3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-a3jsx4.html
Size 171B
Sample260930-kvbzqa1wdy
SHA256 3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc
MD5 e082ebc14f6b24945336f6450b985e45
SHA1 df12ad35c265b0198582e2dc94e0a93048e4de82
SHA512 8dac8fb7101ee6a50ec58409a7d51009d9a3f6b1266377cad6f7f9001bc6f6734ffc067e7cfd0f17a1d0e288803fa8c8d37925590f6421772323ce99a4a9a1bf
TLSH
T1E4C08C7D10C13C150270A93C1DD3B397EC93198E01422B41308180232F35620CED32D0
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2856	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{3284DB37-DC2B-4864-919F-753D35E33E53}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5628	msedge.exe
5628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5808 wrote to memory of 4756	5808	msedge.exe	90
PID 5808 wrote to memory of 1532	5808	msedge.exe	92
PID 5808 wrote to memory of 2856	5808	msedge.exe	91
PID 5808 wrote to memory of 1532	5808	msedge.exe	92
PID 5808 wrote to memory of 1532	5808	msedge.exe	92
PID 5808 wrote to memory of 2724	5808	msedge.exe	94
PID 5808 wrote to memory of 2724	5808	msedge.exe	94
PID 5808 wrote to memory of 4272	5808	msedge.exe	95
PID 5808 wrote to memory of 3160	5808	msedge.exe	96
PID 5808 wrote to memory of 4272	5808	msedge.exe	95
PID 5808 wrote to memory of 4272	5808	msedge.exe	95
PID 5808 wrote to memory of 3160	5808	msedge.exe	96
PID 5808 wrote to memory of 3160	5808	msedge.exe	96
PID 5808 wrote to memory of 820	5808	msedge.exe	97
PID 5808 wrote to memory of 820	5808	msedge.exe	97
PID 5808 wrote to memory of 820	5808	msedge.exe	97
PID 5808 wrote to memory of 4896	5808	msedge.exe	98
PID 5808 wrote to memory of 4896	5808	msedge.exe	98
PID 5808 wrote to memory of 4896	5808	msedge.exe	98
PID 5808 wrote to memory of 5852	5808	msedge.exe	100
PID 5808 wrote to memory of 2884	5808	msedge.exe	101
PID 5808 wrote to memory of 5852	5808	msedge.exe	100
PID 5808 wrote to memory of 2884	5808	msedge.exe	101
PID 5808 wrote to memory of 2388	5808	msedge.exe	103
PID 5808 wrote to memory of 5748	5808	msedge.exe	107
PID 5808 wrote to memory of 6000	5808	msedge.exe	108
PID 5808 wrote to memory of 3244	5808	msedge.exe	109
PID 5808 wrote to memory of 5000	5808	msedge.exe	110
PID 5808 wrote to memory of 5000	5808	msedge.exe	110
PID 5808 wrote to memory of 5628	5808	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-a3jsx4.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x234,0x2dc,0x7ffcf4cdc188,0x7ffcf4cdc194,0x7ffcf4cdc1a0
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,2342873783820990617,9045138023843201510,524288 --field-trial-handle=2256,i,2211536898615140044,8534217372871497690,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,2102596122382988577,3311252161039997700,262144 --field-trial-handle=2256,i,2211536898615140044,8534217372871497690,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,619912567903152121,16765299296821483838,524288 --field-trial-handle=2256,i,2211536898615140044,8534217372871497690,262144 --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:13
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,7374521553878128826,2847194133513802625,2097152 --field-trial-handle=2256,i,2211536898615140044,8534217372871497690,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,17532252776512520388,5277206237052315395,2097152 --field-trial-handle=2256,i,2211536898615140044,8534217372871497690,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,16392460877074222954,12844636407908044923,2097152 --field-trial-handle=2256,i,2211536898615140044,8534217372871497690,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,16916039873453185160,7347241717326593570,2097152 --field-trial-handle=2256,i,2211536898615140044,8534217372871497690,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,2307955216327112619,13982065306878462097,524288 --field-trial-handle=2256,i,2211536898615140044,8534217372871497690,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,6225895280404627053,16593615068646897272,524288 --field-trial-handle=2256,i,2211536898615140044,8534217372871497690,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,9896987095377829974,7248452312185609145,524288 --field-trial-handle=2256,i,2211536898615140044,8534217372871497690,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,9896987095377829974,7248452312185609145,524288 --field-trial-handle=2256,i,2211536898615140044,8534217372871497690,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,10378842162648804028,4491945838297328758,524288 --field-trial-handle=2256,i,2211536898615140044,8534217372871497690,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,7133712668737950300,8956619503909280673,524288 --field-trial-handle=2256,i,2211536898615140044,8534217372871497690,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,404479421247365930,16679366902529457655,524288 --field-trial-handle=2256,i,2211536898615140044,8534217372871497690,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,5824536461633956027,7215462397086222375,524288 --field-trial-handle=2256,i,2211536898615140044,8534217372871497690,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5428,i,8115317254594065688,12437489879876643363,262144 --field-trial-handle=2256,i,2211536898615140044,8534217372871497690,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

08048168-a01a-46a7-b898-31f11cf40071.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\08048168-a01a-46a7-b898-31f11cf40071.tmp
Size 10KB
SHA256 3a275ac82c1ce65b9e185337cbdb91a3e8365324f5243e8dd7bc5b57d71cc768
MD5 527668d16673b01633dcee258802803d
SHA1 4bdfdeb66cb1c972222a0120a85f1e41f93a6919
SHA512 a454245f3023985928607d08fd06a5e719ccc174a161ceae261a795c295306fde81e529e0a7ac3881e2f1aa2543f370ac2000117c6b9634265842c33082aba89
SSDEEP 192:sxR7RQbT/fcsVh2zoA8p49/g6+WNIYU2RhR0G+IgDSJ:sxR7UT/fcsVhrM/5IVi
TLSH
T14C32C716AE68A97B8CCBE20DFB557F53D2F91132A0D51E48B6FC961C14E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 71597f8cf8fe0dcf12ffdba2802b152873d20f99f610f6a08035d349c2f724c8
MD5 5dd92e66a2b4531b7fbef0669cb2e89d
SHA1 0be864efd16f10a08a09a86935c5068820b2a5e5
SHA512 7f8111d41ef45f155b0b38be696ebafcc9b737142e321b59e51b56c07e97e2718089960db49b4997fa971808903c31740aa6980112860bd6a0763092c6dba1b1
TLSH
T1E461A5B0665047D6FBDA0174B3D25D9BB63DC2B0A4834E71C797F97BB802BAD052A058
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598c0a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598c0a.TMP
Size 3KB
SHA256 e40355001ce0abf8357b285a7ac7b098d91f2a52d43e964bb7fa580217569451
MD5 60a1f3a9af7f0037b8a6e7376b6c1429
SHA1 645da7cfc9a63fa170ff2050ef75827636ebc14f
SHA512 a23569adeb18d683f19fd1ad7276222b94060041492200a702b90530310edfa64ad80d5c0b4e0f617e2ca4a125f39efa54b1dfbba70658a2114f72eaeb897f2b
TLSH
T1AC61B6B0AA5047D6F7DA0174B3D25D9BF63DC2B0A4834E71C787F97BB802BAD452A064
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f706a89d279ffa57bda3ce03227008ff4cea3e3ab9cc5bd4117448c8cdf83ee2
MD5 07a847c36ed2260b31f2eb7b88d0168f
SHA1 acaf37362314499809aa65dddd79066bf6a5ba49
SHA512 dadf31089321f06fb7cd3b8ee8c125a3ded94413556fa9dd16e5e60f041f5fc78e26e3394b14d1fba544e32c54c47183da6acfba66cf636f44c040543fdcbe5b
TLSH
T1EC419EF3C7E8866D8E0156F4AB146E1BCE1D0915432C3D5AC9D49E1B93F34B1E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ed24615f07097d9b9abbbfb383f857984ae88370dcdd762b946b8cbc17312995
MD5 6feda9a4aa218ac83024b6004812df77
SHA1 69d916c426f206609f6f7a204c94d831b8bd74a3
SHA512 d5354a6c71ed20b81dde74e8f5719b8f33605947d41eaa9d32dbfe12460efd3be0722710577128968acf431da34199af6061cfc3435d65e1c35ac6f6ed4ebb1c
