6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-wxmnos.htm
Size 34KB
Sample260930-kr9ftazy2j
SHA256 6ba372357efa26a04e1c8eb59f29e9867b04ed241c4665f06e78d1ebe6ab8e5b
MD5 764f5df3b8d286714635f98cdaff2174
SHA1 6f65b07d81db9dcfdfe1482f1ba7a14977d87aa2
SHA512 323c8e03eabf4884fba35ca5253c79f370c09e0156bea23ca0e2c10d948e608a65b47dc8cca9450afb3a81a9c61ccb77d3ff7acd935d3658b61c415597cf2e13
SSDEEP 768:9srfAOHdia5Qe2E4rY0H1UeH+NypaNKiA9b:9QAOHdl5TkY0HeNVKJ
TLSH
T1DFF2D65356D19D37067396F4BCB8BE2C95CA8D0FC248AC04743CA90C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2988	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{E5B8E6D2-6A14-49E2-A9FC-05C103B72175}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 6016 wrote to memory of 4268	6016	msedge.exe	89
PID 6016 wrote to memory of 1792	6016	msedge.exe	90
PID 6016 wrote to memory of 2988	6016	msedge.exe	91
PID 6016 wrote to memory of 1792	6016	msedge.exe	90
PID 6016 wrote to memory of 1792	6016	msedge.exe	90
PID 6016 wrote to memory of 2800	6016	msedge.exe	92
PID 6016 wrote to memory of 2800	6016	msedge.exe	92
PID 6016 wrote to memory of 4168	6016	msedge.exe	94
PID 6016 wrote to memory of 4168	6016	msedge.exe	94
PID 6016 wrote to memory of 4168	6016	msedge.exe	94
PID 6016 wrote to memory of 3188	6016	msedge.exe	95
PID 6016 wrote to memory of 3188	6016	msedge.exe	95
PID 6016 wrote to memory of 3188	6016	msedge.exe	95
PID 6016 wrote to memory of 2124	6016	msedge.exe	96
PID 6016 wrote to memory of 2804	6016	msedge.exe	97
PID 6016 wrote to memory of 2124	6016	msedge.exe	96
PID 6016 wrote to memory of 2124	6016	msedge.exe	96
PID 6016 wrote to memory of 2804	6016	msedge.exe	97
PID 6016 wrote to memory of 2804	6016	msedge.exe	97
PID 6016 wrote to memory of 3712	6016	msedge.exe	99
PID 6016 wrote to memory of 3712	6016	msedge.exe	99
PID 6016 wrote to memory of 3788	6016	msedge.exe	100
PID 6016 wrote to memory of 3788	6016	msedge.exe	100
PID 6016 wrote to memory of 1028	6016	msedge.exe	102
PID 6016 wrote to memory of 2760	6016	msedge.exe	106
PID 6016 wrote to memory of 4952	6016	msedge.exe	107
PID 6016 wrote to memory of 980	6016	msedge.exe	108
PID 6016 wrote to memory of 1432	6016	msedge.exe	109
PID 6016 wrote to memory of 1432	6016	msedge.exe	109
PID 6016 wrote to memory of 2004	6016	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-wxmnos.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffaf0dcc188,0x7ffaf0dcc194,0x7ffaf0dcc1a0
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,17154971633006805931,3597375320502173435,262144 --field-trial-handle=2520,i,17646821230272835442,518817381158426775,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,5790366560542115511,1289649906674504012,524288 --field-trial-handle=2520,i,17646821230272835442,518817381158426775,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,884177585583932634,13680295217333576888,524288 --field-trial-handle=2520,i,17646821230272835442,518817381158426775,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:13
