5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-k8m400.htm
Size 1KB
Sample260930-ld38bas16p
SHA256 5d6004c82e2d7244aad68bb00365d03353aa2ac2d87ec93b28b59b029543fde2
MD5 3a134f40128e3382caf68c7037564ce6
SHA1 d53f727b1b15ed1d2286e65613578331cb2a01f7
SHA512 7dc021062e3dd4f2601fa8291c6c7370bcb1b579bc09aac01ed304c2dfe255c0a67248a2e7b90940563d9c914749f0488d85f55208a5f48bf413f651b735d21e
TLSH
T1FD11CCDB03E23DA45493333764434B8EDF380175E7724F753475211A138A29AD4239F4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4760	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{8BC7E4A5-A425-4329-8654-DB0CE974C17D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 5624	4228	msedge.exe	89
PID 4228 wrote to memory of 4760	4228	msedge.exe	90
PID 4228 wrote to memory of 1056	4228	msedge.exe	91
PID 4228 wrote to memory of 1056	4228	msedge.exe	91
PID 4228 wrote to memory of 1056	4228	msedge.exe	91
PID 4228 wrote to memory of 4168	4228	msedge.exe	92
PID 4228 wrote to memory of 4168	4228	msedge.exe	92
PID 4228 wrote to memory of 4232	4228	msedge.exe	94
PID 4228 wrote to memory of 692	4228	msedge.exe	95
PID 4228 wrote to memory of 692	4228	msedge.exe	95
PID 4228 wrote to memory of 692	4228	msedge.exe	95
PID 4228 wrote to memory of 4232	4228	msedge.exe	94
PID 4228 wrote to memory of 4232	4228	msedge.exe	94
PID 4228 wrote to memory of 3420	4228	msedge.exe	96
PID 4228 wrote to memory of 3948	4228	msedge.exe	97
PID 4228 wrote to memory of 3420	4228	msedge.exe	96
PID 4228 wrote to memory of 3420	4228	msedge.exe	96
PID 4228 wrote to memory of 3948	4228	msedge.exe	97
PID 4228 wrote to memory of 3948	4228	msedge.exe	97
PID 4228 wrote to memory of 2856	4228	msedge.exe	99
PID 4228 wrote to memory of 2856	4228	msedge.exe	99
PID 4228 wrote to memory of 4508	4228	msedge.exe	100
PID 4228 wrote to memory of 4508	4228	msedge.exe	100
PID 4228 wrote to memory of 1572	4228	msedge.exe	102
PID 4228 wrote to memory of 5688	4228	msedge.exe	106
PID 4228 wrote to memory of 4588	4228	msedge.exe	107
PID 4228 wrote to memory of 256	4228	msedge.exe	108
PID 4228 wrote to memory of 4708	4228	msedge.exe	109
PID 4228 wrote to memory of 4708	4228	msedge.exe	109
PID 4228 wrote to memory of 1116	4228	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-k8m400.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffc0eebc188,0x7ffc0eebc194,0x7ffc0eebc1a0
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,14591707718948421436,14316591903674213814,524288 --field-trial-handle=2572,i,6423501098339357024,17574692707758001011,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,10449619284380457216,5061894766360337198,262144 --field-trial-handle=2572,i,6423501098339357024,17574692707758001011,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,8278607256696371031,17456601743301742053,524288 --field-trial-handle=2572,i,6423501098339357024,17574692707758001011,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:13
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,15284712773697888500,5711235544388318617,2097152 --field-trial-handle=2572,i,6423501098339357024,17574692707758001011,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,8833296431820363575,9422448691215521189,2097152 --field-trial-handle=2572,i,6423501098339357024,17574692707758001011,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,17896536514575094537,11957585426927413866,2097152 --field-trial-handle=2572,i,6423501098339357024,17574692707758001011,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,16410995535181731380,3145587619152099159,2097152 --field-trial-handle=2572,i,6423501098339357024,17574692707758001011,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:9
