59ad0b206034047633d7343292097815cdf5acc8f3b0c38d150da0f653e6e5d4

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
de/index.html
Size 2KB
Sample260930-p5mlesff89
SHA256 59ad0b206034047633d7343292097815cdf5acc8f3b0c38d150da0f653e6e5d4
MD5 dad5950f1d033dd1594b375cbd6c20f6
SHA1 e933e375980837328627b0a0fc0e5fabe3f160ad
SHA512 08d00dcdd5c077031d4b207d49868fce6f454b41fe3a3a2b9b12713172915fd425e52a95ad99aec07450295338914e808bce6d48f4e2e145131a6be7e289ed11
TLSH
T1F441651A344CFB24838B47DB90762B29B567D682E3736408FCF782B3DBC9045946B59B
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2108	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{623C2EE5-E50C-4B2D-97A1-0520F46F37AC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4516	msedge.exe
4516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4824	5088	msedge.exe	89
PID 5088 wrote to memory of 3336	5088	msedge.exe	90
PID 5088 wrote to memory of 2108	5088	msedge.exe	91
PID 5088 wrote to memory of 3336	5088	msedge.exe	90
PID 5088 wrote to memory of 3336	5088	msedge.exe	90
PID 5088 wrote to memory of 5952	5088	msedge.exe	92
PID 5088 wrote to memory of 5952	5088	msedge.exe	92
PID 5088 wrote to memory of 2548	5088	msedge.exe	94
PID 5088 wrote to memory of 2548	5088	msedge.exe	94
PID 5088 wrote to memory of 2548	5088	msedge.exe	94
PID 5088 wrote to memory of 5136	5088	msedge.exe	95
PID 5088 wrote to memory of 5136	5088	msedge.exe	95
PID 5088 wrote to memory of 5136	5088	msedge.exe	95
PID 5088 wrote to memory of 5480	5088	msedge.exe	96
PID 5088 wrote to memory of 5480	5088	msedge.exe	96
PID 5088 wrote to memory of 5480	5088	msedge.exe	96
PID 5088 wrote to memory of 4748	5088	msedge.exe	97
PID 5088 wrote to memory of 4748	5088	msedge.exe	97
PID 5088 wrote to memory of 4748	5088	msedge.exe	97
PID 5088 wrote to memory of 1228	5088	msedge.exe	99
PID 5088 wrote to memory of 5008	5088	msedge.exe	100
PID 5088 wrote to memory of 1228	5088	msedge.exe	99
PID 5088 wrote to memory of 5008	5088	msedge.exe	100
PID 5088 wrote to memory of 4516	5088	msedge.exe	102
PID 5088 wrote to memory of 5320	5088	msedge.exe	106
PID 5088 wrote to memory of 5600	5088	msedge.exe	107
PID 5088 wrote to memory of 5596	5088	msedge.exe	108
PID 5088 wrote to memory of 2428	5088	msedge.exe	109
PID 5088 wrote to memory of 2428	5088	msedge.exe	109
PID 5088 wrote to memory of 4516	5088	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\de\index.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7fffbe16c188,0x7fffbe16c194,0x7fffbe16c1a0
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,367554853193043463,12630204274021939080,262144 --field-trial-handle=2216,i,4467408672065510543,11352350891791113374,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,8855190908349256944,11780010994657471040,524288 --field-trial-handle=2216,i,4467408672065510543,11352350891791113374,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,9766511259729823712,18401859142533353185,524288 --field-trial-handle=2216,i,4467408672065510543,11352350891791113374,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,2471830123252316275,9486151726936022282,2097152 --field-trial-handle=2216,i,4467408672065510543,11352350891791113374,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,15613023280198303666,14569989249190911994,2097152 --field-trial-handle=2216,i,4467408672065510543,11352350891791113374,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,2471120565717803706,6596020483055033818,2097152 --field-trial-handle=2216,i,4467408672065510543,11352350891791113374,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,5798303192896691850,17082123318280511557,2097152 --field-trial-handle=2216,i,4467408672065510543,11352350891791113374,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:9
