c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d

Analysis

max time kernel
148s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-z7u3lu.htm
Size 34KB
Sample260930-qp8dmayzes
SHA256 c2d81496aa9aede610168814a238002ce7de294b0fe73040d224b8184e622e1d
MD5 966cbc85dbef6cabdbdc9c7e5496cc81
SHA1 a975b1e21c10dd0dc8fa0dc9ecc3984ca1aaf500
SHA512 4385a6988471168604246748dec63ed3bcfeecaffa1948583072d992edad73d6943a08af0c354e6fcfc007425da662357166b6909fa654e104b78c0e97c38a71
SSDEEP 768:3srOAOH3uia5QeAE4rYyH1UeH+NypaNJiA9Ky:39AOH+l51kYyHeNVJAy
TLSH
T15AF2E65356D19D37066392F5FCB8BD2C95CA8D0FC248AC04743CAA0C5FE4EA06EA7679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5376	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{D7FABA1E-1F5D-4551-8A94-488D5C56B68F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5620	msedge.exe
5620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 1204	3436	msedge.exe	87
PID 3436 wrote to memory of 5376	3436	msedge.exe	89
PID 3436 wrote to memory of 3448	3436	msedge.exe	91
PID 3436 wrote to memory of 3448	3436	msedge.exe	91
PID 3436 wrote to memory of 4856	3436	msedge.exe	90
PID 3436 wrote to memory of 4856	3436	msedge.exe	90
PID 3436 wrote to memory of 4856	3436	msedge.exe	90
PID 3436 wrote to memory of 5704	3436	msedge.exe	92
PID 3436 wrote to memory of 5088	3436	msedge.exe	93
PID 3436 wrote to memory of 5704	3436	msedge.exe	92
PID 3436 wrote to memory of 5704	3436	msedge.exe	92
PID 3436 wrote to memory of 5088	3436	msedge.exe	93
PID 3436 wrote to memory of 5088	3436	msedge.exe	93
PID 3436 wrote to memory of 5008	3436	msedge.exe	95
PID 3436 wrote to memory of 5008	3436	msedge.exe	95
PID 3436 wrote to memory of 5008	3436	msedge.exe	95
PID 3436 wrote to memory of 3012	3436	msedge.exe	96
PID 3436 wrote to memory of 3012	3436	msedge.exe	96
PID 3436 wrote to memory of 3012	3436	msedge.exe	96
PID 3436 wrote to memory of 1272	3436	msedge.exe	98
PID 3436 wrote to memory of 1272	3436	msedge.exe	98
PID 3436 wrote to memory of 4064	3436	msedge.exe	99
PID 3436 wrote to memory of 4064	3436	msedge.exe	99
PID 3436 wrote to memory of 3640	3436	msedge.exe	101
PID 3436 wrote to memory of 4808	3436	msedge.exe	105
PID 3436 wrote to memory of 3412	3436	msedge.exe	106
PID 3436 wrote to memory of 2220	3436	msedge.exe	107
PID 3436 wrote to memory of 3544	3436	msedge.exe	108
PID 3436 wrote to memory of 3544	3436	msedge.exe	108
PID 3436 wrote to memory of 5620	3436	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-z7u3lu.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ff98905c188,0x7ff98905c194,0x7ff98905c1a0
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,7853044431635407740,10280975649613034009,524288 --field-trial-handle=2172,i,9194506278023886708,17719105935677345481,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,2486809689775374659,5741596411859766072,262144 --field-trial-handle=2172,i,9194506278023886708,17719105935677345481,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,3218001065848650532,11899907087271985175,524288 --field-trial-handle=2172,i,9194506278023886708,17719105935677345481,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:13
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,4023973167412197791,1160797462121938735,2097152 --field-trial-handle=2172,i,9194506278023886708,17719105935677345481,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,18153067188737842695,5580187426987477038,2097152 --field-trial-handle=2172,i,9194506278023886708,17719105935677345481,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,2248341022855193452,8843912930257512490,2097152 --field-trial-handle=2172,i,9194506278023886708,17719105935677345481,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:9
