ee5a23d59789e9eacbbacc549720cab4de81a3ee96d6a91a7ebe19e3d466367a4589ef6
TLSH
T11751D985C9E45250FB58023249D2F18B3EF8C9C1D7E79E0615BEC9FDDB2B394AA84104
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ffc9915e182243311552a37f52dcc6d51c97731d5acf2a113610c7621e12d6b0
MD5 e89f0a6c8b20309e5c4d58590e949b5e
SHA1 e95defdea67d26f2716c7540f19ad8a87ba9726e
SHA512 94249d6524f25b01cb72d83f017531c61f01cc26d3e43915b16f88a2f4bd816567d8c637717aa702fd3f727108e393cb019974e41d6e7f6dcd9c0bbd5ba546ce
TLSH
T130419EF3C3E8867D890156F4AB186E1BCE1D0915532C3C5AC9D4EE2B93E24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 feda652d5e8ac8849123ef0071c5e1e9d8cf67aa4f08511f6de5c1acf7f6611a
MD5 b8b4653e8ba4cb341c47f5926933b258
SHA1 827f1037d5f05b0c703946cc088f870627f9a534
SHA512 690b6a72a6a94578b9bc92d16a8fbd01bdf8f66ac9fb87568eb700b76914949a6ba2c66b03cbd097de88a5dd14bd48e8b3114c50dc3899da88a62362a23d28d4
SSDEEP 192:sxRURKbc/fsFsayYhWzoA8p43/g6+WNIY28bFGQIgIJ:sxRUCc/fsFsabLu/5I+fs
TLSH
T13D32B815AD68A97B8CCBD21DBB657F53D3FD5033A0946E48A6FC861C08E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 416729d46dd9d9b7d157cc1a09064994820a63a17b5c3c94b5cbcc8e8eef5a38
MD5 a9c9ab310322f38b789f35d4ff8e03d8
SHA1 0ec3aeace0ee995aa2353f8c9b39bb57dd2e6186
SHA512 0503537725414722496249b78f84ce6ee548fa4ed267dd3d8d7144848f19a1cd35cb9b4948e759c46783fac901e9104e2c4d39078dab66e463df9a5e9fdcec38
SSDEEP 192:sxRDRKbc/fsFs/yYhWzoA8p43/g6+WNIY2tbFGQIgD6J:sxRDCc/fsFs/bLu/5I3f6
TLSH
T1EF32C919AD68A97B8CCBD20DBB657F53D3FD503360945E48A6FC861C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c2ae14165483c6fc9c2b59c70f4246e1f326fd7e96c33968b89d38a2cf630af2
MD5 01612527fe5fbb03554b86bd48d6a4bf
SHA1 82142e24ffe48271b40f8e9c10586defb073cffb
SHA512 2eb45a47d85a659d45285771ba65ccaf3ed84b56b5bb05dfbfe02041ebf8fd9cfc439e458f2e3faf26ceb4fca7e2ac1023d5c8232209f83e59974ef50bb02b07
SSDEEP 192:sxRDRKbc/fsFsxyYhWzoA8p43/g6+WNIY28bFGQIgDoJ:sxRDCc/fsFsxbLu/5I+fw
TLSH
T13E32D919AD68A97B4CCBD21DBB657F53D3FD5033A0945E48A6FC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 93423b70d0f17522472b11481b0faddb78ab4424cf1306de035d7f155adffdd0
MD5 f4895631946b49b4681d2ada9ecd64cc
SHA1 287ade96fe2b90b0fdff4c3aef2fbacebd2d2485
SHA512 91456c5b07c8eb5fc9598380b8a8e83411d89ea78a2be889d6a2aab183b2b6579e96b4119a7f1bd0a86b33ce9b0b131283da651600a3ae8f624c7fd0fc657550
SSDEEP 384:LbnaaCTfCtgp/FfvDKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVPH9NvRWNroHrT:L7aaCDWgptfvD8F1+UoAYDCx9Tuqh0VC
TLSH
T14AB2EA2F644CCB7E8FD00A9DAC196F977E9802C796588D4047FE994C02C77EA911E4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3e2e7697457345ecb7ec066d9317788893ac32199f5ca56a7f72bcf8cc15b30e
MD5 2180f4c60ff7787816149d89b116d4b9
SHA1 4079191ac956ca857085da2adc92ef247bb39a85
SHA512 24ab7ef209fd4d0746accac52adf9fa60854e0bb54b25c87f7fa52fe9053a53fb209a6f9044917164d93507125f316e0ae09fb15d7067a6dc0807c519b7717d0
