af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-u1vgon.html
Size 214KB
Sample260930-p6j7pafg86
SHA256 af6f2b66f13d44d2ec1a96fd2846b3339c52234b98d44fc0fc8d72eaf817bf20
MD5 ca2c96be8ad4c1b27afc858a639eb1f4
SHA1 34bcbb32e3946883cf26447531ab98af52bcab62
SHA512 3437202655e3eb3621e7f896424eace53f0c5f24acf844be2b9d563d88009e6cf5a37bcddba9c2cbaba921fa3f1b6b8b256eb36e35e548489e0a5a04be7cb99c
SSDEEP 3072:opm0WkXwgEweVFmk0RHyEoCmetxWnm6t6b9U9QfyA7cxGTdTbLayQsH:oglIYWRHyrCunm6t6i947gGTx3pQ4
TLSH
T13024023459202B0E3B9246B4B26575A40EF90CB3E95F96227BC801F5EFED1F29049CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1608	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{840B6C60-5173-48E0-873F-1C8513CCEE58}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 4184	4624	msedge.exe	89
PID 4624 wrote to memory of 1608	4624	msedge.exe	90
PID 4624 wrote to memory of 3432	4624	msedge.exe	92
PID 4624 wrote to memory of 3432	4624	msedge.exe	92
PID 4624 wrote to memory of 1404	4624	msedge.exe	93
PID 4624 wrote to memory of 1696	4624	msedge.exe	94
PID 4624 wrote to memory of 1404	4624	msedge.exe	93
PID 4624 wrote to memory of 1404	4624	msedge.exe	93
PID 4624 wrote to memory of 1696	4624	msedge.exe	94
PID 4624 wrote to memory of 1696	4624	msedge.exe	94
PID 4624 wrote to memory of 4556	4624	msedge.exe	91
PID 4624 wrote to memory of 4556	4624	msedge.exe	91
PID 4624 wrote to memory of 4556	4624	msedge.exe	91
PID 4624 wrote to memory of 4616	4624	msedge.exe	96
PID 4624 wrote to memory of 5892	4624	msedge.exe	97
PID 4624 wrote to memory of 4616	4624	msedge.exe	96
PID 4624 wrote to memory of 4616	4624	msedge.exe	96
PID 4624 wrote to memory of 5892	4624	msedge.exe	97
PID 4624 wrote to memory of 5892	4624	msedge.exe	97
PID 4624 wrote to memory of 708	4624	msedge.exe	99
PID 4624 wrote to memory of 1508	4624	msedge.exe	100
PID 4624 wrote to memory of 708	4624	msedge.exe	99
PID 4624 wrote to memory of 1508	4624	msedge.exe	100
PID 4624 wrote to memory of 4220	4624	msedge.exe	102
PID 4624 wrote to memory of 3576	4624	msedge.exe	106
PID 4624 wrote to memory of 828	4624	msedge.exe	107
PID 4624 wrote to memory of 3136	4624	msedge.exe	108
PID 4624 wrote to memory of 1756	4624	msedge.exe	109
PID 4624 wrote to memory of 1756	4624	msedge.exe	109
PID 4624 wrote to memory of 2564	4624	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-u1vgon.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffe04ccc188,0x7ffe04ccc194,0x7ffe04ccc1a0
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,10758803207178897496,10983980164994615562,524288 --field-trial-handle=1932,i,1417840538925496534,5995039792913427482,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,8887514834783544839,5199230796173626736,262144 --field-trial-handle=1932,i,1417840538925496534,5995039792913427482,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,12722071175168939735,7918291056797705919,524288 --field-trial-handle=1932,i,1417840538925496534,5995039792913427482,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:13
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,9640226554162369044,159824129318109236,2097152 --field-trial-handle=1932,i,1417840538925496534,5995039792913427482,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,5840677471423926096,7065706472380884015,2097152 --field-trial-handle=1932,i,1417840538925496534,5995039792913427482,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,4129061647305059409,14690383925564305838,2097152 --field-trial-handle=1932,i,1417840538925496534,5995039792913427482,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:9
