c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-pdmybg.htm
Size 34KB
Sample260930-ndvbhszzhx
SHA256 c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d
MD5 966cbc85dbef6cabdbdc9c7e5496cc81
SHA1 a975b1e21c10dd0dc8fa0dc9ecc3984ca1aaf500
SHA512 4385a6988471168604246748dec63ed3bcfeecaffa1948583072d992edad73d6943a08af0c354e6fcfc007425da662357166b6909fa654e104b78c0e97c38a71
SSDEEP 768:3srOAOH3uia5QeAE4rYyH1UeH+NypaNJiA9Ky:39AOH+l51kYyHeNVJAy
TLSH
T15AF2E65356D19D37066392F5FCB8BD2C95CA8D0FC248AC04743CAA0C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5072	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{98E58E94-EE3B-480E-A47C-0984DFE4A938}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 3348	4484	msedge.exe	89
PID 4484 wrote to memory of 5072	4484	msedge.exe	90
PID 4484 wrote to memory of 4860	4484	msedge.exe	91
PID 4484 wrote to memory of 3236	4484	msedge.exe	92
PID 4484 wrote to memory of 4860	4484	msedge.exe	91
PID 4484 wrote to memory of 4860	4484	msedge.exe	91
PID 4484 wrote to memory of 3236	4484	msedge.exe	92
PID 4484 wrote to memory of 4800	4484	msedge.exe	93
PID 4484 wrote to memory of 4800	4484	msedge.exe	93
PID 4484 wrote to memory of 4800	4484	msedge.exe	93
PID 4484 wrote to memory of 3408	4484	msedge.exe	94
PID 4484 wrote to memory of 3408	4484	msedge.exe	94
PID 4484 wrote to memory of 3408	4484	msedge.exe	94
PID 4484 wrote to memory of 1392	4484	msedge.exe	95
PID 4484 wrote to memory of 1392	4484	msedge.exe	95
PID 4484 wrote to memory of 1392	4484	msedge.exe	95
PID 4484 wrote to memory of 5312	4484	msedge.exe	96
PID 4484 wrote to memory of 5312	4484	msedge.exe	96
PID 4484 wrote to memory of 5312	4484	msedge.exe	96
PID 4484 wrote to memory of 2256	4484	msedge.exe	99
PID 4484 wrote to memory of 3372	4484	msedge.exe	100
PID 4484 wrote to memory of 2256	4484	msedge.exe	99
PID 4484 wrote to memory of 3372	4484	msedge.exe	100
PID 4484 wrote to memory of 3832	4484	msedge.exe	102
PID 4484 wrote to memory of 2388	4484	msedge.exe	106
PID 4484 wrote to memory of 4684	4484	msedge.exe	107
PID 4484 wrote to memory of 4800	4484	msedge.exe	108
PID 4484 wrote to memory of 3024	4484	msedge.exe	109
PID 4484 wrote to memory of 3024	4484	msedge.exe	109
PID 4484 wrote to memory of 4996	4484	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-pdmybg.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff83f6dc188,0x7ff83f6dc194,0x7ff83f6dc1a0
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,1578948715846921631,14159901344779701045,524288 --field-trial-handle=2148,i,9257116252652464005,7574797834451858507,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,14970034188650378323,18150339977799358897,262144 --field-trial-handle=2148,i,9257116252652464005,7574797834451858507,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,17323952440554222236,9694797120821299429,524288 --field-trial-handle=2148,i,9257116252652464005,7574797834451858507,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:13
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,6801721663287306306,1975075945731224286,2097152 --field-trial-handle=2148,i,9257116252652464005,7574797834451858507,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,6617429569433182322,1706025485324977158,2097152 --field-trial-handle=2148,i,9257116252652464005,7574797834451858507,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4368,i,9061860797688972112,15446804087646029053,2097152 --field-trial-handle=2148,i,9257116252652464005,7574797834451858507,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,892943668057720689,5722966820804644688,2097152 --field-trial-handle=2148,i,9257116252652464005,7574797834451858507,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:9