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,16013023094797766755,15646534729730836999,2097152 --field-trial-handle=2520,i,17646821230272835442,518817381158426775,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,353928526523155923,18213349927044181987,2097152 --field-trial-handle=2520,i,17646821230272835442,518817381158426775,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,761551497920426714,3145054872297645667,2097152 --field-trial-handle=2520,i,17646821230272835442,518817381158426775,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,203522395603864209,1075672842306617509,2097152 --field-trial-handle=2520,i,17646821230272835442,518817381158426775,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:9
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,12512509685922010709,16556100727466597888,524288 --field-trial-handle=2520,i,17646821230272835442,518817381158426775,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,856807603573430535,8891448648322970147,524288 --field-trial-handle=2520,i,17646821230272835442,518817381158426775,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,17541430118797335905,2457750550265974640,524288 --field-trial-handle=2520,i,17646821230272835442,518817381158426775,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,17541430118797335905,2457750550265974640,524288 --field-trial-handle=2520,i,17646821230272835442,518817381158426775,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,14323188813479618273,14693060525444183229,524288 --field-trial-handle=2520,i,17646821230272835442,518817381158426775,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:14
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,6646762385506901091,2978087803982314192,524288 --field-trial-handle=2520,i,17646821230272835442,518817381158426775,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,2684154534399267271,3173596893358895041,524288 --field-trial-handle=2520,i,17646821230272835442,518817381158426775,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,10968962680966464793,17491935423062201016,524288 --field-trial-handle=2520,i,17646821230272835442,518817381158426775,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:14
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6516,i,16638352690957159598,15625902948816629095,262144 --field-trial-handle=2520,i,17646821230272835442,518817381158426775,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e1f78699b4f1d6c89e71d75269f2e6754c1697e9a1b4dbc0f83160286d7e0ebf
MD5 57c62c9c6ecd87c2268217e2760532c9
SHA1 690d6b008f142ce9faa632dd3bb632c57b844df7
SHA512 1b3c849812adf02bf40479af4a81d29cdfa9d4781ee1d602ef68326544b9f17c666926214cac473eb1d4696638aba8274ffdc9090ed7459b7dc3d8b2b3d65a31
TLSH
T12661607848808241FF7E407DD7D09CC336B34AAB52432E612A98FF7C64463D1B25781E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59623b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59623b.TMP
Size 3KB
SHA256 4457b9005905e45dfd64c1d8cafb51b1aaefc98d962038a99f8a387b0875a89a