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,16617569499279238593,3460060591873598320,524288 --field-trial-handle=2216,i,4467408672065510543,11352350891791113374,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,8642002401707713822,1402126528943702968,524288 --field-trial-handle=2216,i,4467408672065510543,11352350891791113374,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,12715817100583391906,4044823708960278270,524288 --field-trial-handle=2216,i,4467408672065510543,11352350891791113374,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,12715817100583391906,4044823708960278270,524288 --field-trial-handle=2216,i,4467408672065510543,11352350891791113374,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,15204219512157118425,2922885961406971969,524288 --field-trial-handle=2216,i,4467408672065510543,11352350891791113374,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,11883131416234980664,15898382109012344423,524288 --field-trial-handle=2216,i,4467408672065510543,11352350891791113374,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,510272835915379307,16991434822566649167,524288 --field-trial-handle=2216,i,4467408672065510543,11352350891791113374,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,15772661122176954805,8375834320043361998,524288 --field-trial-handle=2216,i,4467408672065510543,11352350891791113374,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5544,i,16364954724157842680,13150105002901786064,262144 --field-trial-handle=2216,i,4467408672065510543,11352350891791113374,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1af708a87a0e07ef0694325060c9cb87aabc308819320628ad9555c62fbfc8fe
MD5 ecdb9554d05eefadbef925863cab0092
SHA1 8fc2db8f2260025abc58a28183a1ef17949a7155
SHA512 0be680015ff301fd4e7e9202ee34adef7cc48c1d6a2db33a5543de2b4107b6abfc012798cabf7de9465a8d6c6c1539fe95baa236a1f8ddb2173d86e462b1d057
TLSH
T13851E80997D205DBDBA570B19EC00C9BFD3426F08083DF5205A5D879AB0B3A8C1CD3B4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59329f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59329f.TMP
Size 2KB
SHA256 23318c0eb9a2ce4c642a004c15131f3cbbf7a9aeffa72bd87a041685dee50622
MD5 76202c8595540c4d5a84726e24c94298
SHA1 bbc008df837d5b465c9372b176a45908750d39af
SHA512 53fe088488736543a16ec988e3c2eb85c83995804f3be2e2987a622948d15348c40247fecdae59d0492957cef182016dcd077ca61ec50e3e2ab1a2aea11eb4ae
TLSH
T18A51B64997D245DBDBA570B1ADC10C9BFD3426F08483DF5205A5D969AB0B3A8C1CD3B4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 baa4da468ab74fa8b7b594c05997bd3172fb5a905559a982eca8cb4ceb1b7c78
MD5 6670859ff8937b51f870b2993f0d29ab
SHA1 a45f4da7a0baa2215d4824543c4cd82c1853ab70
SHA512 c084b8839e4c7582885ee3646bd86cfb7ddf858a0a587105ad70cd5433506efb5ee29b3c15249e114d2e536e173e9d50a2064f717fad00c2cfd8e0f89a4e2818
TLSH
T16A419EF3C3E8867D890156F4AA186E1BCE1D0915532C3C5AC9D4EE2B93E24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a15d1e68c32fa15976588d58f7e557b9df1f64b9fd887e1741872a277596cd5f
MD5 07677fdda8546875a5cab944aefed0f7
SHA1 b6236abec2e218e1d2714f8c60403d72c70bed5f
SHA512 4b5cc7007790e154d95c4e5705ecbfde4be1638b647f43ae87c7c9823fdc278fcaad357b2dd9e0bf802ea706725d0495a7471ac707634bbda9fd4dfc7b1cf970
SSDEEP 192:sxRwRgbz/fsvsKyYhlzoA8p4l/g6+WNIY28cF+G7IgIJ:sxRwIz/fsvsKbIA/5IPF1s
TLSH
T16C32B8556D68A93B4CC7E21DFB697F53D2FD5033A5901E48A6FC861C04E76DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 49472875ead42471abbf1dfd2c9a7dc9fc67c1d40cb60c64e7cc5b33a567b5db
MD5 4ad4b8be31b7506ef2b3aaacf80f6d41
SHA1 647d5a54a9379867842671b1a9808c32664a0b5f
SHA512 1358eed215fbc48645362c0f7c38b757611e71f54d99b07eba737910ce692c19744d8757d76f66278bdaed26df1963a0caef1796f9453241d9081320a6fe45dd
SSDEEP 192:sxRHRgbz/fsvs7yYhlzoA8p4l/g6+WNIY2GcF+G7IgDTJ:sxRHIz/fsvs7bIA/5I1F1Z
TLSH
T1BD32B955AD68A97B4CC7E21DFB657F53D2FD503360911E48A6FC8A1C04E76DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 2f73b12dd61adba8e11858a305336a468f591770e84144865635945a0525eb99