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,12350000253285690577,15678303783996072718,2097152 --field-trial-handle=1932,i,1417840538925496534,5995039792913427482,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,4264376576465189935,17260631696115763336,524288 --field-trial-handle=1932,i,1417840538925496534,5995039792913427482,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,2809432412459829739,6383920940428432088,524288 --field-trial-handle=1932,i,1417840538925496534,5995039792913427482,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,9355298844950732132,13763335452832883538,524288 --field-trial-handle=1932,i,1417840538925496534,5995039792913427482,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,9355298844950732132,13763335452832883538,524288 --field-trial-handle=1932,i,1417840538925496534,5995039792913427482,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,11381889638979001752,8318184728205499150,524288 --field-trial-handle=1932,i,1417840538925496534,5995039792913427482,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,6205698648226778007,9928532539702536796,524288 --field-trial-handle=1932,i,1417840538925496534,5995039792913427482,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,18233220937688448909,14514626836968697075,524288 --field-trial-handle=1932,i,1417840538925496534,5995039792913427482,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,15686176599758555565,13638506597556317068,524288 --field-trial-handle=1932,i,1417840538925496534,5995039792913427482,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6400,i,14437627643060045127,14192337301317113098,262144 --field-trial-handle=1932,i,1417840538925496534,5995039792913427482,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b20255f77285225ee1d46271de5d488a7f8cae647f5deab7182b6b24156d3bad
MD5 7f7a1b3c125906e865da216d7e3b954d
SHA1 837836b90b3870e9fa8ee86a260411f6194300b3
SHA512 16f35ea1ba527312c94a084ae3eb3335e3f561fce5134af54bc423a2e1888f507dfca0bb0d790da2f8e84314eab224d88142ee9d5ac6ae8308e663667c90bf08
TLSH
T10861C748CA4187B7DB7942307DE621F7F6F065716A8B1D33348AE4BABB4631CB310108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597b60.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597b60.TMP
Size 3KB
SHA256 2b66d25b8a0a607a14ada6b69049b64b1a872a665c5b2d237f37896848457168
MD5 4dcb1277522b01d8a7cde5751aeed213
SHA1 cf7a63786e9ad4550b019596203269f11a972e20
SHA512 83ea745da0a63bed4c3d5704aafa3d6972ced5bd7e32987ed868a2864ef6b956357ddcef947db53c5d73026a28f2e694c73231bd284f8778bc5bdf1593e4c3cd
TLSH
T15861C748CA4197B7DBB942307DE622F7F6F065716A8B1D33348AE4BABB4631CB310108
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 35b23f140db5277f9befaaf93a5634cec0af3aee1c50b9097dbfeadaeb5e755d
MD5 94621be4edc9922c4f2ba46eefe13248
SHA1 f82dd46584d4edf29ad990fa14ae474555d7d45a
SHA512 4dc137497960d60f4ee1bafc9400956baac0220b952981665eeb49a94fed9b1d70ed6658d030d6e0523bd189d8632ce8b4ec89a37d96c33224a56e67bf9ea2d8
TLSH
T1B3419EF3C3E8867E8D0156F0AA186E1BCE1D0915432C7C5AC9E4EF2B93E24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e9ffba19ac378bc321c5f7ecacdf4ad414e8525b62bfd6fd2558ea3877f41e24
MD5 0a54324243e210402a3d4997a5e477ad
SHA1 40f2c0ee1b45e384e3a156ce91e6fe6b97f2b8db
SHA512 a5d43396632917b5f545adfa50e05cac29ebbe39c41d6ee34dbed6ad3f1767bac54622f360cfc96684ecadb65385d93a153b233db8e491d3c2889764f04c8aac
SSDEEP 192:sxRTRqbh/f/msFvQ7R75EzoA8p4R/g6+WNIYlac+1GHIgIJ:sxRT2h/fes1y75lE/5ISs
TLSH
T15E32A655AE68A93B9CCBE21DBB657F13D6FD1033A0951E48B6FC861C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 50f2731c064d0e57f264e97ded323e64384b56875c15e6b09b2c89a097081c61
MD5 bb8b53d9ac0bbe9740ff4fbb70c1af91