MD5 69530d82dff16fadd1ff6cdcb996aa77
SHA1 9dcc55c1343eb9012e9548b9ea42000f233eb846
SHA512 11228c36fcdf975d4118140f6675d8ae9a4f6aacf5a4bc7ef2fecb878bf8a4ef17f251f4709f7e8c5356a059ca534b1a04f429872430101d5e37a073b604183d
TLSH
T16861607859808245FFBE407DD7D09CC336B34AAB52432E612A58FF7C64463D1B25781E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c8db3967a3605ce33394ad1d9f6f34ef8514ee44dde157060e7a46970d2b9c32
MD5 8af2db0283c06692ae649c0402599024
SHA1 6b9c5e7e6f915cfc5ab96bcd9097435047f247e4
SHA512 9ac164c278423595d8c54af550c19b368bea2a7735370e717c5a4ea58747cc96242953a9076e52dc9009ca84d996b1d10df725ef3733f8931325e9c75f059e85
TLSH
T1AB418CF3C3E8866D890156F4AA147E2BCE2D0915532C3D5AC9E4DE2B93F34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 938f9ffa249263026d20f74615fe0c528d1dce8ad3d93755f4b353a3a3e9978c
MD5 01aec519aca8bc92a2cf32a2abe94e77
SHA1 d880da0f7f1cef8b28a20d07200614b3fa1bad69
SHA512 16ecb534bf37f8aa78a5612c21098ab21fb4e4f5a45cc3e59f764f59a9d9267eb33ca92f73654a9e927f5997135f73e695028ca620949f7b77ffbaf06dee5844
SSDEEP 192:sxRGRdbiV/fensBxoqzoA8p47/g6+WNIYcDXtiTMe+GZIgDsJ:sxRGriV/fensron2/5Ij9iThXc
TLSH
T19932C7156D68A97B9CDBD20DFB55BF53D2F8503360A51E48A6FC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 12079955605c264bb3acfdfe706917af8374f2f857d31375a77e9a9fd3098a42
MD5 155d58b6e2208ce72bcd3eb36da563d9
SHA1 d1c120cdddf53d046c3b1f5c926e19b4da1ac441
SHA512 e731f48d0eb7fa32a2c582da5a31f044f809ebf97b80c7c76809e937b856f00749867878e18bf5ca6829adcd063ab3dbbe873cab85a82b71054f01bc391ad553
SSDEEP 192:sxR5RdbiV/fensdboqzoA8p47/g6+WNIYckXtiTMe+GZIgIJ:sxR5riV/fens9on2/5IE9iThXs
TLSH
T10332A5156E68A97B8CDBD20DFB65BF53D2F95032A0A51E48A6FC8A1C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dfb933809fabbac7f78266404dacb559bd1d1dedd6494f9f55c83c123b6c626e
MD5 8fcb569b8628bd5ebe357131ccb58f19
SHA1 393920b212820dd3bd57204f81c78438072650c1
SHA512 89d1b76788648035b79a1ce4efd4a936b5056756aff789a0397ad9648ca42e1218b8827b45a46c8f9cc51a7df13112f9ef60dc631b7b1d3d9bb619a624b58072
SSDEEP 192:sxRGRdbiV/fensBboqzoA8p47/g6+WNIYckXtiTMe+GZIgDWJ:sxRGriV/fensZon2/5IE9iThXe
TLSH
T16932A715AE68A97B8CDBD20DFB55BF53D2F95032A0E51E48A6FC8A1C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 bd9b238438b0ca0394cf7e20c230868f623d60c6bbf241a4d391a7724bf54226
MD5 e8850b2f858ab346c806880e9971ee70
SHA1 27bd8ead65d073eab9b6a42d99788e15967978fa
SHA512 b1cd9b5acd7f1287e84483e47ff9f2a54b1e8b572d737b06daa6bba5dc4debe1c02725823fddc974c83d0a1c749de320616df53c9c6c4461c1851b6ea1fed5b7
SSDEEP 384:D7JakElfCtg17Ff9tKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXn975RwVroMXd:DFakE5Wg1Bf9t8F1+UoAYDCx9Tuqh0VV
TLSH
T1D3B2C93F644CC77E8F804A9DEC196F976D9802C79A588D4047FE994C03C77EA92298DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 aa3a99c7bee4726b5d84f499f4dfb52970cdf4e1b71f6e888701d62b0cdeb7ab
MD5 cfec168256a85fb287c91e959d9e842b
SHA1 365a5fd587c430461cd30aa9dfe720058ec1aec2
SHA512 f1a43276c22d13f9904d64d0a8ab54171c8a546cd4f9960dacd17bb7a5b1354c4834b0de65d636c1eeab4de46890e22dfa2266366ef8f1254bb5ccfa2f6bebf1