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,13987890276786611280,12664899810028754850,2097152 --field-trial-handle=2172,i,9194506278023886708,17719105935677345481,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,2775114716230564070,9531493223998915199,524288 --field-trial-handle=2172,i,9194506278023886708,17719105935677345481,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,12894998197614262568,13607672756635062003,524288 --field-trial-handle=2172,i,9194506278023886708,17719105935677345481,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,3218558180505839905,7427328344488617129,524288 --field-trial-handle=2172,i,9194506278023886708,17719105935677345481,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,3218558180505839905,7427328344488617129,524288 --field-trial-handle=2172,i,9194506278023886708,17719105935677345481,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,425297869657952597,16614361301117339178,524288 --field-trial-handle=2172,i,9194506278023886708,17719105935677345481,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,7007105829050948526,5571444511218234959,524288 --field-trial-handle=2172,i,9194506278023886708,17719105935677345481,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,421692017483998664,117082729061006319,524288 --field-trial-handle=2172,i,9194506278023886708,17719105935677345481,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,3610049017595730000,2218425513621418739,524288 --field-trial-handle=2172,i,9194506278023886708,17719105935677345481,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5612,i,10796954500211723539,8773748217199515484,262144 --field-trial-handle=2172,i,9194506278023886708,17719105935677345481,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a9463d1520641a29629dd55ba7db6a5e2911d65ef94e8ac9c7bb01cfaa5edd7b
MD5 4db1d6c7e85be5e568515924fea3b9c5
SHA1 b3eaabc1e1b02ed9b7afcf9acb3c14958451f272
SHA512 441ab90e7b5386521adf12605a9a58b28c89c7d6b28a292144fcac60acba19dc0ec52a8275cf3118b535c63c2b46f05aa324f0fe0fbbf0759fda098702036d6c
TLSH
T1E95186D161598A9CC7B8E471C1D14243FDFF26F0A74B9F1128B6C2B66BC63E47325841
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a790a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a790a.TMP
Size 2KB
SHA256 2cd2d7b2bf9e5dc53594cba86674c3413d845936acc530bfc558d67763f724fe
MD5 2123a9a74a53fbb5fe232ed1a17a9186
SHA1 43ed62ed37fc391834772061a3ce4f76c4f51d86
SHA512 d017a6d2ad150457046f14c4de188aba05016fe361ad46f25532320a56ae1e5852a00711fcd87d1c4a5e45550139960ba5ea045f637435dfa00957df436bd2a5
TLSH
T14B5195D161598A9CC7B8E471C1D14243FDFF26F0A74B9F1238BAC2B66BC63E46325841
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f3992400c6c04f1d3839819558f3e52636c93cc5a82b4d1197785f9ce22f8783
MD5 d4dd5600ca707218bd02aec4671afcac
SHA1 a020c572cf6af5a269f9a34518087f6f78ec4ab2
SHA512 f91c9642a83144e5deaadce6cf4084eb9a3528e83bd021b15cee5bf0270fb20b26685f93e0752128605e331462bf58da2619eae64836d6004128c75cf61a12eb
TLSH
T1B741CFF7C3E8867D890156F4AB186E1BCE1D0915832C3D5AC8E4AF2B93E24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6e36afa8a6b0abca5161f87e7d404e746e040a4a96a7e8279040025faef15c87
MD5 ded34d94eccecdf33bcb0dd8d4def506
SHA1 99db3b34d7d502970227c9aad182d24934870810
SHA512 dd6e52f7ae37850aeb037ef76938da5261746e5188c384ef008cfcf1ac3b3320a7f769e68cc1a488826012073bb4f8125d483f945f6a3aec16942ec240adb92b
SSDEEP 192:sxRmRqb4/fksDK7xFgzoA8p40/g6+WNIYDFeGZIgDcJ:sxRmW4/fksD6xN/5IW0
TLSH
T10732B815AE68A97B8CCBD21DBB65BF53D2F91037A1911E48B6FC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f7439c6ac228bab1744268e8ee961fc9f1ea4e88dfee9d1fe75612cbbf4cfd91
MD5 62a2f2861ce6c7b004fc83c0494a41d1
SHA1 7534e7e2ac8a418782b580bc4e04c16f12a5befe
SHA512 d1158aa10c1a1ca16cc4c763eaa9d63fe412d6c9f829e07136e046ec66d39bd82bd2881cd7a4524a79ba010c2e93fbd8d87f9038b2b55e67bece1fd340b83881