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,12807346428861830128,9219270103068664532,524288 --field-trial-handle=2572,i,6423501098339357024,17574692707758001011,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,14934261664995544301,15805419875341908069,524288 --field-trial-handle=2572,i,6423501098339357024,17574692707758001011,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,2072986578441359757,6342927326276028319,524288 --field-trial-handle=2572,i,6423501098339357024,17574692707758001011,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,2072986578441359757,6342927326276028319,524288 --field-trial-handle=2572,i,6423501098339357024,17574692707758001011,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,5513968575637958479,10668810492683664159,524288 --field-trial-handle=2572,i,6423501098339357024,17574692707758001011,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,6495441977708115466,6688409764126279338,524288 --field-trial-handle=2572,i,6423501098339357024,17574692707758001011,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,3465013790868529738,16601659862908864821,524288 --field-trial-handle=2572,i,6423501098339357024,17574692707758001011,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,10921908827280816050,16474825970858729574,524288 --field-trial-handle=2572,i,6423501098339357024,17574692707758001011,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=816,i,15857994588183593454,9507582642750355614,262144 --field-trial-handle=2572,i,6423501098339357024,17574692707758001011,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4ca6d0cc59e61e518fc27bcb04b074cc30ea6ac8087bd062a34e3dbf5c0dd84d
MD5 9ce99e0f559907ab842270ea710b4560
SHA1 4f5909df3a89a700c1dcde5565ed727c2851bcde
SHA512 41ea9b5064981d478e4689522eea9ad0a1720c6a8c07e8b6d40ba5a2aad9acebe31c898f104c77400a35b14c6be9d261f6808227802305934d03a26fadd98f3a
TLSH
T1D3510A4F83E48079F79850B4A2E93C8A396885D16AFB1EDB0394D6B8580236573C9723
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597258.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597258.TMP
Size 3KB
SHA256 e046606ba19921ea4e1889ccddc2d18bd3262c72c6bea1a86051588d6f32b3f8
MD5 9bf68e96cc9431c56cc615fa6d75c2e4
SHA1 23d47705244266e4699e2e2c5982ad938881facc
SHA512 c08080027e0d535551136e12e9a1bd67fd59c0c3f9ca54fdd6f18d4f253dd360c4655f30d6f8d9850920d2db362684e2733b47e29914060088354462ecbf7e0a
TLSH
T1AC51088FC3E48079F79810B4A2E93C8B396885D16AFB1EDB0394D6B8580236573C9723
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 171fc1cc500e4ab7e09bad560a78688ac2c2eb1485d472ac8aba294a3d2bdccf
MD5 7420cb7509e0ef7ec8cafe9b489ba520
SHA1 f322c1ed6b3d9306fa2c4b52a040e0fe8c286d0a
SHA512 2ca4d580b20e2a2f805eb9ea5240d165c9b9518c24fff273c34c82b15369e623467070d4b3552d50b87f0b6ef3f85f9cc04f44b72caf1f7a01261ea06d1d2538
TLSH
T133419FF3C3E8866E890156F4AB146E2BCE1D0915432C3D5AC5E4AE2B93F34B1D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c213e19c1ebbecb52439f6d38cdf921d3bd0205346b4e95f1d9497221a94bc96
MD5 a1e757ef242f21c5d96b247e1470f094
SHA1 3ca3bc824227eab16b828c289b16438a80295464
SHA512 21e270141c6d8590ff4fb14da880d8b544f70cd0583517c866932f064f9602888924d43d908c7fed24131a7e983d45a7e85a005e21d8a7649b9958e5e0367fde
SSDEEP 192:sxRGRLb6/fqs0mqzoA8p4C/g6+WNIYu+8iwGCIgDTJ:sxRGp6/fqs0mnT/5IYoZ
TLSH
T10932C715AD68A97B8CCBD20DBB55BF53E2F91032A1911E48B7FC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9f3d1f85136f7fab89b4346be3d8661a0f4d925861e62be6176c6cb1f2032433
MD5 b9ee49f3beeaaa36cee35ab17480973c
SHA1 82e6c4862a657c4bbc5ac0a1ef1139af8de1b6ec
SHA512 22bbbf442d62277325343a8d4478efb95bbdd1f4b6eb551857f2595bab3f8eb8327138b1def6c1f226f9d7dab7e7b2ad480d7e153e43bc2cea4c8553ad2b3898
SSDEEP 192:sxRpRLb6/fqsYoqzoA8p4C/g6+WNIYueiwGCIgIJ:sxRpp6/fqsYonT/5I0s
TLSH