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,10410548850282732566,8946048519807160092,524288 --field-trial-handle=2148,i,9257116252652464005,7574797834451858507,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,2872757149890316726,5386821876303021389,524288 --field-trial-handle=2148,i,9257116252652464005,7574797834451858507,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,9562581873169071425,5532756757687358877,524288 --field-trial-handle=2148,i,9257116252652464005,7574797834451858507,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,9562581873169071425,5532756757687358877,524288 --field-trial-handle=2148,i,9257116252652464005,7574797834451858507,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,17836694851018031702,5100965888879875418,524288 --field-trial-handle=2148,i,9257116252652464005,7574797834451858507,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,13097874159215853870,17149983472157543072,524288 --field-trial-handle=2148,i,9257116252652464005,7574797834451858507,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:14
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,10879411257228104615,18216654756679095582,524288 --field-trial-handle=2148,i,9257116252652464005,7574797834451858507,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,70384725731193170,13613898421997019693,524288 --field-trial-handle=2148,i,9257116252652464005,7574797834451858507,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:14
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5864,i,13426528488392519971,13057161311837352091,262144 --field-trial-handle=2148,i,9257116252652464005,7574797834451858507,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 abaa2e4d18e4ab20b490ee9730b7a1ccdb67d917be5e7defa2c0552bc34bebe2
MD5 bb8e631cb13afe6444c052bd975dd580
SHA1 4aadae7daaed4cd8416808109682a1d1c637d9d2
SHA512 9a1bf3d97c3ed4fc6a40a310d49456616f4e36f57d86b2f06f40cdad2c6ba42c713ea1a99c5019f73cd950e4a1b86bdae4ccedac480948ec3df62f85263e33af
TLSH
T1A45150B181AE5829CF9885B6B598164F353B99B2078F1DF13EDBF8B5CB06770418744C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5965b5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5965b5.TMP
Size 3KB
SHA256 c92ea4eeb9585b5d05febf2a79cf5f57e5f982ffc4d6d465ce74d1df9b3d340a
MD5 e4711db3c0ae41a383878cd152231364
SHA1 c018a7cb40bc97d0f6e913372eac133a903363fb
SHA512 d2728bed67aef237345bbb547791e32d20f0b94e42f4b187a247b873d484e54f0c87ff178ddc75b6cad88cb7905af7eccf8f4590d7d90c4f464a085c32c978e5
TLSH
T1D05172B0819E5829CF9884B6B998164F343B99B2078F0DF13EDBF4B5CB06770408744C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 efd38b1c3fa33bd19a87d86038dcedf54780d651822549012b07aabc6d7cfa3e
MD5 c239b6165c874d5af7836d0657fd6afa
SHA1 f3a934be9843b740b6a07f77006a157650d98538
SHA512 7ea4022df8a45c9c18c1fb7b0525cef5b2e33f5a1d980d0d09e9eeaf2a448b4505034a0e7356344a85d16419521872637c6d242fef52d9d0e425ca8a37e6eb3e
TLSH
T1D6418DF7C3E8967E890156F0AB186E2BCE2D0915831C3D5AC9E4AF1B93E24B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f03e108f0f93c0af0af1faadd971e553a3aca79fbceb920ea5698f88785edf85
MD5 704444295c62095c3896b6c1a3953948
SHA1 f5295dbc81e30861fbd15077066f791d27cee86f
SHA512 52967b38df2fa29efc614db8b59cfad583af328df1355fc6f1f245ea103372368c2a1b81e66069fbbd7989d6cda8d0fe980329e555ab0a24bd4981c0e778052d
SSDEEP 192:sxR4R7bv/fqs3QQ7R7AIzoA8p4O/g6+WNIYlacBRGTIgD7J:sxR4xv/fqsgy7ART/5Idp
TLSH
T11A32C8556D28A97B8CC7E21DBB657F53D6F9503360911E48B6FC9A1C04E76DD120380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 90c1f70d9e037510cd5e3061263526784734424e00c6cd4c631aef4829f11426
MD5 62ce0c41805f4a0f6763f3d04ca21403
SHA1 44dc2c4633041305d9750561b6d8b6c3905afe69
SHA512 196541a42ba556b5c6b2a73167915d39e96c42d48f890b188ec2aed8af1ae2835face9a492c13e61c610053836f7011ae79c230711d62a535d03bbcf5aaa0080
SSDEEP 192:sxRTR7bv/fqs8HQ7R7AIzoA8p4O/g6+WNIYlac+RGTIgIJ:sxRTxv/fqsiy7ART/5Iqs
TLSH
T1F932B7556E28A93B8CCBE21DBB65BF53D6F91033A0951E48B6FC9A1C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 df3b19eb2c185d16f8ec039566d1af9283527fca4997d410ef432553515c5c42