SSDEEP 192:sxRVRqb4/fkszK7xFgzoA8p40/g6+WNIYDFeGZIgIJ:sxRVW4/fksz6xN/5IWs
TLSH
T1BE32B715AE68A93B8CCBE21DBB65BF53D2F91037A0911E58B6FC861C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 70c1cbac68b5f259bdc50cc2413a64a6a2cd141d64cb745522f7661fd9945561
MD5 66626ff58c47a06cc8282fe013544950
SHA1 96026a22ea5043e1bdd7b683b321c47ba4dd771f
SHA512 7d32f332e41e52863c2ab98fa7d7c1d74210fe09313153fb2429ae4982679f761a0423ca0e61baec782925458afa279d8c176738ac8157aa1b19629f605c0796
SSDEEP 192:sxRmRqb4/fkshK7xFgzoA8p40/g6+WNIYDheGZIgD+J:sxRmW4/fksh6xN/5IYO
TLSH
T19832C915AE686D7B8CCBE21DBB55BF53D2F9503360911E48B6FC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 b82d51dd6b0d460e8a98f49ad52c43ca0f679989cbdf65430c85fec824de4809
MD5 ad4e794b6f13c7bdf556988cceaaf1ad
SHA1 aa37ec80dd87b5ea1491f4b14b0e0327eb2a70d7
SHA512 8a0f6f2f8e30980f3cbee89150e28e67b526e49775d9070ff85ed1567412472cc01c45997bba6015f496fddd3a26ea7841d2700ed16b3a3bd7bc6dca12c01c31
SSDEEP 384:ScwYbpGfCtgaEFfA6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVO+9W+R93roTy1:SzYbpUWgasfA68F1+UoAYDCx9Tuqh0VE
TLSH
T130B2DA2B640CC77E4F805AADEC1A6F977D5802C796988D4047FE994C03CB7EBA11A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d3fd41e1-20bf-4d18-ab67-a7a2ae020b75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d3fd41e1-20bf-4d18-ab67-a7a2ae020b75.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caa11a9e-2f95-4c20-b515-65d946413667.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\caa11a9e-2f95-4c20-b515-65d946413667.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 bbc36841c58661285f76bc796a7dfd3d374c5dc5ffcb2b6b6512d8d77cc46e09
MD5 b2dfe3b6cc9881607044bab454edfa55
SHA1 f96f48a5872e5a0a57636879fc9591dc0d6eb0d9
SHA512 9fbceab9dbc75ff8b52520e69bf4005012b260d766edc63c86f56873cbed596049a304efbf0b93fe4cc149319bc22ad177a4e7f82fc47d34c31c674a1331f752
SSDEEP 768:Pq3571UybNbLhmtHTOeRFZD1fTos7Rj32sbep:Pq35SYY1fT/RD2syp
TLSH
T1E3F2AE36B8E49D734CFAE284B246B6477FB49563DAC9498444DC6E0E04DBBAE0347C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 46aaf10fd46f169173cb0009354dd504e61b0b88396fce114269619007aff8e4
MD5 7628d37204c7a9ae3c854e7087d947a7
SHA1 8286af3d9f23498e5f7516b91b215aca03fb84d0
SHA512 ad588ba9fa99114b3b7348a79e1129257b531a884c7e8d430005c9903f77384fdcf03db81f8720a7c3fa462b2e6920f3764a577bd60227b80b59facadfa32948
SSDEEP 768:8q36NUybNbLhmtHTOeRFZD1fTos7Rj32sbep:8q362YY1fT/RD2syp
TLSH
T12AF2AE36B8E49D734CFAE284B24676477FB49563DAC9498444DC6F0E04DBBAE0347C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 be1c517d4ec87cd1ffc8c1f7691d770f406ccfe6a8c894838c47ce390a429e1c
MD5 18f9c54e567198cd512025701c1757a0
SHA1 7ec9ab280660c59752e5308d46d1d8d58858b304
SHA512 306b826c30820b7c73aab933e47edf1206a40cdd4c83a059bcc608b288313ac2cb0229d450016af4ba51bbf3e071dc1fc3f4878a2eba000c47a626c1015a6578
SSDEEP 768:6FQx3owgHNUybNbLhmtH9OeRFZD1fTos7Rj32sbep:hx342aY1fT/RD2syp
TLSH
T1C9F2AE37A8D4CD779CFAD784F24A7642AFF041A3C9D9999455CC6E0E009BAED034BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 356ddbcbec33992bff2975db865172c5a9cf3e583a1706f903415316dbf79b43
MD5 b9c484a6473a4fcd04ea998ad32805a9
SHA1 72f38b81668699489fef35ba98b619729c6e3b2e
SHA512 217233ae54edda7440cdbc2bf94350d7abda9bec9bafcde408006d29f9aae30c7e9877255ff97c2a188b304fadcacd39c2f40deba3ea6910589afd6694101469
SSDEEP 768:z/UxvxjgC+k3dp4ybNbLhmtSOeRFZD1fTos7Rz9/+Pu:GZj3+k3duTY1fT/RBKu
TLSH
T19E03BF3AF8D46C338CF6E244B20A764BBFF415B395C91A9809ED2E0E158BB9C1307856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d720787e-e61e-44a5-9050-0cf4db4e21d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d720787e-e61e-44a5-9050-0cf4db4e21d8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download