af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-c413wu.html
Size 214KB
Sample260930-kfdj1aah72
SHA256 af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20
MD5 ca2c96be8ad4c1b27afc858a639eb1f4
SHA1 34bcbb32e3946883cf26447531ab98af52bcab62
SHA512 3437202655e3eb3621e7f896424eace53f0c5f24acf844be2b9d563d88009e6cf5a37bcddba9c2cbaba921fa3f1b6b8b256eb36e35e548489e0a5a04be7cb99c
SSDEEP 3072:opm0WkXwgEweVFmk0RHyEoCmetxWnm6t6b9U9QfyA7cxGTdTbLayQsH:oglIYWRHyrCunm6t6i947gGTx3pQ4
TLSH
T13024023459202B0E3B9246B4B26575A40EF90CB3E95F96227BC801F5EFED1F29049CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2596	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{FFCEE19F-AACF-45D1-BF88-A2F565AD5734}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 4232	1380	msedge.exe	88
PID 1380 wrote to memory of 256	1380	msedge.exe	91
PID 1380 wrote to memory of 2596	1380	msedge.exe	92
PID 1380 wrote to memory of 256	1380	msedge.exe	91
PID 1380 wrote to memory of 256	1380	msedge.exe	91
PID 1380 wrote to memory of 5928	1380	msedge.exe	94
PID 1380 wrote to memory of 4228	1380	msedge.exe	93
PID 1380 wrote to memory of 5928	1380	msedge.exe	94
PID 1380 wrote to memory of 5928	1380	msedge.exe	94
PID 1380 wrote to memory of 4228	1380	msedge.exe	93
PID 1380 wrote to memory of 4228	1380	msedge.exe	93
PID 1380 wrote to memory of 2240	1380	msedge.exe	95
PID 1380 wrote to memory of 2240	1380	msedge.exe	95
PID 1380 wrote to memory of 1684	1380	msedge.exe	96
PID 1380 wrote to memory of 5668	1380	msedge.exe	97
PID 1380 wrote to memory of 1684	1380	msedge.exe	96
PID 1380 wrote to memory of 1684	1380	msedge.exe	96
PID 1380 wrote to memory of 5668	1380	msedge.exe	97
PID 1380 wrote to memory of 5668	1380	msedge.exe	97
PID 1380 wrote to memory of 5924	1380	msedge.exe	99
PID 1380 wrote to memory of 3064	1380	msedge.exe	100
PID 1380 wrote to memory of 5924	1380	msedge.exe	99
PID 1380 wrote to memory of 3064	1380	msedge.exe	100
PID 1380 wrote to memory of 2492	1380	msedge.exe	102
PID 1380 wrote to memory of 4960	1380	msedge.exe	106
PID 1380 wrote to memory of 1400	1380	msedge.exe	107
PID 1380 wrote to memory of 1740	1380	msedge.exe	108
PID 1380 wrote to memory of 5108	1380	msedge.exe	109
PID 1380 wrote to memory of 5108	1380	msedge.exe	109
PID 1380 wrote to memory of 5964	1380	msedge.exe	110
PID 1380 wrote to memory of 5964	1380	msedge.exe	110
PID 1380 wrote to memory of 2656	1380	msedge.exe	112
PID 1380 wrote to memory of 2656	1380	msedge.exe	112
PID 1380 wrote to memory of 4540	1380	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-c413wu.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff821bfc188,0x7ff821bfc194,0x7ff821bfc1a0
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1956,i,7044581544096475869,13538056123284602590,262144 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:2
  2⤵
  PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2096,i,2536799223434116798,7013566410279845156,524288 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,1063967256869454158,16045799481161327564,2097152 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,6874876780522370228,5082952554949999056,2097152 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,5912274956965348789,10505814739022946245,524288 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:13
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,12587709594527498747,10804993068478915697,2097152 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,9073251243811933496,17064339416963483548,2097152 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:9