SSDEEP 48:K0mBcAeEE9bI/wISY9K981+9xWtYXoEGyL5IVpz3Lkb3SPISBkK9B1rkxJ0Yyz33:K4NqKOg6iKkKfaQO0K3Kya2OB
TLSH
T145910F4670BB46503DBD394C82E5A62E524132A33554EA3B7FBC05B34E6AE4C8DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a5d15.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5d15.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 20b3aff50510a6b3368901db3100ba5bfb7271554b6bc574d5b2416a8f658e5f
MD5 c20c230bdadc076b73a21908d6041a67
SHA1 d956d82dc6eb88ed68390247d7442e97b96e83a1
SHA512 38986cf753a207f7bcb29b3fc40bde7f6e72d7fea33c9923a4b211435872e85ff4f15790afef57377db25d504f87b6ab94b0611daea636837270637789aa4e55
SSDEEP 768:2ly3up2gm14YLO/ZDmGA5b65Q92RQMPbIRs2BE:2ly3ELAF65dQnRsaE
TLSH
T159F2AE72ECA1DEF36CF955C07687B2466FB84163D1C886E054EA6F0D0597A9E030BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 00b62c2a1252be18fff5be973f9e5f14d6df1e96f1ee1d3a15886f14e3220a8b
MD5 f399c795eb0fdcdec975e8a98d236195
SHA1 5128aad22711d5b3515af3d007337f9bb9b2008a
SHA512 82ca6dc3bba53d0dda6988856e782b7d6af05f0a4783df4502f284980a8e1ecf9b7ac73cb2406ef8028b132a4ad2963283f2397887e082b0181b5dc7b0df7002
SSDEEP 768:4/UxvxjgC+v3dr2gm14YLO/ZDmGA5b65Q92RQMPbIJBfs:FZj3+v3ZLAF65dQnJ9s
TLSH
T10703BF32ECA5ADB39CB965803647B28BAFF44173D0C895E405EA6F0D09C768D430BD5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 15cc57f26249f3ebc7a7d9cb7817388f5f79227657c39c2c12a2fa98fa72b660
MD5 abaa7f7dd9b4818e698ac7fc33873375
SHA1 52d04bef49311152b58f43242806f46dadfc4107
SHA512 75bdc20c2d4536f86aacec00642280d09dfc5eb838fd34dcf6d9c45059931934a826503042ea76644883af214909e75579df85905328d034c7719bf66a333521
SSDEEP 768:oy3Np2gm14YLO/ZDmGA5b65Q92RQMPbIRs2BE:oy3fLAF65dQnRsaE
TLSH
T179F2AE72ECA1DEF36CF955C07687B2466FB84163D1C886E054EA6F0D0597A9E030BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2ba3ab5cb3900b106e17430743b7fe5fdb8c9d757fa9a88a7d8287cd23ca7ece
MD5 3f994ae63ac74c6ff976628faad7951e
SHA1 6526ca7a01ab7eeaf49ce3ba76c7cfbdf2697d7f
SHA512 c2e95457f3c335a55938217f06b55c0a7c491455581d4bd461b4d59bbad872bbbcbd7b4ca22e80da979fe8d9e0b964d754bfbe554411cc65bf8b8bb8a501e783
SSDEEP 768:U/UxvxjgC+B3zLPwgm14YZtDmGA5b65Q92RQMPb5Fj0O:BZj3+B3Xq3AF65dQCFQO
TLSH
T12B03C036EC95AEB39CF95680374BB35AAFB84173C1C895E049E96E1D06C768C430B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 e2ef2ba5389c6837a2fb2690da639e54a64ce337c1363e5cc1b3fab030589914
MD5 474670e2edabba4a66db747dedcafe95
SHA1 ca09243bf3aa766e856a38a45a00c60254130ea8
SHA512 feb4adc844d458aaee49f7dbfe60940588f8f83e6e29152c7b3d4c18089c780c14a333d443d35823ea57ea50745d41ef2f8ce70e0cd26332944fcaad08b2b835
SSDEEP 768:eGFQe38wgTp2gm14YLO9DmGA5b65Q92RQMPbIRs2BE:eNe36AF65dQnRsaE
TLSH
T11403AE729CD4CEF7ACFA5AC0B646B2066FB54173C5C8D6E0A5DA6E0C01979DE030BC5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b544c2b0-94fe-45d5-b2be-53c184d8ad50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b544c2b0-94fe-45d5-b2be-53c184d8ad50.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download