SSDEEP 48:KMLGnrFNdWTNYdIarWKVz9BWRjGoQRLHyDC9ocC4IpTM7kIakpKVg9ypRa5oj0cm:KsYoKRqmuZ+KqcpdaK+ES/
TLSH
T1B891EA2274BB0251387D3D0C92D49BAF438136937029FB2B3BEA14555E66E049DFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

4bf400a6-8493-4ce3-b8a3-e74262570873.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4bf400a6-8493-4ce3-b8a3-e74262570873.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2b854200475c6fa305a6c249ec07123f4cd0bd1095e8af3f2815f7de80395ff9
MD5 bc9e2139a3a440f9ff2eb0b1eef422cc
SHA1 7cce49fbc2cae2bf5dd067daee1441c4dde510df
SHA512 4e3777f0f71b62fc78f0627089278b9d017a30dca9d4b6604579f30bc55b4112c4411f7e18a7db813bef953755d38e1e9fc2a4c7127e8b6d0085405d7c228b44
SSDEEP 768:D5/UxvxjgC+Z3YlOxieOT93xaynUPO4Qp7cPAiSm2eo4w4cciGrTFlJENoMn:DsZj3+Z3MwCIywQpYoimeoR4ccFFfEmq
TLSH
T1CD03BF75D8A8AE63ACF3A280365D6783FFF14563A5C52E588AED1F0D42873A94307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b0f96e26d322d342ca82bff5e1de705013d340920591f546221c78faeb4e4546
MD5 e303113a28432c252b7b5e9ac2b63555
SHA1 a86bf1dc3b1e48a7330f17686685eac2707a5c3f
SHA512 54c837b07cdc40f691c54bdf3558c0f7a1f302da5c9a4cba157883f912da4505b12652849dd47ec956357e1ee05c707d59c95990f68f4b1b0caf1f703d65d956
SSDEEP 768:nk3L84xieOT93xaLnUPO4Qp7cPAiSm2eo4w4cciGrTFlJ2sLYI:nk3oyCILwQpYoimeoR4ccFFf2ssI
TLSH
T1D0F2BE71D9E8EEB7ACF7928176497302BFF08113E5C55A54C9EE2B0D02476AA031BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c1e7ce190cd0b3d19434e2bcc51f5e1f457137ded7ccdd238127c46948831312
MD5 03ae3e68801d158e339bb97a7c7437f2
SHA1 6ca1a73a0ea4aa4f22628c76165ee70bff624228
SHA512 a7000287106f36e36cc04b8a929daf47869528081c27ab4758d6ffaeda61071313c9706e8c02efbde21718d67e2b43fc3bba5fc992dd064a94343884819e1615
SSDEEP 768:Dlk3G84xieOT93xaLnUPO4Qp7cPAiSm2eo4w4cciGrTFlJ2sLYI:Dlk3DyCILwQpYoimeoR4ccFFf2ssI
TLSH
T11BF2BE71D9E8EEB7ACF7928176497302BFF08123A5C55A54C9EE2B0D42476AA031BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 31d5e04007b509e135b935d2c2fc11bc4708057f36da8e56a0eb0b742f8efcc0
MD5 b446068404d2ebc70e02cfddce038294
SHA1 8ff0ac795cf76338bc8eb89c34ebe40f4197035b
SHA512 d90e00d32352da2f8672c3d2d0d0d2d97bd867e8f3a24dfa1be7ad22c3192a6c545a674961eb5b148611a8dda45bb64d7a9f2e1a40c7d3a7a39618ef56010874
SSDEEP 768:2FQY3Fwg584xieOT93xonUPO4Qp7cPAiSm2eo4w4cciGrTFlJ2sLYI:9Y3GyCOwQpYoimeoR4ccFFf2ssI
TLSH
T1E103AD72C9E8DEBBBCF79B85B6493302AFF18163D5C5AA94D6D91E0D01472E9030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 1d65256bba81a3de59966b4116d2ac74fa67ea084044775618a07294ef307636
MD5 aae3ac32b8a713c5054232a4cb623c3e
SHA1 e53513394be20bc27d68da538b1e819a5458f3f2
SHA512 722a37d8e2be44532c60d9f2816ad50e51eeddba1e0fef5e860baadf78ce33f1ef64bd6a465c2a9dd70ecf7c7ebbc6f92a62a15b952f25e8ffdf950ee5047fde
SSDEEP 768:vw/UxvxjgC+5j3wVE28lieOT9TjFnUPO4Qp7cPAiSm2eo4w4cciGrTF5NAgZbCMc:vdZj3+5j3wG2yCTjFwQpYoimeoR4ccF0
TLSH
T16703BE75E8A8AE77DCF39784365D6342EFF1416395C22AA4CAED1E0D42873AD430BC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download