af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-o49wx3.html
Size 214KB
Sample260930-jjwpbav19k
SHA256 af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20
MD5 ca2c96be8ad4c1b27afc858a639eb1f4
SHA1 34bcbb32e3946883cf26447531ab98af52bcab62
SHA512 3437202655e3eb3621e7f896424eace53f0c5f24acf844be2b9d563d88009e6cf5a37bcddba9c2cbaba921fa3f1b6b8b256eb36e35e548489e0a5a04be7cb99c
SSDEEP 3072:opm0WkXwgEweVFmk0RHyEoCmetxWnm6t6b9U9QfyA7cxGTdTbLayQsH:oglIYWRHyrCunm6t6i947gGTx3pQ4
TLSH
T13024023459202B0E3B9246B4B26575A40EF90CB3E95F96227BC801F5EFED1F29049CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3636	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{226D7F36-E2D6-4927-BE39-A323C9A4C6F1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 2864	436	msedge.exe	89
PID 436 wrote to memory of 3636	436	msedge.exe	90
PID 436 wrote to memory of 5368	436	msedge.exe	91
PID 436 wrote to memory of 5368	436	msedge.exe	91
PID 436 wrote to memory of 5368	436	msedge.exe	91
PID 436 wrote to memory of 472	436	msedge.exe	92
PID 436 wrote to memory of 472	436	msedge.exe	92
PID 436 wrote to memory of 2400	436	msedge.exe	95
PID 436 wrote to memory of 2400	436	msedge.exe	95
PID 436 wrote to memory of 300	436	msedge.exe	94
PID 436 wrote to memory of 2400	436	msedge.exe	95
PID 436 wrote to memory of 300	436	msedge.exe	94
PID 436 wrote to memory of 300	436	msedge.exe	94
PID 436 wrote to memory of 1804	436	msedge.exe	96
PID 436 wrote to memory of 2608	436	msedge.exe	97
PID 436 wrote to memory of 1804	436	msedge.exe	96
PID 436 wrote to memory of 1804	436	msedge.exe	96
PID 436 wrote to memory of 2608	436	msedge.exe	97
PID 436 wrote to memory of 2608	436	msedge.exe	97
PID 436 wrote to memory of 1488	436	msedge.exe	99
PID 436 wrote to memory of 1488	436	msedge.exe	99
PID 436 wrote to memory of 2700	436	msedge.exe	100
PID 436 wrote to memory of 2700	436	msedge.exe	100
PID 436 wrote to memory of 5148	436	msedge.exe	102
PID 436 wrote to memory of 1084	436	msedge.exe	106
PID 436 wrote to memory of 3672	436	msedge.exe	107
PID 436 wrote to memory of 5728	436	msedge.exe	108
PID 436 wrote to memory of 3384	436	msedge.exe	109
PID 436 wrote to memory of 3384	436	msedge.exe	109
PID 436 wrote to memory of 2376	436	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-o49wx3.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffb3bf5c188,0x7ffb3bf5c194,0x7ffb3bf5c1a0
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,6090018791302540109,6599207512867477890,524288 --field-trial-handle=2196,i,16106370913525375137,14088778104123925407,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,2412985487029317470,3137857608474104221,262144 --field-trial-handle=2196,i,16106370913525375137,14088778104123925407,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,6761259595215736243,14257284438072197919,524288 --field-trial-handle=2196,i,16106370913525375137,14088778104123925407,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:13
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,8633242864638182983,4208614087366886930,2097152 --field-trial-handle=2196,i,16106370913525375137,14088778104123925407,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,4328405120892802985,11842999127442357695,2097152 --field-trial-handle=2196,i,16106370913525375137,14088778104123925407,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,3207487360689230208,4498111114483676324,2097152 --field-trial-handle=2196,i,16106370913525375137,14088778104123925407,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,17884641162492983842,5541369698524687794,2097152 --field-trial-handle=2196,i,16106370913525375137,14088778104123925407,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:9
