5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-d04qae.htm
Size 194B
Sample260930-ml1ylazeph
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4520	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{91E2C9A0-16C3-4829-BC55-A3F9577ECAA2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4272	4204	msedge.exe	88
PID 4204 wrote to memory of 3576	4204	msedge.exe	91
PID 4204 wrote to memory of 4520	4204	msedge.exe	92
PID 4204 wrote to memory of 3576	4204	msedge.exe	91
PID 4204 wrote to memory of 3576	4204	msedge.exe	91
PID 4204 wrote to memory of 5200	4204	msedge.exe	93
PID 4204 wrote to memory of 5200	4204	msedge.exe	93
PID 4204 wrote to memory of 4984	4204	msedge.exe	94
PID 4204 wrote to memory of 4984	4204	msedge.exe	94
PID 4204 wrote to memory of 4984	4204	msedge.exe	94
PID 4204 wrote to memory of 4304	4204	msedge.exe	95
PID 4204 wrote to memory of 4304	4204	msedge.exe	95
PID 4204 wrote to memory of 4304	4204	msedge.exe	95
PID 4204 wrote to memory of 5388	4204	msedge.exe	96
PID 4204 wrote to memory of 916	4204	msedge.exe	97
PID 4204 wrote to memory of 5388	4204	msedge.exe	96
PID 4204 wrote to memory of 5388	4204	msedge.exe	96
PID 4204 wrote to memory of 916	4204	msedge.exe	97
PID 4204 wrote to memory of 916	4204	msedge.exe	97
PID 4204 wrote to memory of 5160	4204	msedge.exe	100
PID 4204 wrote to memory of 2868	4204	msedge.exe	99
PID 4204 wrote to memory of 5160	4204	msedge.exe	100
PID 4204 wrote to memory of 2868	4204	msedge.exe	99
PID 4204 wrote to memory of 5364	4204	msedge.exe	102
PID 4204 wrote to memory of 1480	4204	msedge.exe	106
PID 4204 wrote to memory of 3000	4204	msedge.exe	107
PID 4204 wrote to memory of 4636	4204	msedge.exe	108
PID 4204 wrote to memory of 3636	4204	msedge.exe	109
PID 4204 wrote to memory of 3636	4204	msedge.exe	109
PID 4204 wrote to memory of 2988	4204	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-d04qae.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffe2d84c188,0x7ffe2d84c194,0x7ffe2d84c1a0
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,7605234648742264600,259861346137663754,262144 --field-trial-handle=2256,i,2938814210047800846,8906224107213109340,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,6159133082794373158,1567364349562343757,524288 --field-trial-handle=2256,i,2938814210047800846,8906224107213109340,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,16585471183036188108,274836593721512420,524288 --field-trial-handle=2256,i,2938814210047800846,8906224107213109340,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:13
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,6166133784673454642,12853334456108478504,2097152 --field-trial-handle=2256,i,2938814210047800846,8906224107213109340,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,15315842459091510753,5575156609815963740,2097152 --field-trial-handle=2256,i,2938814210047800846,8906224107213109340,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,7734665481499019748,9101181526071132604,2097152 --field-trial-handle=2256,i,2938814210047800846,8906224107213109340,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,5195760573213457058,12004184286007726916,2097152 --field-trial-handle=2256,i,2938814210047800846,8906224107213109340,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,1254186840899740684,683849175216589495,524288 --field-trial-handle=2256,i,2938814210047800846,8906224107213109340,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,13070564275659852262,10525414008594154224,524288 --field-trial-handle=2256,i,2938814210047800846,8906224107213109340,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,7909548932186505024,11753639178687567169,524288 --field-trial-handle=2256,i,2938814210047800846,8906224107213109340,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,7909548932186505024,11753639178687567169,524288 --field-trial-handle=2256,i,2938814210047800846,8906224107213109340,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,12421675924149901280,9242343564926238163,524288 --field-trial-handle=2256,i,2938814210047800846,8906224107213109340,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,6535806160342386925,10440385138937045000,524288 --field-trial-handle=2256,i,2938814210047800846,8906224107213109340,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,13342385172431355327,16028795156578343687,524288 --field-trial-handle=2256,i,2938814210047800846,8906224107213109340,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,7207348185875261355,15930609051262442660,524288 --field-trial-handle=2256,i,2938814210047800846,8906224107213109340,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5316,i,2104647816051925447,11039681932988696617,262144 --field-trial-handle=2256,i,2938814210047800846,8906224107213109340,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 93759e998b226848eae053bd242d217f1ba31b690c81f79de30f86ed378d4dfa
MD5 7352a1e8c80ae3a4ddc0e5696c33f199
SHA1 c39929ea08c81cf047cc47a3aed658f8cb4f4366
SHA512 69c0f6a05e0a057a44283b07b8552d67cf1adbea8dc7daec7febe792912ed07d233a4210d4452e100adb89155ca752508ffc238d45f27d34727ddeb44fbad579
TLSH
T1E8513D881A634E8AE7BCBF33CEF1228B3B30A6B965C35E492474C4BC6BD275511E4345
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 76101ae63ca49265b55c5cec389d32210aa02a6745d1f4ac1096ecff03e4a186
MD5 db5f8aa8230e9e90e8036b51f31e5022
SHA1 953b9f5673d15b640f96c604b195310308dc5bf8
SHA512 0f61d29c1a6ab65a18ebce9a658fb57ac943e0801450c619719296c44f760958af164133cbf48c423f4b943ec62bc147a8891ca93c8dbaad92d8a81c9776f3cf
TLSH
T1E1417CF7C3E8867E8D0156F0AA18AE1BCE2D0915432C7D5AC9E4AF1B93E34B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 759a3949c408d216ce2fd2eb69380d8c37cfc611c0a8bc0c3f27f8a1128a618f
MD5 bc7c930e482611e5e4244afebd2be824
SHA1 f7a390d33c95c1e0429c8f672ddcab96d177a94b
SHA512 98e7b4ba2f1665b98f969121c17f3c41588098132740a3945c3ff4f3d390110a20c54e34b4625621d01380401f8b0448de9e0302e58b28ab5480294366e1306e
SSDEEP 192:sxRHRobU/fwsPQ7R7s/zoA8p4b/g6+WNIYlachvG94fIgD0J:sxRHwU/fwsPy7sWO/5In4f0
TLSH
T13132B6156E78A97B8CCBE21DBA65BF53D6F9503360941E4CB6FC8A1C04EB6CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6da3643930ed4c06924483044315b6d1a382f4992d5196627aad5d4be9ca08f1
MD5 f1bb16d8e8682d52381ad245f19b035f
SHA1 c38a37d18e0cb4d961579091756dbfcd3478317f
SHA512 b733d132aa52ad95f666267423f1e572ced38e51b390cac5432e38195639fa48cf2fc59de31e933e263e2b738726431bf4bc27e416f407afd483661776093a97
SSDEEP 192:sxRsRobU/fwsQQ7R7s/zoA8p4b/g6+WNIYlac+vG94fIgIJ:sxRswU/fwsQy7sWO/5Iy4fs
TLSH
T1EE32B6156E68A97B8CCBD21DBA65BF53D6F91033A0D41E4CB6FC8A1C04EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 233f78b831683f4d3901ea73861ed5b436d199f96228f274e951e996fdcbea99
MD5 898863b4615bbf109ced954f2c852b2c
SHA1 4a1579b6b414749c069373188d84384665432b7d
SHA512 19b99a67c638043c8a0c04560b3f4fc786a58a3ad9f391456820471b0a49cf7c5ce1dccc8bd13c5a228cb8f5c3ca350772c1b61c2648edac9bfba0939da6e16b
SSDEEP 192:sxRHRobU/fws8Q7R7s/zoA8p4b/g6+WNIYlac+vG94fIgDuJ:sxRHwU/fws8y7sWO/5Iy4fm
TLSH
T1C232B6156E78A97B8CCBD21DBA65BF53D6F91033A0D41E4CB6FC8A1C04EA6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 1655d83e30d5c054a41686b6ced669b43958ac1b375afafc0440d42b14a48de1
MD5 e0be074fd35bc8aac7cb686d468663b9
SHA1 21f127be1f89b40bc46a0e66ae59a5ced42379c7