MD5 d107ad9165bc3b15badda452220d56e7
SHA1 cc2dcbc934b9ec9d5621fd1c26d07dd0c2ea7e46
SHA512 562117d74a9d5987c7a7029d41bfabe7171f4e290b7c4dfa3fcd9bcbe9bb3f83ad59200493639f89febdd3bafa9e4439537c294f6d3f992bb27d017b34de665a
SSDEEP 192:sxR4R7bv/fqs3HQ7R7AIzoA8p4O/g6+WNIYlac+RGTIgD1J:sxR4xv/fqsXy7ART/5Iq7
TLSH
T16732B7556E68A97B8CCBD21EBB657F53D6F91033A0911E48A6FC9A1C04E76DD120380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 7d981fee27d2534a18d2eeaeadf66cd789181a8bcffc7bb129daa7add7c9d652
MD5 c902c98790605d2ff0d5b4bacb09a0eb
SHA1 53ea66009444676b46eef365534a4a6ddef41ba4
SHA512 d6bb034951d1a9ea011105cc6efc6e0d6926a53f123dbd52c4c77723a9e7688fee93f326b01b45c386510eefc630a9c078cbdb20ed5c98f012cea7e136f838e7
SSDEEP 384:kWdRdcVfCtgSQFffTKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV4A9+mRfXroe2x:ksRdcJWgSwffT8F1+UoAYDCx9Tuqh0Vt
TLSH
T105B2E93B644CCB7E4FC14AED9C196F976E9C02C796588D8047FE984C02C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

1d9e78fa-fc83-4d37-8e27-bb83504e2aa2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1d9e78fa-fc83-4d37-8e27-bb83504e2aa2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 640b0434a2127798a1ba1e5115e0314c5bca08ba880c49f7972c28d182c0247d
MD5 fd7a3d3fd0321d782763fef05c57f587
SHA1 6ef36fa4b3119df7adc1b8a6b7938ca995be77d6
SHA512 06e682fa81d9da3c478df327c549aeb5b6f273297008363766cef694bfc2ae389b81c6dcf96a41755e3559708a32e5d58a4393eaed9b76a1f0129850b1f7d73e
SSDEEP 768:k93cbsnitSFaj9KxnqMwQi5BgK5/CwYcZcb2sWN:k93cInIBKxVmBg8/d2b2sWN
TLSH
T19EF2BF32DCF48DF75CFA9241B6863346AFF49257E598064488ED6F0E06979AE130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 6dbc700268205e067fda728b6555edee9d948a781f40e55160683afcfbbb4ad9
MD5 559060664c680eaff589e574bd3c5074
SHA1 bafb36f9c4cedc39cb1da1b8c00955d3aaac0462
SHA512 330966433aaef3b5d5b21a59620c1814c78d74880a04402a293b713290929024fae85c130c439bb40364d47ad02fbbe00ac4bcd9c5d34bc165385acec3b3a93f
SSDEEP 768:qFQD3awgLbsnitSFaj9KNynqMwQi5BgK5/CwYcZcb2sWN:RD3uInIBKNyVmBg8/d2b2sWN
TLSH
T173F2AE33DCE48ABB6DFA9741F68A3342AFF04297D895565485DD6E0D02978EE030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d9e417c01e6c570ae40d2371e55a89ae0ba4478d6016e8cceef4b7750b8ab78b
MD5 f9dd8f43ba4395f80bcc7f66e9b189f8
SHA1 8619c29b5fec9f41d406c035eb163a6028a0c707
SHA512 e002221cd6049a70eb5401b3ff63892a53e9896aa8401f554a9c0465a1ff9db73c51bc4f386687992130015910b59d8c9641ae1f21ab822301dcdcba18818f32
SSDEEP 768:t937bsnitSFaj9KxnqMwQi5BgK5/CwYcZcb2sWN:t937InIBKxVmBg8/d2b2sWN
TLSH
T115F2BF32DCF48DF75CFA9241B6863346AFF49257D598064488ED6E0E0697DAE130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 cd48d696f9ba029894fae800a78f853b663e09b7ef0ddb025573f4890b356926
MD5 f0214a4f3b3b91c6045794d623f7ac99
SHA1 9fc3ca0610d0f8b6eb0641842712934d67636e0f
SHA512 f578c41d4b6f4a7126cd2c44216b45c9372b6337b7d7163744011540694c3ffadc185e25e10546276ed66f174af1a6b1a654e279a27a80c98ec98b3a5912b701
SSDEEP 768:B/UxvxjgC+U37bsPitSFaj9KxnqMwQi5BgK5/CwYcZcb2sCn:UZj3+U37IPIBKxVmBg8/d2b2sCn
TLSH
T1BE03CF36ECF45DB75DFAA200B28A2387EFF45653D485196849EE1E0E06C79AD130BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 ce06749d28beb65bd32602ed7600fe78172655e33d588a5d42747d594f54d557
MD5 2c78fca26e83a746ad457c718ddc2899
SHA1 8889f35a410083b372840919881858632c3c5e00
SHA512 abcc71afdfee7d0e77a4ef17f3266fdb9f30ce60f962698c6722c3652fab9d57b7b4ef0caa1b307919a1d51a22b4224b851dd38456ce9a1808fdd0f73a84f0e7
SSDEEP 768:O/UxvxjgC+Ft3a9ezSFaj9KnqMwQi5BgK5/CwYclwA8Dea:DZj3+Ft3a92BKVmBg8/diA8Sa
TLSH
T13703CF36ECF499BB8CF69244774A239BEFF45193D484099889ED1E0E07C7AAC530BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f402c9f-5bfc-4507-85ba-f9c6b0a6efee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9f402c9f-5bfc-4507-85ba-f9c6b0a6efee.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/3832-165-0x000001412B0E0000-0x000001412B321000-memory.dmp

Download