ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-ezp6gv.html
Size 116B
Sample260930-m63ypazvcx
SHA256 ccde54317343ebacd6da2afde0b4007f766b637b1ba34510c74de49797553d77
MD5 0e2f15dcf7166552e959f0ddb363e706
SHA1 642e84dc85171feae5dbbb9727736ee1424a232c
SHA512 2a659912d4f25102f996a71566eca6840ac2b3271147c266d9836f2fc5785b4b514e248b396d62b7504556f50046f7610023adc8c55c2c9b9a8ec715c29ce525
TLSH
T122B0125F120702053D601D527DD3375714174B9E01A969E01267C9FECCCB9B2EE4739C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1320	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{F01143C0-A11B-43D1-968E-8F01F44A9CEE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 3408	2584	msedge.exe	89
PID 2584 wrote to memory of 5768	2584	msedge.exe	90
PID 2584 wrote to memory of 1320	2584	msedge.exe	91
PID 2584 wrote to memory of 5768	2584	msedge.exe	90
PID 2584 wrote to memory of 5768	2584	msedge.exe	90
PID 2584 wrote to memory of 5056	2584	msedge.exe	92
PID 2584 wrote to memory of 5056	2584	msedge.exe	92
PID 2584 wrote to memory of 3808	2584	msedge.exe	94
PID 2584 wrote to memory of 2428	2584	msedge.exe	95
PID 2584 wrote to memory of 3808	2584	msedge.exe	94
PID 2584 wrote to memory of 3808	2584	msedge.exe	94
PID 2584 wrote to memory of 2428	2584	msedge.exe	95
PID 2584 wrote to memory of 2428	2584	msedge.exe	95
PID 2584 wrote to memory of 4836	2584	msedge.exe	96
PID 2584 wrote to memory of 4836	2584	msedge.exe	96
PID 2584 wrote to memory of 4836	2584	msedge.exe	96
PID 2584 wrote to memory of 3864	2584	msedge.exe	97
PID 2584 wrote to memory of 3864	2584	msedge.exe	97
PID 2584 wrote to memory of 3864	2584	msedge.exe	97
PID 2584 wrote to memory of 3380	2584	msedge.exe	99
PID 2584 wrote to memory of 3380	2584	msedge.exe	99
PID 2584 wrote to memory of 1300	2584	msedge.exe	100
PID 2584 wrote to memory of 1300	2584	msedge.exe	100
PID 2584 wrote to memory of 1232	2584	msedge.exe	102
PID 2584 wrote to memory of 1396	2584	msedge.exe	106
PID 2584 wrote to memory of 1876	2584	msedge.exe	107
PID 2584 wrote to memory of 3644	2584	msedge.exe	108
PID 2584 wrote to memory of 4764	2584	msedge.exe	109
PID 2584 wrote to memory of 4764	2584	msedge.exe	109
PID 2584 wrote to memory of 2852	2584	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-ezp6gv.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffece6bc188,0x7ffece6bc194,0x7ffece6bc1a0
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,16645117119200935638,16900482487080654441,262144 --field-trial-handle=2108,i,11505895055730965560,17461120860085064592,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,16080102705268269326,2234293020814420801,524288 --field-trial-handle=2108,i,11505895055730965560,17461120860085064592,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,6088821407267443153,7124627978106304740,524288 --field-trial-handle=2108,i,11505895055730965560,17461120860085064592,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:13
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3636,i,1676548045613966632,1090930796517961722,2097152 --field-trial-handle=2108,i,11505895055730965560,17461120860085064592,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3652,i,912294282952707696,12255508978101945880,2097152 --field-trial-handle=2108,i,11505895055730965560,17461120860085064592,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4420,i,2829049364975100254,2970432288944085833,2097152 --field-trial-handle=2108,i,11505895055730965560,17461120860085064592,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4432,i,3064814493944413117,17897341760625560749,2097152 --field-trial-handle=2108,i,11505895055730965560,17461120860085064592,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:9