SHA512 81633976aaf71286f54dbf79bd455db6f6b1545e404adb3dd40e7cca2bc478fbf6dc1e6d510bbae84538b33f1e06bce526e42af13cad764bcd69ed40b0cdfe65
SSDEEP 384:kWdRdcVfCtgSQFffTKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV4A9+mRf5roe2L:ksRdcJWgSwffT8F1+UoAYDCx9Tuqh0Vt
TLSH
T17BB2E92B644CCB7E8F814AEDDC196F976E9C02C796588D8047FE984C02C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c78de6169358a9313e015e319576b909f31cb2704d32d28fdc6fb70eec7a788b
MD5 9d60ee3b5d3eaf8b47f1ce71ec57f6b3
SHA1 83a9cfe7c4c480210e0cdfa1a509b26bdd085cdf
SHA512 deec0f8472468b42d456b906d242a443124844c22326a8d9a21ec28bfb57fd704a92ec45ce61ac0a2c147341af7c933b4c606d6d18c85c8502341a8c271ad0bb
SSDEEP 48:K0Nsh9P7/gbTmzIS1gK911XgxlwY23ttyLfir/BhBab5UpISPaK9v1lax/KYstqg:K8qEKLqKCIgKpeeBGKa8S6z
TLSH
T18F912704307A0640397E2D4981B4CB2E165272A33659FA6FBFB804B55A2FE488DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

4ed12bf3-c43c-4c47-8757-72134875e5e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4ed12bf3-c43c-4c47-8757-72134875e5e0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1a3768a4e7f845c674adeb0bed061259a0155d7f16ed16a6a2119a40e5084d30
MD5 a8aa3b788019280a2f36f09d99cdb661
SHA1 f209e2b21ef3d722d472297af6b0f0e1a52d734a
SHA512 a04f4c0d083d707e969c061c3e82b24c5e60bbcb24097cbc2a7367d66bfd477c0c244365cc643963c6c0429bf4d986a1a79fb26ac7362c0e374d6859f6ccfb4e
SSDEEP 768:y03Y5oiuSFajtbSnqMwQi5BgK5/CwYcZf2sak:y03OoVQVmBg8/dt2sak
TLSH
T13CF2AE32ACF48EF75CFA9244B2877246AFF45157D9D8099884DD5E0E019B8EE134BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 30776cc13fd228d1cdca3763c32c32e9d223083b3a3387eaf37f27ac0b231afc
MD5 47d4e69ce27200fed1c52edaa6196c1d
SHA1 0205090e72c0f4a6bf89d8577df73d618ee60e04
SHA512 c9a1135f54e27f385971de3cdb36bc0496d1f30f02dc3d58bb43ab4f2fff176503fef742916ccd30dcfb384738da8b32dffb5afa7af98fa6eaf5e9125c70f1dd
SSDEEP 768:i/UxvxjgC+t3r5ueuSFajtbSnqMwQi5BgK5/CwYcZf2sUm:nZj3+t3VuxQVmBg8/dt2sUm
TLSH
T1BF03CE36ACB49EB75CFA9240B28B6387EFF45553D4C509A844EE1E0D069B9ED434BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ae67ad1ade26a4cbd93e6fec075804412f605f9b2d1ce6076f548a29c369a5c8
MD5 e176c2cf1b4ae59999f73f20434a7b89
SHA1 2786264ff1a1c4e679301d51e2f6775a83b548b0
SHA512 40ce0db5235caa073b6149218810c3b8ba7ad8a0f9d398bf8c9637cd37f35588a6dc95f0b5cd4ca513c373d22bd171f22455a28d5bcc3153b56f4dd6c7f9c489
SSDEEP 768:i03p5oiuSFajtbSnqMwQi5BgK5/CwYcZf2sak:i03voVQVmBg8/dt2sak
TLSH
T1D8F2AE32ACF48EF75CFA9244B2877246AFF45157D9D8059884DE5E0E019B8EE134BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 a15c62e186f7b453990e250fb0a1f889f2d0e260e852ec8bd3cc3e562c3417cc
MD5 c83b71a68ecf18e36a592a150ca66dcb
SHA1 e6fc9e2734123a40fb96280955c506f1f22a566a
SHA512 fc230e4c44e5dee198e3d88f4d74cb53839c65471aaf2bbd40e44c727f3a9d9ccba83d9e6c5122f817e20f5f9e8c7b4345e38dba86d61d98020aa77950f0ff8b
SSDEEP 768:O/UxvxjgC+Ft3zazDSFajtUnqMwQi5BgK5/CwYclqA8Dea:DZj3+Ft3zaVGVmBg8/d8A8Sa
TLSH
T16903C036ECB49EB78CFA9644764A638BEFF45153C484089889ED2E0E06D79EC530BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 d1000ec561cb4a1c7d2e016510d86c01ac8da381fa262ad844c07ada2f7cea70
MD5 9b5c008bbf4de6f12578262c35b66a1c
SHA1 be42da3eebcb7ef1737663c5a35d21784770a737
SHA512 3bf3b9c6b69cb80950295432b2037976de6af2367e8e32e6988df7bb90008e10e9d4cb5f12bd84246dac91546a5a09100fda4b59d53342c03c3a3d976889e6be
SSDEEP 768:cFQ23ywgh5oiuSFajtbJcnqMwQi5BgK5/CwYcZf2sak:P23YoVXcVmBg8/dt2sak
TLSH
T147F2AD33ACF4CEFBACBA9684F68A3242AFF44197C898559885DD5D0D019B8ED134BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8159460a-48c7-4367-85c2-c16c5906d786.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8159460a-48c7-4367-85c2-c16c5906d786.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download