5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-1253-20vucw.htm
Size 194B
Sample260930-r38f8attbt
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4132	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{EC274A2E-7980-49A9-94F4-A94C86FFC623}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 3352	5004	msedge.exe	91
PID 5004 wrote to memory of 4132	5004	msedge.exe	92
PID 5004 wrote to memory of 4100	5004	msedge.exe	93
PID 5004 wrote to memory of 5048	5004	msedge.exe	94
PID 5004 wrote to memory of 4100	5004	msedge.exe	93
PID 5004 wrote to memory of 4100	5004	msedge.exe	93
PID 5004 wrote to memory of 5048	5004	msedge.exe	94
PID 5004 wrote to memory of 1088	5004	msedge.exe	96
PID 5004 wrote to memory of 3404	5004	msedge.exe	97
PID 5004 wrote to memory of 1088	5004	msedge.exe	96
PID 5004 wrote to memory of 1088	5004	msedge.exe	96
PID 5004 wrote to memory of 3404	5004	msedge.exe	97
PID 5004 wrote to memory of 3404	5004	msedge.exe	97
PID 5004 wrote to memory of 5364	5004	msedge.exe	98
PID 5004 wrote to memory of 4924	5004	msedge.exe	99
PID 5004 wrote to memory of 5364	5004	msedge.exe	98
PID 5004 wrote to memory of 5364	5004	msedge.exe	98
PID 5004 wrote to memory of 4924	5004	msedge.exe	99
PID 5004 wrote to memory of 4924	5004	msedge.exe	99
PID 5004 wrote to memory of 5736	5004	msedge.exe	102
PID 5004 wrote to memory of 3228	5004	msedge.exe	101
PID 5004 wrote to memory of 5736	5004	msedge.exe	102
PID 5004 wrote to memory of 3228	5004	msedge.exe	101
PID 5004 wrote to memory of 2808	5004	msedge.exe	104
PID 5004 wrote to memory of 4720	5004	msedge.exe	108
PID 5004 wrote to memory of 4192	5004	msedge.exe	109
PID 5004 wrote to memory of 5636	5004	msedge.exe	110
PID 5004 wrote to memory of 960	5004	msedge.exe	111
PID 5004 wrote to memory of 960	5004	msedge.exe	111
PID 5004 wrote to memory of 2064	5004	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-1253-20vucw.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffdd6b8c188,0x7ffdd6b8c194,0x7ffdd6b8c1a0
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,3280316967610229251,9965151127816129954,524288 --field-trial-handle=2152,i,6292429177301247556,9357506357364643119,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,5603022014694842873,4043707118026825000,262144 --field-trial-handle=2152,i,6292429177301247556,9357506357364643119,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,16105987629423585635,13539313697459678519,524288 --field-trial-handle=2152,i,6292429177301247556,9357506357364643119,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:13
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,9968377357775331911,14974582498795179330,2097152 --field-trial-handle=2152,i,6292429177301247556,9357506357364643119,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,9839787792213551223,3746888545810319704,2097152 --field-trial-handle=2152,i,6292429177301247556,9357506357364643119,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,320224132950314062,11428187543116864458,2097152 --field-trial-handle=2152,i,6292429177301247556,9357506357364643119,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,16392713711798367646,5612817781073629494,2097152 --field-trial-handle=2152,i,6292429177301247556,9357506357364643119,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:9
