5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-8fmal8.htm
Size 194B
Sample260930-lpaedaxbme
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6140	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{59D3330B-E27B-45F8-9902-7BF992CB9D80}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5892	msedge.exe
5892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 5984	4648	msedge.exe	88
PID 4648 wrote to memory of 3336	4648	msedge.exe	90
PID 4648 wrote to memory of 6140	4648	msedge.exe	91
PID 4648 wrote to memory of 3336	4648	msedge.exe	90
PID 4648 wrote to memory of 3336	4648	msedge.exe	90
PID 4648 wrote to memory of 5252	4648	msedge.exe	92
PID 4648 wrote to memory of 5252	4648	msedge.exe	92
PID 4648 wrote to memory of 3556	4648	msedge.exe	94
PID 4648 wrote to memory of 2860	4648	msedge.exe	95
PID 4648 wrote to memory of 3556	4648	msedge.exe	94
PID 4648 wrote to memory of 3556	4648	msedge.exe	94
PID 4648 wrote to memory of 2860	4648	msedge.exe	95
PID 4648 wrote to memory of 2860	4648	msedge.exe	95
PID 4648 wrote to memory of 460	4648	msedge.exe	96
PID 4648 wrote to memory of 460	4648	msedge.exe	96
PID 4648 wrote to memory of 460	4648	msedge.exe	96
PID 4648 wrote to memory of 5640	4648	msedge.exe	97
PID 4648 wrote to memory of 5640	4648	msedge.exe	97
PID 4648 wrote to memory of 5640	4648	msedge.exe	97
PID 4648 wrote to memory of 5008	4648	msedge.exe	99
PID 4648 wrote to memory of 5008	4648	msedge.exe	99
PID 4648 wrote to memory of 5872	4648	msedge.exe	100
PID 4648 wrote to memory of 5872	4648	msedge.exe	100
PID 4648 wrote to memory of 1888	4648	msedge.exe	102
PID 4648 wrote to memory of 4732	4648	msedge.exe	106
PID 4648 wrote to memory of 5088	4648	msedge.exe	107
PID 4648 wrote to memory of 2852	4648	msedge.exe	108
PID 4648 wrote to memory of 3684	4648	msedge.exe	109
PID 4648 wrote to memory of 3684	4648	msedge.exe	109
PID 4648 wrote to memory of 5892	4648	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-8fmal8.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7fffbe36c188,0x7fffbe36c194,0x7fffbe36c1a0
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,2972137568602802613,9410263523483407272,262144 --field-trial-handle=2472,i,14438700341535602845,16827273797944429686,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1680,i,15760580217682882069,17888511945833411623,524288 --field-trial-handle=2472,i,14438700341535602845,16827273797944429686,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,1546347269691406647,10165833674582444993,524288 --field-trial-handle=2472,i,14438700341535602845,16827273797944429686,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:13
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,8402926391103340564,16245305635823961754,2097152 --field-trial-handle=2472,i,14438700341535602845,16827273797944429686,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,18011389004182465034,17078686435983975629,2097152 --field-trial-handle=2472,i,14438700341535602845,16827273797944429686,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3984,i,5808356522045493952,2254118178086583011,2097152 --field-trial-handle=2472,i,14438700341535602845,16827273797944429686,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4056,i,9200140649898832173,13150992017902768476,2097152 --field-trial-handle=2472,i,14438700341535602845,16827273797944429686,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:9