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,6147527055674869459,16246455044192977535,524288 --field-trial-handle=2108,i,11505895055730965560,17461120860085064592,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,18327178542451670254,13797984332829821949,524288 --field-trial-handle=2108,i,11505895055730965560,17461120860085064592,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,10040474374487276551,22792711086733180,524288 --field-trial-handle=2108,i,11505895055730965560,17461120860085064592,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,10040474374487276551,22792711086733180,524288 --field-trial-handle=2108,i,11505895055730965560,17461120860085064592,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,8758719660923001055,18257374570673650946,524288 --field-trial-handle=2108,i,11505895055730965560,17461120860085064592,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,17202029428543885645,8851626417032221204,524288 --field-trial-handle=2108,i,11505895055730965560,17461120860085064592,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,13677914458934644304,2647679785361799899,524288 --field-trial-handle=2108,i,11505895055730965560,17461120860085064592,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,14163237731471539924,10936665980799628031,524288 --field-trial-handle=2108,i,11505895055730965560,17461120860085064592,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6516,i,3489834410161787855,7888942743851388826,262144 --field-trial-handle=2108,i,11505895055730965560,17461120860085064592,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 62a696a4e79d9882538065428d091a51da64181c8bcc7f71e6c2a0ab1a3a45df
MD5 af21365257bc2833ec50b4770ae21dd5
SHA1 ef3fb9e06cb5bb9771cfb505712b96c6ace97bb4
SHA512 2b2c1533d23f2a9ba3f2e00ae05cdc0aa232919fa853db005316a2d91ab177edd74c0f85a7d7a29cf6dd21341ce6a74187a5d5f40a7b7e3835cb49c066eeedf7
TLSH
T1A351628006E4BC9FF75D413081D31DA3BA3C4D8311E32EDA86EAD7BA5A0B7654354B57
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595b26.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595b26.TMP
Size 2KB
SHA256 9e82c7c0a04e00dbb49dd27132902b2f14cc41807975fdf1701599425bb9d122
MD5 5e29a44d4012daeb3de9ccc43719b477
SHA1 d1b8fb2c3d10572c90c4d4cebc4c61b9bd45d115
SHA512 a64deff9d86742e2519ad2681bdca275c6ae4a6600a3d426021ca786d5b5bd0c29024a8bc3b2c2556bac5a7b6aed1235469a9e92c4502283fcb25402aeebaf80
TLSH
T1A051518006E4BC9FF75D403081D31EA7BA3D4D8310E31EDB86EAC7BA5A0B7694254B57
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6c30a9aa85c153af5eddd409d21cd5cd46d51eb35c551c0a5d737145f0d18382
MD5 7c08ee82da4f7a9bb501bbfbb0073d74
SHA1 f172b592ad0a75eb9ca4b01a049df82044120b00
SHA512 2a69b14c4eeec8a79bc2ef0c05c3464f7456b92b2da2313cf94a8d1c21d7b3bc7ce6bba5ce40cf7d50e7e411f0aa1a402ab8b87d88ed22be6d91294cce97fd15
TLSH
T1A3419FF3C3E8866E890156F4AB146E2BCE1D0915832C7D5AC5E4AE2B93F34B1D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6140146846df58b87059e82be7394201ec2bd269bb7b3787d9f6349b8ddd9bca
MD5 a36de91134e7184f159050e8ba1c5ec1
SHA1 5ede0e5fe0ca5c974a912005ac1200a23eaea46c
SHA512 2bb1d6c2ec605f81589d46abe0cf3248c99b4cbf314cbcdb029cdb9494ce569134abce77c0bfc66ea2b74cc1c1d5539b6c115ec86d67bc669f0d415db79405bc
SSDEEP 192:sxRIR4b5/f1sHl3YzoA8p4x/g6+WNIYuei4GMwIgIJ:sxRIs5/f1sHl3hQ/5IyMs
TLSH
T1F622B6156E68A97B8CDBD60DFB55BF53E2F91032A0911E48F6FC9A2C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b70d8b4e35348982a21fd6be406dbd4e615c37ec8c1375108bb3743b262d1d81
MD5 5466d63b19cf9cce8504d6dd8ce92d8a
SHA1 6c66a68bc72c48eaa57903d264855591d10851ba
SHA512 fe16ca5a09dde0c63241be12f113d58768732e1d0b0d18a6e3c59c94df57c2c7619b5e35d349b7e540a396957087844e075b4709dfc24d925e52df3561a946fb
SSDEEP 192:sxR3R4b5/f1s+23YzoA8p4x/g6+WNIYu4ni4GMwIgDiJ:sxR3s5/f1s+23hQ/5I2dMi
TLSH