MD5 e884c535d6af02fbc3e904ba84e0ccab
SHA1 4bb6e5721d8c19f355cca9e8364ccabb6b2df7b3
SHA512 70c2a15c6e928aa85cc474ce2a81fcd060d4e616bdb45590221a815915ede589cd7f538c65aa3602e4f4ff62037e3ba6fa4b4ee24983be6154226176adc98c78
SSDEEP 384:LbnaaCTfCtgp/FfvDKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVPH9NvRWProHrf:L7aaCDWgptfvD8F1+UoAYDCx9Tuqh0Vs
TLSH
T119B2EA2F644CCB7E8FD00A9DAC596F977EA802C796588D4047FE984C02C77EA911E4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ebc91263-e17b-4d5b-a83d-412e7a6c81c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ebc91263-e17b-4d5b-a83d-412e7a6c81c2.tmp
Size 11KB
SHA256 420c5e9d767a2ac6053cd7b82bd925e2cbcf8af99fd8e97d93dc96c37506b893
MD5 59c60ea5d1ce9bfea90398d4e5ff3335
SHA1 62c9245dec862797a6e226d1e8ae759dd0e56741
SHA512 ee28ff84279191ccb4dc47d0f678210e367810ea144774ed3c9205a817a15da8826be7b148b4ae432194955b1008cf712feaa6b8e9f4bdd8ee4bb643427a7505
SSDEEP 192:sxRHRgbz/fsvs/yYhlzoA8p4l/g6+WNIY28cF+G7IgD9J:sxRHIz/fsvs/bIA/5IPF1r
TLSH
T16A32B955AD68A97B4CCBD21DFB697F53D2FD5032A1901E48A6FC861C04E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59cc30.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59cc30.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7fc21c1d100565ade3f130174b32f0be2a431c295323a06e298ef0be5824f36f
MD5 e6c2858aaf5fdbebfab36b9f23c97481
SHA1 2ef2c70aba6194656b9ef4b88b12a663d9db2add
SHA512 88e8c04c805b7fe8511b200195071feeb46c127f046f32cde760f82698140ff1055ac62e9750ab87d4319eb969298ef5a14fe2a7e06c55d6b04e1992fec14c1d
SSDEEP 768:6G3l3Ygm1+mFc6XDmGA5b65Q92RQMPbYRsMD7:6G3IRAF65dQDRsI7
TLSH
T16EF2BF72DCA1DEB35CB9A1C13687B2017FB88627D1CD869058ED6B0D0597ADE430BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 923b4376e1a055cc80afe84829524e7acbeb5570b651d1cef7b0064a0063569b
MD5 3e5df61551584985990025907ebc8458
SHA1 6e1e20ed175fc71fda6a77b1406ab5a0fb812a02
SHA512 a3c2870ebd2eb2d5821bfbf217f0c7b8908724c69970d0d53907d59a62f327c58411203526458545388d5b5ede2639a2c4e7d3f38468074da8a2ab287651c0ff
SSDEEP 768:H/UxvxjgC+33JsYgm1+mFc6XDmGA5b65Q92RQMPbYRsM5A:6Zj3+33lRAF65dQDRsaA
TLSH
T16413C032ECA4AD735DB9A180364BB346BFB48523D0C996A409E96F0D06C76DD430BD5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 bc8ff5e0175b960f9486cca9281529a496b49c08430a854d479989fd84f6ca89
MD5 4260e4778dc89d3beb12e55f94e731f2
SHA1 54e5e36a6983120aeba8e2f32e02bf67bfa684ff
SHA512 b2764f2beb012a4571bc19bda0090fe61b89d098d3754c5d7a2b2617ffc1a427f427bd60b40c37a0f6e143e55e3bef6fc78569da151804b993c9a615419412e3
SSDEEP 768:bG3E3Ygm1+mFc6XDmGA5b65Q92RQMPbYRsMD7:bG3nRAF65dQDRsI7
TLSH
T128F2BF72DCA0DEB35CB991C13687B2017FB88623D1CD969058ED6B0D0597ADE430BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 a5b3b71ff0f0ad51e92ab761aaf49f669ea2696af21e3d59baa0b406a66c0100
MD5 557955e732f72b5aa5af82d87af33f7b
SHA1 c4ba875ed78391b892ef79338420acd8d294a9f5
SHA512 ccd1eb353d6c786b759bf550f0c104b8e1f350736843e272cb8d0dc1f5763389611020ab431b411027555474e4ec5deb9c85cb05b92f92a45ee0e06b4ff6a4bd
SSDEEP 768:JFQ13swgm3Ygm1+mFcWDmGA5b65Q92RQMPbYRsMD7:I13OAF65dQDRsI7
TLSH
T12403BF73DCE0CEB7ADB996C0764BB201AFF48163C5C9D29099D96A0D01975DE030BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e8f560801f5d775ad147c628b3f974e03abed35451d19cf6714e6fa4abda3b13
MD5 190824bf968628798f24706b29c9e76d
SHA1 9a5f15dbe00e42ce64f93c9ffc6ac58092ffd11e
SHA512 f9f3279d42eadf63b2de26bbe0779b2c20085fae5d4e564aa61d94106badeaf7410ac37c6377bd4acf55b8961747c4857fd84b0db8fa31a84bb2017a14a6e91b
SSDEEP 768:U/UxvxjgC+B3vVRRgm1+mF6tDmGA5b65Q92RQMPbZFj0O:BZj3+B39E3AF65dQOFQO
TLSH
T16503C036EC94AEB79CF952C0364BB35AAFF84173C0C456A049ED6E1E06C768D430B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f23b110b-3d93-4144-ba3b-94e67c3a929e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f23b110b-3d93-4144-ba3b-94e67c3a929e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download