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,4278207121997952469,4070540304900052123,524288 --field-trial-handle=2196,i,16106370913525375137,14088778104123925407,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,4648452957593648044,16715426839036665251,524288 --field-trial-handle=2196,i,16106370913525375137,14088778104123925407,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,14854801314757459411,5452360475082052188,524288 --field-trial-handle=2196,i,16106370913525375137,14088778104123925407,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,14854801314757459411,5452360475082052188,524288 --field-trial-handle=2196,i,16106370913525375137,14088778104123925407,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,7021524860404619641,10917871851033456722,524288 --field-trial-handle=2196,i,16106370913525375137,14088778104123925407,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,11788320073636723992,4598203215291714963,524288 --field-trial-handle=2196,i,16106370913525375137,14088778104123925407,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,1964847949946972263,18159485100810499770,524288 --field-trial-handle=2196,i,16106370913525375137,14088778104123925407,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,5354065141796237473,5255713201938952287,524288 --field-trial-handle=2196,i,16106370913525375137,14088778104123925407,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:14
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6512,i,9122523213288628330,2061076453267805500,262144 --field-trial-handle=2196,i,16106370913525375137,14088778104123925407,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4bf1ac9bade2c3141ef322603981770e4c6e0706d56ed6e7b1f5e84cd1a34b86
MD5 a51f36e8d193390836b6a146bb14a11e
SHA1 4d0bc16d72a557496852119c76760a15d2213ca1
SHA512 996779b4f2b8bc4d68096960d8466ba4ee04583db9f8c626661ccdb0ab02363a4ba9b0931dfa9515f841099d14f81ee494ccbe1eea9b17a27cf9d98998ee3502
TLSH
T1F651A4C799E19970E3F820F09DE60387FAFC49B1DACB0D030094D5F96B1A76CA305A54
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d519.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d519.TMP
Size 2KB
SHA256 3423ea9177a58a0ca2d0f4e21024c8a1cf3e3040341d4bc4c7958af1ede142f9
MD5 3c04f5d1f3e196884d23a267abf04372
SHA1 4db69454d8a979370a22e7e2ebfd1f47362f7654
SHA512 e61a1f2c2334d7756158709fa8e61daf6ac75001811271bba03bbe5dbf350d367a3b279a295bf129fcd83c3c531ef795d75bbc467ab58536cf48f89af18b4928
TLSH
T1385192C799E19970E3F820F09DE6038BFAFC49B1DACB0E030094D5F96B1A36CA345A54
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a33f437ae73a5228bbf150fe3bde1a784a2e71f13f178333c664f4316d256df9
MD5 60265db06393437d9afedd26d8f210b7
SHA1 62c7e11382430ec0926ee2dd6c4f63064bcfe645
SHA512 d49ca213767ace5013f35026ec3dac581515bf9e6f2ac30df00541c4961b22fff44796853991120afcb65d8c34e727a0be13ecd67b592c8224d0c06cfed55212
TLSH
T1D841AFF7C3E8867D890156F4AB186E1BCE2D0955832C3C5AC8E4DE2B93E34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 08133ad0ac35c8dabf93dce1fc5a06983dd78e0c5cdefa3b395232c36cd5a065
MD5 6cc47369f6546eabae3f6c499317e94e
SHA1 5516c6c1c5b5a87d251df8512447c468d64d0929
SHA512 2f0209d8789d229455b181dcbaba18dfdef2507d862e5d5a0efef67c705159bfd0498859550c4042a4bb5f57dd118fcaf35696eecc025592f6a0c367ce0228c8
SSDEEP 192:sxR3ZR2bP/fVsDK7xsJzoA8p4x/g6+WNIYDFAGWIgIJ:sxRpSP/fVsD6j4/5IDs
TLSH
T18832A716AE68A93B8CCBD31DBB65BF53D2FD503260D45E58B6FC861C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0c03419b1d2a99c50c17caa3effd5820cc72e18f1556643c29c430cd203e4e3e
MD5 fc13d50f2ac5c0d465f37fd356ed771e
SHA1 caf151e1ea44539f4775dcbb8c647d70b14775b0
SHA512 9470ef0d8b414451bf7d03e8b9481392beb43d8f9855e1317918dba517345cb35e59e229d090cf44b23ed241831335a308d5595310fcee25edf0af80eba9e199
SSDEEP 192:sxR3WR2bP/fVsAK7xsJzoA8p4x/g6+WNIYDhAGWIgDmJ:sxRmSP/fVsA6j4/5I5m
TLSH
T11E32B616AE68A97B8CCBE31DBB55BF53D2F9503260D45E48B6FC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7d2ed98bfdd48a1a58743e68dc00212019c2314e48d8c797751e283b41fa45a7