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,8085974843573813723,10156982432179605124,524288 --field-trial-handle=2472,i,14438700341535602845,16827273797944429686,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,12964669096091766645,14597638132989707701,524288 --field-trial-handle=2472,i,14438700341535602845,16827273797944429686,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,13015977504292332254,14902459698584580286,524288 --field-trial-handle=2472,i,14438700341535602845,16827273797944429686,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,13015977504292332254,14902459698584580286,524288 --field-trial-handle=2472,i,14438700341535602845,16827273797944429686,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,11219146356911543334,13393066579333478819,524288 --field-trial-handle=2472,i,14438700341535602845,16827273797944429686,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,1070746565275396554,242740730077948203,524288 --field-trial-handle=2472,i,14438700341535602845,16827273797944429686,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,2234328032822608992,16625629471834291369,524288 --field-trial-handle=2472,i,14438700341535602845,16827273797944429686,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,18401309486471355592,12686317829188516407,524288 --field-trial-handle=2472,i,14438700341535602845,16827273797944429686,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=816,i,9958029548624762258,18373339215468278768,262144 --field-trial-handle=2472,i,14438700341535602845,16827273797944429686,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5892

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e67268c7eb35315947389439263a708d0cd042f91ac3fc938f67343e3258241f
MD5 abc79cbb830589765cf0079f30dc6aed
SHA1 edfa00c572a71675af4b8a8209705462bcce3aa8
SHA512 3e065dd8f6514c90785dfbb0f11bab821b25031cd4b9a3bd91800667aeedb94d534b06676f9aac0af79b03b2172193b3d1f8c958f58eefa840cbec0281992197
TLSH
T15551B649979245DBDBA570B19EC10C9BFD3426F08483DF5205A5D969AB0B3A8C1CD3B4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593128.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593128.TMP
Size 2KB
SHA256 5361509c808adb72c433dc3f9353dcc08163cc0dbf422fd9e84b38d1151529d3
MD5 7ec43ea1769292da54820ad178e41aa0
SHA1 c595c9f83962492a7fbf3e238006dd72e76464b9
SHA512 3d71d4b0b319c8c5d57d74422a5bc02b13fbd4474707079089ab89b760cf60d16f66184a48ef7c906f20aff3637a940c3c6e986ceee41f8f0398c851e8405751
TLSH
T12551B64997D205DBEBA570B19EC10C9BF93426F08483DF5205A5D969AB0B3A9C1CD3B4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 04dd1ad5afe18ac67b8e214b651704f5136efe9f377d1ee234400c5934fdcd99
MD5 6c388266f6505c1629b6914a53fe01b4
SHA1 f53bc828b6e17f569a8eed686cc934c5ec5351e8
SHA512 acd438e2588c28583aa1ba6056fb5ab7f78617c265a489832b9e809c34edc13000c344e4a8b68d4312d8423ab769103602dec077305f0e3356f1687a4ddf8664
TLSH
T165419FF7C3E8867D890156F4AB186E1BCE2D0915532C3C5AC9E4DE1B93F24B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5b35a6c252a7ec0995d4fbced246b9f77b1bbdc54d144b3eb04233b0480e47ea
MD5 5969fb549d0924e439d5c5baac8b6fa7
SHA1 8cb55e99640c15342d7d8dbabde3b457315dd43d
SHA512 aaeebf9750567290ce41df2885046be7b15971b18e4f8c3497b5da6adf0b366827be361acb671e1f9224942adbe6f8b380d32c926296a7bb767b74c6314df4ec
SSDEEP 192:sxRyWRybV/fsGsKyYhjzoA8p4ay/g6+WNIY28cLGeIgIJ:sxRyWGV/fsGsKbSby/5IPfs
TLSH
T1A6329815AE68A97B8CCBD21DFB69BF53D6FD503260941E48A6FC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0cc821f7ac404770ceb7ff6a78fa5f4a90288ff9009b38f8ab0c2186c4125363
MD5 4f8867fec7f548c6557eecab38a21d64
SHA1 f57f486baef6b503378e4b7c702bd1fac662876c
SHA512 7bc686025b8a58af6d42803fe9ee00a0c05e045361bcf03cc64999d02ce5a9a595ed3408aaadb7f7dea9d14e7fb9675b42a1f1a949cbd3d943d61c41fa6cc345