T1DF32C8156D68A97B8CDBD60DFB957F53E2F9103260911E48B7FC9A2C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 08e1c211df3c678851d8d9a3bd422b51cbfca636f22db6774fc44be7951562d2
MD5 8200ee55161b7227cb5b7c72d3913feb
SHA1 0ccee735f27ec3140195c72488690f67a3099983
SHA512 262bb589b430ed3ba204064701a4ee38323c3b0b68fefb3eae2c75cb0e1be8c6ef875ab5d59b0b7eea136c4960c0ac500819b3972d9069f6c5632e0f8a00766a
SSDEEP 192:sxR3R4b5/f1s+l3YzoA8p4x/g6+WNIYuei4GMwIgDAJ:sxR3s5/f1s+l3hQ/5IyMo
TLSH
T18F32B8156E68A97B8CDBD60DFB957F53D2F91032A0911E48B6FC962C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 1faa6539857095b8f3646c81822ed3ff3c2b9d18c50f5a3ae84ea3b4a9efa6b2
MD5 7e12f8c9fbf3db46f821530165f2638c
SHA1 86544a251baa60fa3c48e5e0261f84a5350bde64
SHA512 2d003c879422632a9891ca5b474c52d5a2a0463dbcb1e558e8f873c2c8a5cf4c32e3121005e92287bd14df22398ee220b06e8f2004c1b923412facdca115b79d
SSDEEP 384:/7fnhUVfCtg6UFfCwKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXb9kMR6Erocb/:/jnhUJWg6cfCw8F1+UoAYDCx9Tuqh0VG
TLSH
T130B2EA2B644CCB7E9FC00AADEC196F976D9802C796988D4047FE994C03D77EE911A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f284.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f284.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c195a826dfc7b61870a1c97592bcdea79d2bf88307fd11fe466b303953930f5b
MD5 4d530a92f159773647f18b945badd290
SHA1 8641c5229a7025e4f4b2c88d2331525f7ab2f9c4
SHA512 37d4b60a1bafc62eaf5113af7f31fb290b154ca42517dd9cdd2f9594ac66aec5842d82d02b810eb58af82cc56e98155892e97fc3162b0c054a594516f0bc4ae0
SSDEEP 384:xZcIv38Nk2QIrfIidnfLKXOVXbt8XUXl3MBabY7Ba8S5x2YkmuP3kGgB2A+v3igO:Zv345SO5S85MIYNa8S5oYklnA+32sa9
TLSH
T194F2BF35A9E49DB39CEA93C6B24773427FA44133D1C85AD8D9EC1B5D02976AF0303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 ef8497779a9bf5388ae24b674602b3b0cdcc666879e0aa53abc99120979f75cc
MD5 124837979dcceb9f6f2b8ead4959fa4c
SHA1 631cc252eadb2f0ec3ce6bd95a51465498f5b899
SHA512 0d5d0ed09ec3696966bc9e260c09b1fdc243d3a2270a74d092f2e624014bf43a37d668fb2b80113d75d958602b59d0bf8c82837d2a7d1467ebe4f22c6d84975a
SSDEEP 768:5q/UxvxjgC+y3r5SO5S8BMIYNa8S5oYklnA+32siV:FZj3+y3xVTWRdAo2siV
TLSH
T18213B036A9D8AD739CE692C5720B6393BFA45133D1C56EE889EC1F4D07C72AE4303856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c4cab251e8ff269a524549ff35c7ea84a7b7d6664dfd39a422db6357f781ecee
MD5 aa581f7fd06c9ce20e40dfc3c56eaf07
SHA1 31967ddaaaf8c30105489057b80f62243372ce62
SHA512 48cc7fe9df6bf17d27be693e46680b7c8df9aa45882cc4ec2bea267f1e0759e9072c934d914ef994a8db7b7fa9b1685bbd40495bd79e9c5c28240c159f2df476
SSDEEP 384:58ZcIv38NkXQIrfIidnfLKXOVXbt8XUXl3MBabY7Ba8S5x2YkmuP3kGgB2A+v3iR:5qv3n5SO5S85MIYNa8S5oYklnA+32sa9
TLSH
T110F2BF35A9E49DB39CEA93C5B24773427FE44223D1C86AD8D9EC1B5D02976AF0303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 38bfa5082fc66f4882cc388a599b465b9892b25e87edd879526017b0b0166cf8
MD5 1af75690c0383304383a463a03175f10
SHA1 c3187189ae4478d733fa1a1dd009759d8b989594
SHA512 b44e00d6889c7baa8cabe00e6434c1acc42a77edc6b39ee9b6b86fb76afda244e88ff2f50e4f570ca55d4b0f3640845bff8bd769d9ca18d4a087641cd1acb43d
SSDEEP 768:aFQE3/wgY5SO5S88MIYNa8S5oYklnA+32sa9:BE34wTWRdAo2sa9
TLSH
T12903AE3399D4C9B7ACEA97C5B24A7342AFF44133D584AAD8D6DC1E1D02972EE0307C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7c671682ee299e37db704435e3b8f41ae3a912a58b3265cb5c1af9d9a3674197
MD5 7eb9d3abc1983d1a9c90dfe897b3e1dc
SHA1 a70bae609125fc597b2e58ea5d54e0e8ba1b325d
SHA512 39266a23e4af39112e00d7db0faa151af6cb0c4e1a0a1d5811bf8a7644845ff09a85f636bbc246e056146454439056e12eddfd47202d796bf35df7071524613a
SSDEEP 768:do/UxvxjgC+23Sf2SO5SaJMIYNa8S5oYklnAapSH8L4:nZj3+23ECvHTWRdAOS04
TLSH
T15C03C03A9D94A9738CF663C4720AA357AEE55123D1C46AF88AEC1F0D06C77AD5303452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download