T14332B615AD68A97B8CCBD20DFB65BF53D2F91032A1915E48B6FC961C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6d02db3836c5f28bec9c4108c6c3e715ed86e8b895462a4030ecb4d3d34134c5
MD5 85a465b3dbee3be9063893fb94710c22
SHA1 8a435af3ee931d5495bee84d84d0a123db11dace
SHA512 e677ef0cc9076a0ff1fe446e465323d3f90f5a7883b029c5955a00f19f08ca097064b7a747f0dcbd835a68210d6acb696c6b665c4f7edd331fe4df9cc54f741f
SSDEEP 192:sxRGRLb6/fqs0oqzoA8p4C/g6+WNIYueiwGCIgD9J:sxRGp6/fqs0onT/5I0r
TLSH
T11132C716AD68A97B8CCBD21DFB55BF53D2F91032A1911E48B6FC9A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 95a88147ee3f80277ee151fec9d02a17dd2b1809b8e025d571eba6ab4d4a1ce0
MD5 80ca03eb34d1abc0bb6da1f334e5b5cc
SHA1 7a9e09b921981af50466548b018c3987d72e3d93
SHA512 f38cb809bd22f498be2747e08c3af3b4f514bd358c8cdaf2eaca826b024e5bff4790dd932d2cb86265089dcea50876979a6cb672708515122d0ecf29a0e061f9
SSDEEP 384:/7fnhUVfCtg6UFfCwKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXb9kMR6frocbT:/jnhUJWg6cfCw8F1+UoAYDCx9Tuqh0VL
TLSH
T1DBB2EA2F644CCB7E9FC00AADEC196F976D9802C796988D4047FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0d30.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0d30.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 24bb4bcf637c6cc59a54e1dc4cdadffd14883f4f58a3d40f207537ee30a80b53
MD5 d06afbd2c0a2b412217dcd4633edcf4b
SHA1 26fe133b4c03769f51700fa56e97a3b4e5e56b1e
SHA512 a8ecb944039dc0983693808393824206da6f69063c1351536dc90c89a23221e6f13f4742417a433d400a6ab5b74bb2e411fbfb161c2750fee711838fb752f56c
SSDEEP 768:5t/UxvxjgC+p3HVSO5faXEMIYNa8S5oYklnA+c4YGHO3:2Zj3+p3JBTWRdAr4YUO3
TLSH
T14513C036B9A4AD739CFAA3C5B107A787EEE44253D1C56DE849DC1F0E06C72AE1303856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6c9ddd1464f9ec54533feae60e591409dfde63b7e10ab5ca915159386017128f
MD5 00669af03f355680ee46fc0a8ac59b08
SHA1 f67c2351b3673b86f0e754ee4a75e62869003b1d
SHA512 157eb9a5742f54aa016c17b61a9e60197bd820baed8207b6904e4577d2e66b597b7c91c5214dd33293df387b2863e227a4d68d7d174dd9c26e040e6dc61d8ce3
SSDEEP 768:PA32VSO5faXNMIYNa8S5oYklnA+c4YGHLf:PA3kuTWRdAr4YULf
TLSH
T155F2B036A9A49DB39CE993C5F107B783AEE44213D2885DD8C4DC6F0E16D76AF1303866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 44a9b9f0f298391b0947e74c2a052d9f04c241364084ad189456b55e7605509d
MD5 421d3790159dbc587a4aeb7437f2ec54
SHA1 a697ffbb0dc75c75190e9326be50c8b073b8d455
SHA512 fa4fdbb05235e5cdf62c7aff723346c15c8903ce24ee78563df55772840ce1a22762919847e4cb106347c53a1431a4fa5d852d493ae6af04744fc831e3019480
SSDEEP 768:5BA3XVSO5faXNMIYNa8S5oYklnA+c4YGHLf:/A3ZuTWRdAr4YULf
TLSH
T157F2BF36A9A49DB39CE993C5F106A783AEE44213D2885DD8C4DC6F0E06D76AF1303816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 c3d0f862b8df57ae9b40ba741aaa203fb6976b1a4e39b8a28de83be6a2937933
MD5 f013e7450604b9b047cd5d4feeb68084
SHA1 337079d558458eea877443e4f9600f561101fe71
SHA512 826b93454eb07cc9ef0cbc54311e0d716ab6c8279ea11659f306fd50c75fd6cc396e102460ce300ba544315e37181e957561258e4cdfd55fa232f3d10fad9b8a
SSDEEP 768:yFQ83Twg6VSO5faXIMIYNa8S5oYklnA+c4YGHLf:J83GfTWRdAr4YULf
TLSH
T17E03BF33A9D4D9B3DCFA97C5F5067742AEF04263C188A9E8D5DC6E0D11971AE1303C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2bfd7a7a45e5e2acda562f860ef405b209823b08207c4a459df1adfff996877b
MD5 3adbed71f328578db6f357a19488c61b
SHA1 838c2b427019498e757f4e32ff5859f53152ad45
SHA512 9c338f7f243536e500fc145e7dfef773dde22a7fc80511911160eae331e0b338dc9e39c97f10c6af525da07d0e013ce2232d0082223d55c343818196b5664d53
SSDEEP 768:do/UxvxjgC+23hfySO5faNJMIYNa8S5oYklnAaxSH8L4:nZj3+23h+sHTWRdASS04
TLSH
T1CE03C03AAD94A973CCF663C4B20A9397AEE55263D1C069F889EC1F0E17C77AD5303452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd184ccc-28db-4f96-9ef4-0a9efc64500e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cd184ccc-28db-4f96-9ef4-0a9efc64500e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download