SSDEEP 192:sxRTWRybV/fsGskyYhjzoA8p4ay/g6+WNIY2zcLGeIgDXJ:sxRTWGV/fsGskbSby/5IufN
TLSH
T1B032A815AE68A97B8CCBD21DBB69BF53D6FD503360941E4CA6FC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6ba3edb73d2f7fc960aaaf2b7a72539c7263eacbf8f326e1b99083269c66035c
MD5 7fac1d3e7bd3dc832f64ba1e910a8014
SHA1 c57f0a11b48e2d84db807f63011b8d8f7779f2fe
SHA512 6a5761c7fbec8a2754c98ef96808b31636fe1afa8a89e9672537989d10b09f9a3d779457f01c6db0d5e068f1daf93b674f7ed30dcc4f35ad39a1f7123d5c4f56
SSDEEP 192:sxRTWRybV/fsGs+yYhjzoA8p4ay/g6+WNIY28cLGeIgDBJ:sxRTWGV/fsGs+bSby/5IPff
TLSH
T18B32A815AE68A97B8CCBD21DFB69BF53D6FD503260941E4CA6FC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 1ff5ca3f2f05bb111260125ccfa8b037f6e52cecc6de83a0c8538fc6ec9ad059
MD5 a2cc060e6d72ecbd24f86b4672e8b568
SHA1 bef438e23eeb5db20a930b6884b4b387468ce95f
SHA512 b13ea11bf23cb75384c785c5597032ada6188b63a5cab0b89bef81a05671a9d0d843d980bbc32fc238d452c05a3d8c3e8c6fff2dc89a03ae654f3fc373fc6362
SSDEEP 384:LbnaaCTfCtgp/FfvDKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVPH9NvRWiroHrK:L7aaCDWgptfvD8F1+UoAYDCx9Tuqh0V2
TLSH
T118B2EA2F644CCB7E8FD00A9DAC196F976D9802C796588D4047FE994C02C7BEA911E4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

90341df2-bb75-48a6-810b-2d7975f9d5cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\90341df2-bb75-48a6-810b-2d7975f9d5cf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 99a8946bc306b90722516b58bbaec12bfda8ecd01a203dc0b721e5698bf2b94b
MD5 1cabda6620c338dff630a9a71a4cc3bc
SHA1 3be3cdd3a9548157e9906b255e3cac4dac3c2f2b
SHA512 ac27789902191cc910fa400dbb5332fad5bcf8cbddfafef24d041f1a230d27b88754451d1540a6377a8fa7b0ba1342d7b2a84e5b52c6cd22634b3524d340d3ca
SSDEEP 768:j63ztgm1+mFc6uDmGA5b65Q92RQMPbchYGHfb:j639GAF65dQPhYUfb
TLSH
T1FCF2BE72ECA4DEB35CB9A1C13587B2456FF88253D1CC568498ED7B0E019799E0317D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 b4200f06c838cbfc49a4cf58529de9d054e87b2213fbdacb5f12740b8a176a46
MD5 397400f1159cb7abd3f97c2ba25c197a
SHA1 a390c9262690c4cc6daa9d36ceaf58ce712296c8
SHA512 619a0ddaa58ce39e3a4d050b9d44bec7ba32c8e74279ff85957a8d1cd33f151555ed73c75a2813ab0fba8f82415fc3a9c3238b1ad8bc24edd5474cde3ac7db89
SSDEEP 768:6FQm3kwgitgm1+mFcaDmGA5b65Q92RQMPbchYGHfb:hm37AF65dQPhYUfb
TLSH
T10003BE33DC94CEB7ACB996C17A8B7245AFF48263C4C89694A6DCAE0D01975DD030BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7b49db9502792b0df24130e06c0eec073cae2297863c09c3dd5e5f83a8ec03b9
MD5 dfd88b9a655ba1441334f4c13d296e5d
SHA1 45869a74992f3badc26ef17d4ff40430a80139ed
SHA512 f5362fd5e3c4f7eff061b6099f61b909f9d269efff5a6a22fbc2fdd97bf793e6fec7949cd621df4fcc79758b1c419cec7dbe2113381850d5016d1f5142e303b0
SSDEEP 768:B63qtgm1+mFc6uDmGA5b65Q92RQMPbchYGHfb:B63SGAF65dQPhYUfb
TLSH
T118F2BE32ECA4DEB35CB9A1C13587B2456FF88253D1CC568498ED7B0E019799E0317D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 65c91abf52977ff8daab4da9872f1e6b79a91dbb348fd766b07dfdac8b9e3375
MD5 657e9461c44634329368ca006cc4ce7d
SHA1 8b364dccf32b68339c4c947a591a62410f12d16c
SHA512 f1db1c049f6c96916549fb04e5c1399d8202bd2e25d20b1fd2049f3b56d0b6733ea6e1f03ccd1540df3ceb2006bcc6cf7f214205a49eda1b21284c8851b59ad5
SSDEEP 768:U/UxvxjgC+B3v8nRgm1+mF6tDmGA5b65Q92RQMPbuFj0O:BZj3+B3Em3AF65dQlFQO
TLSH
T16903C036EC94AEB79CF952C0364BB35AAFF88573C0C456A049F96E1D06C768D430B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

129a8680-9263-4b3d-ba49-fa4cfd47149a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\129a8680-9263-4b3d-ba49-fa4cfd47149a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download