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,15390337065788995448,10371882043273508042,524288 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,8538914076486301798,4500826238482352009,524288 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,166060740664610251,1114907922291466258,524288 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,166060740664610251,1114907922291466258,524288 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,17245867964605185012,11025083805722798174,524288 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=1220 /prefetch:14
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,6755801389990357196,18169275840148048547,524288 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=1216 /prefetch:14
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,13435939152264573633,9792718717346759455,524288 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:14
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,14934308741468356377,7657331809178248602,524288 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=1188 /prefetch:14
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,15342243459316980462,16032249301199492036,524288 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,603570434991502387,4335377572370842282,524288 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6452,i,3621693094244439779,7701370525784417404,262144 --field-trial-handle=2972,i,2191423381476254194,10789892115325669107,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f48fbde65d863732e23a006efc9b90ded3ad6e6ba6561e3c6d34bec1ee65e839
MD5 e8d008159046bfd5618fe028b9b422c1
SHA1 33da8fb1a7fa26a7a11f5b2711b759065edfe395
SHA512 07e94a01d819d1728fc4c0a27372fdd5408263195140838ecd7d794e02cc5cd0c21f7a616a2412b39418b9a748cc7c6177c1ebfd93e9e849c022f159643120f9
TLSH
T1CDE020B447C5C25DD101A547C2586B4CC2803F0AD7CEAE05271884887142040F6937D5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c79a4af69e8dd57968d5ac7e3b988bc820a4d7f1bcdda12639c83f97f53b7126
MD5 af3e73ba6847a1746c583c2b038ca279
SHA1 548588c86a9e9a267f4ca89e26e1031e03e7a3fc
SHA512 f2aacec56c9049c84af7ec2770f6d9774f683ac8e46c43e0172483c79921ab17c5bc479a8c65e1163a21c104d70e83afd4e3f55802ce0c53f61a2bb723e78606
TLSH
T10B5184871DB18070D76854F4D4D053873EF525B15AE31E05467BFEB8BF4E3D29189868
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cd0a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cd0a.TMP
Size 2KB
SHA256 3dc9ab9fd8f7b196ee9410a40f2114507035b92f4b28344907768a16d35dda5e
MD5 8a482f4a7097b1947d4ac1b10689ee7f
SHA1 9e54aaa13cc199f8ea7d96a72b22094eaf7532cd
SHA512 707c285b2840f8b47c4b5053122db5b40cf851faca185b7cbd8337856985b816dc2a414634422515ee72c93155a4fdc0425efae011885c0f97961ff266b6d505
TLSH
T1B75184871DB18070D76854F4D4E053873EF565B15AE31E0646BBFEB4BF4E3D29189828
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 01eea6254bee5cdc9b6c5dec284048363adf7d22896ccacd3d40adb4aebd8f9a
MD5 c49edb82921b7c834371325b1a3332b8
SHA1 304eadd4c2969d23ad6a9c1db3bda2096780f8cd
SHA512 14b87ca856a27ca5ccbcb6e275a627c1904b11a5893019a7203a37b8d444153316a24388778a4b98d58892f3fb83475d7bf7d8f9bc6476cedba8d7a8e93ffc32
TLSH
T13D41A2F7C3E8867D890156F4BB186E1BCE2D0915432C7C56C4E4AE1B93E34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b8df60f478fd2ac95b5e07cbd026be9316295259a2749b2aadb734688d84d779
MD5 21b1bc6d7e6623c774018e0738b9af06
SHA1 c9e2398b4c4bd135cf5d9e96223c4645a72bf05a
SHA512 79cf82cc22d7a6278559b19986b78282e107d88b2fb96a263d93f5aebb83afba8b7cc0b78ae56fb3a773045ba63d8169a07c42a0b2fe854ddfcea3f7e4933d42
SSDEEP 192:sxRNRjbP/fcs2HRwHzoA8p4B/g6+WNIYEIf+GhIgIJ:sxRNxP/fcs2Z0/5I07s
TLSH
T16932B615AA28A97B8CCBD21DFB697F53D6F91032A0D41E48F6FC861C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5d719e26c4698de0f3095921b2ff91bcc71bcaa4c6c8a6f21384a6050be3f6cb
MD5 4004307d213f8bce4c6faeab046facb9