MD5 06079e2389f3d3e65d2102f60247b893
SHA1 33c8c97ec2a55639c616746da8e811ebb03d1da6
SHA512 a758f1c2c0ca03442eed47a2196115c10ce76526ecd5801d04d408231b9ac4c331d463b610508ec853c837d36b459b66cc7bd4d6f3d8f83960286fdc103d67c9
SSDEEP 192:sxR3WR2bP/fVspK7xsJzoA8p4x/g6+WNIYDFAGWIgD0J:sxRmSP/fVsp6j4/5ID8
TLSH
T1CE32A616AE68A97B8CCBD31DBB65BF53D2FD503260D45E48A6FC861C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 a4f66069eda1cb6f4fe0b635dc232c5411f4302699945b045aa09f9b06b23197
MD5 e7d11f90456f5172113a29f0cee73e50
SHA1 329b8050a7fb2e894ff09070e50e17b7c07a4d9f
SHA512 d4d5035770be275fbc2b8f94f9813ff29fbf25d1e07518b201d9e5be0dc17ef0d7555819aa31d905ffa359a309c259488f85a197a7267d565aff981a13eda159
SSDEEP 384:ScwYbpGfCtgaEFfA6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVO+9W+R98roTy9:SzYbpUWgasfA68F1+UoAYDCx9Tuqh0Vl
TLSH
T115B2D92B640CC77E4F804AADEC196F967E5802C796988D4047FE994C03C77EFA21A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

3739f242-6032-412c-ac3a-f9d891f4a657.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3739f242-6032-412c-ac3a-f9d891f4a657.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d9e06340b1b740808a88e80f9f687e5f8e42ad93056609a165ed8ebad7bafe2a
MD5 5827a15b63a15894a89efcb3be2367ac
SHA1 dd9011a42fe912cfae7619409523d9988e766287
SHA512 5b7b36c0758741dbe3f12fb2d764357063abbe718ea7b9d5f7bafac4c2e4e7becbc3a43d2a685771400cb83e98ce2ef501a00e61d4e6a9d6d54615fdbfe0b150
SSDEEP 768:1N3B0CPybNbAREztrOeRFZD1fTos7RjpB2sI2p:1N3B0GHY1fT/Rf2sbp
TLSH
T174F2AE3AB8E45D734CF6E384B24A7A03BFB44563CAC9598454DD5F1E049BEAE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f43719ba02b9979199d1e0392bcc41cd2673a7bf800d5e0bc591af72900108e4
MD5 6edd0c3740cf700f14db217c5002cd7e
SHA1 21419a1ae695e03b6b85a85a1dd31ce8b49586b4
SHA512 bff7b6c5406891c3449dcc12f9d7e5966da5717b064f9493fc99411b31aca8d5db2e684c656e15306675e8e09e9b3a27f1f6c86e80f6177305bec0e888ad05ae
SSDEEP 768:1N3W0CPybNbAREztrOeRFZD1fTos7RjpB2sI2p:1N3W0GHY1fT/Rf2sbp
TLSH
T14CF2AE3AB8E45D734CF6E384B24A7A03BFB44563CAC9598454DD5F1E049BEAE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 c47186aec09f3edf4fc072d8bf0db113f6c01ae4ddbfc5539a025615cfb90ae5
MD5 938222f07d65da7b0a99433b284e7ff7
SHA1 e934564839c7856e3af32921774892b7213b1738
SHA512 c12bb0013ad5d31deb37fa0a6a70f7396cb0d8d508c3c99d8320b51dbe83c456d219976b906181a496d709c15a7a40d47f81a244ae1347992727168ab9afa16a
SSDEEP 768:J/UxvxjgC+s3W0iPybNbAREzteOeRFZD1fTos7RjpB2sIoR:8Zj3+s3W0m+Y1fT/Rf2sJR
TLSH
T1B703CF3AB8E85D334CF6E344B24A7A47FFB4497389C958A809DD5E0E05CBB9D130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 bfc46836686a1e91785b7ed833c2659d892f1930dedf2529db95da9bfc88969b
MD5 b253b01b3d93854d8d3e555c8d42a3df
SHA1 32d96d4a4b074e0fa98eddfddf8a1dd6e05d751a
SHA512 2814d8f30f28a15ab50e05aac65acf9d14fa47835fca17b398c6d64a43958e8fb88cea66c1717100575877c04bec4c5d9e3a28f95deb6699a914b31e5943cb78
SSDEEP 768:tFQ033wg50CPybNbAREzt7OeRFZD1fTos7RjpB2sI2p:80330GPY1fT/Rf2sbp
TLSH
T1D1F2AE36A8D88D779CFAD784F24A7603BFF041A3C9D9959495DC5E0E0097AED034BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 c5f3c8f8c8ad1deae5329b25b73f10c170ca08cab1d3f818902d55543b3cf366
MD5 d097d1830977b177cf7bfa495e50f0dd
SHA1 9a4ed374143e46a3d873321dc4ab2b4c161f2ef8
SHA512 9de0a088431ea25e2fd1bf517de8fcb3943f95597d62302bd0c0aeccd007fc07ffa66b2bd3735445e962945622e4a744e5320a796567d0069e53561addc0e019
SSDEEP 768:z/UxvxjgC+k3UvQybNbAyOeRFZD1fTos7RzL/+Pu:GZj3+k3U4zY1fT/RPKu
TLSH
T1A003BF3AF8D46D338CF6E244720A764BBFF055B386C91A9809ED2E0E158B79D1307856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9566a2a-ece8-4981-9bee-bce5c324c4b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c9566a2a-ece8-4981-9bee-bce5c324c4b4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download