SSDEEP 192:sxRIRQbT/fcsJh2zoA8p49/g6+WNIYU2R3R0G+IgIJ:sxRIUT/fcsJhrM/5I9s
TLSH
T14322A516AE68A97B8CCBD20DFB597F53D2F91132A0D11E48F6FC961C14E66DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 67e7b9d533f10d3d8167d8298ea8bdb0a0de1e2e8de355cb9911ce9d2c6f43ca
MD5 3d6e574ae4aa008639f2224d397546c2
SHA1 b7c1f009d1286a059aefd28993756844ece4852a
SHA512 fa41736e654b56d2475db1c02d73efe10309ce37aea24c135009bdaa8effa4dfd161140b997f2bcb0c8068b9e236614e381c705dc4a928b1f701c1efc35e53e7
SSDEEP 192:sxR7RQbT/fcsch2zoA8p49/g6+WNIYU2R3R0G+IgDwJ:sxR7UT/fcschrM/5I9o
TLSH
T1FB32B616AE68A97B8CCBD20DFB557F53D2F91132A0D11E48B6FC961C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 83eb3f2046e3d917c9b8337e9d485574ce33762c23b807f969a054cf40ed63b2
MD5 9f6577d5ee37d7520baa04cf7930f30b
SHA1 d46a47d989f13d77bf596acfbacec5e57d4f6948
SHA512 85e29599bef6ddca8790f0c80aabc6f73173320e6c35440169eff8a5815912b1fc6d919c7f720ba773c8f8b91f760d621d1c4699fce050981a654e1585595187
SSDEEP 384:64qajXwfCtgmcFfsO7nKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV+a9mWRujroe:6JajXKWgm0fsO7n8F1+UoAYDCx9Tuqhs
TLSH
T13AB2C93B640DCB7F5F900AAD9C19AF976D9802CB96588D4047FE984C02C77FA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2433.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2433.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 dcf983f9e8e68289aad601153ee8716e7bb0b5e17c61314c5af6403e46e0925b
MD5 f9ebb3dda3e62907aab2985b89dfbb49
SHA1 31ab9bc3d24f8718cf952a530eb0894b6eba4b4c
SHA512 57991d4faaab258adcd6df8ad0585ebb436b4d392263d7bc69b3a920f542125ffcec252fcde907265e7294f4ec404e814c2c50240f8e5abca32cb8cf199f3a66
SSDEEP 768:jS36MC+XKBEE57Y0GZxJsXBdK8Zu4YGHK36:jS3s70/JsXf7k4YUi6
TLSH
T115F2B031E8A09EB35DF7D29176063783AFB446A3C6C94E84D5DDAB0D019B5AE1303D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 37efae7476106d60b18aecf6fa32b33c1c7c151ee4180eaf624a1092e63085e2
MD5 324c3d362c30fec9229d6d506d4dcd0e
SHA1 fc5397e309d1ec1224144c137c33ba8610204715
SHA512 93960bd800ba363487e8fde440eec4594ab1db9deb3b8ba46f9e3c60e55790f3acc4b45784f77a2979edd38071e09d451048725f5b5ad6e5d1c5f265b08bcadf
SSDEEP 768:7S3jMC+XKBEE57Y0GZxJsXBdK8Zu4YGHK36:7S3X70/JsXf7k4YUi6
TLSH
T1EBF2B031E8A09EB35DF6D29176063783AFB446A3C6C94E84D5DDAB0D019B5AE1303D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 ca3be48408693c68b44d229762f293ea801f054fc76ae4ff972f75044f6d90d6
MD5 d84d1d94744524f6bbff2e72fee77671
SHA1 1fef337d9e6f42dbede21039320821406a34f6e8
SHA512 be14299ba55302d498b7d6458eb9b869ae8697f060f8f79773a363c1a47303bd7f0a2f1de781b844c14f591871210031064b7bb29cd7196ecac00b248f34bfe0
SSDEEP 768:P/UxvxjgC+/3XzAXKBnE57Y0GZxJsXBdK8Zu4YGHKIm:iZj3+/3e70/JsXf7k4YUBm
TLSH
T10513C031E8A4AD635DF7D690360A77D7EFB446A3C2C54DA849DD6F0D028B2AD130391B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 5e2efb7faafe5f61472586cce3808180ad4c288edc41d694cad2dd4568d6be4c
MD5 331eec66de06e91b40f188ac169c283e
SHA1 f192b0761997b9f2e67eb78cfa1771b7c989343a
SHA512 57e2734c60b7dee1b6c552fee8f47d60a661d44c3d9e817bcfe7caefd1cd1e9635ff8ae6ced7d233bbe54a75d69a1315651279653fbf1ea5a1301c1cf401ad7a
SSDEEP 768:oFQ13UwggMC+XKBYE57Y0GZxJsXBdK8Zu4YGHK36:L13N70/JsXf7k4YUi6
TLSH
T184F2AF32D8D4CA779DFADB81BA0A3683AFF442A3C6C98D94D6DDAB0D015719D1303D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 2e9d970a9242a67e3afd176078300b991bdfa34ef03bf446f6c15918156b2f2b
MD5 aa945f87542d1abfb45b888949a055cb
SHA1 e0cb614b8ef522b78a8b367c26ef3fccd0ef3de6
SHA512 bf7261da185bfabe1d3e8dd0cd94d1aff465d08da76df701a22f51577e28c34f3a1d7e6737deb5b3ad15b02de030b4d54eaa0ea4fe6d1810acaf40d74ccd8263
SSDEEP 768:A/UxvxjgC+I3/rKBCE57Y0GZxJsXBdK8l6NSHUPpMs:tZj3+I3o70/JsXf7ANSfs
TLSH
T16603CF34E8A09D735DF79390370A7397EEF446B3C5C55AA88AED6B0D128B26D030395A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download