SHA1 16f56f9b9107a54cbc141e5c55ec18257efc7909
SHA512 d59eab1bbfd09b0c4d13599509b62382d3435e63492e2d85a1bb3947c55c4d061d5dc763c82568725e8aa4d1eba647b9e7147c135b004827085e8ea84f6bce6f
SSDEEP 192:sxR6RjbP/fcsRHRwHzoA8p4B/g6+WNIYE6f+GhIgDyJ:sxR6xP/fcsRZ0/5Ie7a
TLSH
T1CF32C615AA28A97B8CDBE21DFB557F53D6F9503360D11E48B6FC8A1C14E76CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 42cef62fe849a79c565d8a60199272cc3f37c3699c66e9dbc0fa9d7973c0d00a
MD5 30e268ca9f36ceaecea4a48ec1e2e327
SHA1 8cd80e7fcbb6c233650a84e9433ef201a8966942
SHA512 78c7c380e7b0d52818dbcd4317f1306767dc9fd95f090c072680e890a4fa71b3ef1117a199fc3a834a63f73a27c326c8821267e55a4400897b03a42bb237cec2
SSDEEP 192:sxR6RjbP/fcsHHRwHzoA8p4B/g6+WNIYEIf+GhIgDQJ:sxR6xP/fcsHZ0/5I07Q
TLSH
T1AF32B715AA28A97B8CDBD21DFB597F53D6F9503260D01E48F6FC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 5d31cb31a9954f1c344c5916142c3ab84dc9ad34aba20cb0afacec66d085d761
MD5 f407418a773a5d5b44033b0ee63aa600
SHA1 8bdeca4b0b053e5b09d4486fda34f3258a143630
SHA512 42f88de9ad4cfd9f831ecab9bb785148ae4dbe1574d5c827049d5f3a14206a06f04532cb488b198dd546344285cf85cc1978fe79d1e1dd98f97571343ba9cab7
SSDEEP 384:USupCD0fCtg82FfrLKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVQc9hnRX0roJek:U/pCDmWg8KfrL8F1+UoAYDCx9Tuqh0VA
TLSH
T163B2D92B640CCB7F4FC04A9EAC196FD77D9802C79A588D4047FE995C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

0e510381-cc5c-49cf-924d-4fbde4db319e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0e510381-cc5c-49cf-924d-4fbde4db319e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 75bbc6470c59f2374f89a9a90f9fce795ab4a8c69ad7ab9e6553f1a4ea0afe82
MD5 d886ef595f50dbbd39e764e943559a81
SHA1 ca02fcb4d7ac1d3c57c61a62cbd0096ddd6e06a3
SHA512 575a7053ee71746364eb227697141a6dd016415b68d1846118b4773ab668ae40f473e3edc2b801bc2484a8860de6db4e3826085d20f3a55db2d8bca3b5ef9ee9
SSDEEP 768:uL38HS8Tc7fZrKup5XSwQs88uBkiT2w2sRK1:uL38yjtrrILNBB2sA1
TLSH
T1DFF2B035EC948CB3ACF69385768B37026FF05147D4C80B54C9DE661E029B76E134B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 69672c381e77c1eb5dbff2155d61a1150e7697101cbe66de5df639100f5a7cf7
MD5 d2ab1b827f3c6d51c873f8d06f986136
SHA1 8efedb9b460e4c3a7d808a165468c881b3d93855
SHA512 21c030b88ba4e85b8fde9a18909eef8e14173703a1093b7a92fb38edf60ae2f8cc6264ebc144ad8258b355b18ed99c817eeb2e942a535e7931c0cebb0432ab79
SSDEEP 768:gFQl38wg7HS8Tc7fZrKQcp5XSwQs88uBkiT2w2sRK1:Tl3+yjtrFiILNBB2sA1
TLSH
T17BF2BF32ECC489BBECF69785BB4A33029FF05057C4C44A94DADE651E029B6AD134BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 0f95df5fb8b8baf56ea366f2a6621083efaffa83e4dbf06e251498027a265853
MD5 3cb5e3b79fe69828414c23e3a59ed798
SHA1 75214228d0d62b18a4e2480f686b4067763c27fc
SHA512 9bbb19eb7c8a3b9978998f6d43ebe49d15b7e923e1d50b65518e0c2250c6fb627523c9ab48a8f15a838d8ba7dee41fc706db1a6234644b8135aa905f81fa17df
SSDEEP 768:R/UxvxjgC+W3g0ac7fZrKZp5XSwQs88uBkiTCU/P84g:kZj3+W3gitrOILNBFHg
TLSH
T16303C039ECD46863ACF3A385365A275BAFF06053C4C41B9849EE7A1E039735DA307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 06f098e10a92ec95872efe2523038b80f5f98b77224d676b9059338f1ee1a01c
MD5 05011fa4941c99764089e01b1640a385
SHA1 2260e66750a5e55f26444fe6f79f01229b766fe4
SHA512 fd4cac694fbb24d3b8c8defc38ce2b7b9c32525d866fa6bd3a824fefb8c9ef0cac27059a1aadf95c7003500220ab5c1b89fad11a9b1a928ddf34a516a39b8bfc
SSDEEP 768:IL39HSLTc7fZrKup5XSwQs88uBkiT2w2sRK1:IL39y8trrILNBB2sA1
TLSH
T16DF2BF35EC948CB7ACF69386768B37026FF05147D4C80B94C9DE661E029B76E234B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9aa2c654-828d-43b0-8ca4-3bfcb51a6074.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9aa2c654-828d-43b0-8ca4-3bfcb51a6074.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download