SHA1 c53a4f33887430dcb5493cc97554507deb2b4f58
SHA512 1ffb2b2f6bd4749b6ace5d8c951ad7f212195394ac202e57fd44fd2d41f6def83bcaae42f5a24286658732409fd459933c6f72dcd8bb4ff54023b2e0d21be0e4
SSDEEP 192:sxRgRqbh/f/msT5vQ7R75EzoA8p4R/g6+WNIYlacA1GHIgDoJ:sxRg2h/fesT5y75lE/5IkI
TLSH
T15332C9556E28A97B9CCBE21DBB657F13D6FD5033A0911E48B6FC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 382afd0a5b55504066c446a2a8c7929fcbfeab5311164bea83ff24424b26637c
MD5 6040f97a2c397f98367a28ed52056f44
SHA1 61d07c30ab7d83b28aeb2f38b7c92540c51eeb6e
SHA512 03ad885ed986b3f937618af8872a2e9afb3595c5e2dbd2484885b080a07daef6e7468aed8824dbbb6f81ca8de2774be27fb67ad3d1539cf30cc16591490bc058
SSDEEP 192:sxRgRqbh/f/msyvQ7R75EzoA8p4R/g6+WNIYlac+1GHIgDyJ:sxRg2h/fes2y75lE/5ISK
TLSH
T16332B655AE68A97B8CCBE21DBB657F13D6FD1073A0951E48B6FC861C04E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 592421aee4b10d5c92366142a5fd869fc6eede630361b0350738c793f6f6d506
MD5 7b1d75f216d54d38f0e1f731d06d3348
SHA1 efcf4fc8962753da0759fc4af748653d23bb8b2d
SHA512 5806355a069a26af79d0b4a97548253903a79282180c2f5352dfbd8bd2c4d4a11fba94141a3d4a018b1638a23e059f13c28eb6e0e97e96addf507a7e18383df3
SSDEEP 384:kWdRdcVfCtgSQFffTKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV4A9+mRfproe2x:ksRdcJWgSwffT8F1+UoAYDCx9Tuqh0VP
TLSH
T191B2EA3B640CCB7E8F814AEDDC196F976E9C02C796588D8047FE994C02C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a15eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a15eb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 3394b68da3d1cff47584bf4344bb09ac723b1b1116f0f7e3694b525844853871
MD5 fd3ce7f2f16819143e33068dec3bdf90
SHA1 b1bb056b171d1946a2e0a227875637d52f351914
SHA512 69d14bfe24c0498bbf5c99665ddd7b24cb5372b6c87a422bacf9fb9b0a5a478f7467837b5ed508e4092ec6308a27f019a8c9967a3ad6ebf5603fd2be038a2cb3
SSDEEP 768:S93OjB+SFaj7J3+knqMwQi5BgK5/CwYcZJ2sxGL:S93OAFVmBg8/dX2s8L
TLSH
T167F2AE32ECB48EB76CF98244F6867742AFF49253D599059484ED5E0D42A78AE130BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 db555b9eb037cc0f717d2e82167bb18c0872e56c6a89cb693d1c86bcb4a8fdf0
MD5 fd04b09cd6bffc354220888e2c47616f
SHA1 d1334a4372777b026e1821e94553c44a7d8e27f8
SHA512 119f8830c8adbc1f135430354f1a347a8e18f25feff8fc3d1e655ca6e20771588d72d502d5f52782edee6798a99462fffac7e0775e8fe78119337f90656f0273
SSDEEP 768:NFQo37wgCjB+SFaj7J3+9FnqMwQi5BgK5/CwYcZJ2sxGL:co3cAGFVmBg8/dX2s8L
TLSH
T1D4F2AE32DCF4CEBB6CBA8784F68A7302AFF442A3C899959495DD5E0D01A74ED034BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6a9e939e5c8a7e9844fcacce411f33a7344c3ee9bb7d477b5b817eb99d7672f8
MD5 a35d34a3a56590bb48b5272bc061617c
SHA1 498fe61139656253c324a226daae049e85b59933
SHA512 066b5701368d996307645f0663774bd552eb8ce02c59f2a2633503ba63f7f57d7d5e64cc937450db06eea2c044311ed768e15ec3cfa27e96502b42fdfa5bc5d7
SSDEEP 768:i93JDB+SFaj7J3+knqMwQi5BgK5/CwYcZJ2sxGL:i93JgFVmBg8/dX2s8L
TLSH
T1C7F2BE32ECB48EB76CF98344F6867742AFF49253D599459484ED6E0D42A78EE030BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 b30607796fcb0b609ab9583b1824eaa49c6d0ee90d75a09ccb3c4f3810fbd482
MD5 33136d525d8c9ef5098fce12701795b2
SHA1 f9eb50b67376295c6df3d4a7e0bee09fcbc9b1ff
SHA512 b889c3fd4e626edff7dd734c9b9e081bafcdf07fe8e9f218e6df724dccef5865f4cb46c08e8ad2adcab2dc465b7f20ea7e0d67da2b52494063aa45ff94fa44c9
SSDEEP 768:O/UxvxjgC+Ft3TpMSFaj7J/nqMwQi5BgK5/CwYclrA8Dea:DZj3+Ft3Ti1VmBg8/dZA8Sa
TLSH
T12C03C036ECB49E778CF68244774A638BEFF451A3C580099489ED1E0E46979EC130BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3658c05d-810a-4413-b2a6-cfa014bccc8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3658c05d-810a-4413-b2a6-cfa014bccc8f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download