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,266461712797802049,12882141724335341584,524288 --field-trial-handle=2152,i,6292429177301247556,9357506357364643119,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,8509183930837037872,875180949709180446,524288 --field-trial-handle=2152,i,6292429177301247556,9357506357364643119,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,4600008951885112382,6264043482216841693,524288 --field-trial-handle=2152,i,6292429177301247556,9357506357364643119,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,4600008951885112382,6264043482216841693,524288 --field-trial-handle=2152,i,6292429177301247556,9357506357364643119,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,13646474984919135923,10091676751586103841,524288 --field-trial-handle=2152,i,6292429177301247556,9357506357364643119,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,10435364429975138936,1396937683100279288,524288 --field-trial-handle=2152,i,6292429177301247556,9357506357364643119,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,10710151119388289304,9932646868042977853,524288 --field-trial-handle=2152,i,6292429177301247556,9357506357364643119,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,5163462585814746286,16198719578635245305,524288 --field-trial-handle=2152,i,6292429177301247556,9357506357364643119,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6448,i,12851652413184787355,6142734003955401342,262144 --field-trial-handle=2152,i,6292429177301247556,9357506357364643119,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e1837ee53009f9b691f7aee3be45ffb945d4894bf04ccaf875b9947114bb5224
MD5 58ba31abb4a3fd3bbc9aadea4fc9ca13
SHA1 d79c4b2ccee6dadb45162ea34fb988911510f0b8
SHA512 0c096d7f5d364e0911d26f4bc2ea03e3d81b2026be5182b04fc17e7949640761db8056138b55b28aa9abe884d601d2cf6b1be9e992fd3565c35c69def459d32a
TLSH
T1F3D02B3579ACD772C18C503A405901112A95F001FD46C1801953B10848913400006295
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0a1e646beadfff70af6a1dc73b6baa41188262ddbb2b7781270d4e94c92c02be
MD5 893220bb58a1416480d52375128fa19a
SHA1 3a577208211e9133f3744d9ba695501b0481ca9b
SHA512 b3f0e3d85398f7aa7fcea74cd44fd2709c0265d9072771dccfe7508832bc1173f452a0f49028e8bd62ea434676abcdf4a111c8e31f121871fbdfa4acf207b131
TLSH
T1C2D02B3179BCD772C18C503E405A01112A85F001FD46C1801A53F10848913400005281
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c0ec80959383d716ab5e868f52e5247b0b2b35ebf27f498baae312a9a06e7be8
MD5 b38e4091cb69be2b05bef994ae3d6558
SHA1 c0f7541ea183cde43dec77c701678b9f31b1b152
SHA512 2fb1d315797b4a9b6f8dc2729077fc86c1e9b9cd8161266adca96a99c0991ce51ce8b29c669e195c5cd2fa6cc09ba0e8b291a0df94e62b1f4839a8221a53f8fe
TLSH
T138618D058334A91AFBA9FB3553C78D9E79B3449CCEC30F11D642F0B847097A6C2B4858
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ddf2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ddf2.TMP
Size 3KB
SHA256 5d41c9871114887572998152666a9dc32a7a2c4a6ce91aa1813221896018c447
MD5 5bab64225b29e04ef27f731ab293ee8f
SHA1 a5cd7b5ae25cf7c519895bec8e25e9786b30a152
SHA512 b59300d247a13c7266d1a911b1a0898cf308a83cc4031280f25a0b4464c13d214d5e0a64b4ae53d88d4d0abfef421b27b29ecd064f12f8b4497c403224624a91
TLSH
T168619E098334A91AFBA5FB3057C78D9EB9B3449CCEC30F11D642F0B84709765C2B4858
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f93381ca4e38a90ac9703cf8fc5786685ebd989fb50d620c45ef6a773b16e9bb
MD5 935194d94f677fce54016bb34e1d975b
SHA1 e92cac22e26b66546083b4b47865a34b62494daf
SHA512 50f8a5bc40a75cf9dcc14ad757108a3dc84804dfb5bf594fae93b4cabc48c7dcc9055b16ffd20d52c8c8ea02e8b3b613aee3312801088ef3bd610d214f868fb8
TLSH
T13641AFF3C3E8867D890156F4AB186E2BCE1D0915832C3C5AC8E49F2B93E34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 29913ff69c18a4f860a051b2bb0391ddaff8f11151bde67656c0ec7040ee7bae
MD5 b035f53fe5473862a38e543b236b046c
SHA1 eac3664a4281441ac0baf92e5d9f717d5c86c52f
SHA512 3364c6b22a7f29b102f9942a3cdc2b7efab3a7c3c15fb7bd58f2fc46da902d72bef15d56d4fa13c2c6f2deeb66a9103eeaa3b40a781ba56097c418e0728a7acc
SSDEEP 192:sxRMR+b1/fIslqmBQzoA8p42/g6+WNIYdR8GYPIgD7J:sxRMq1/fIslHBJr/5Ith
TLSH
T1BF32B715AD68A97B4CCBE60DBB55BF53E2F95032A0D51F48B6FC8A1C04EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c7fc0635f160d908c16a0a76a3f94c7fc7f06ff0e1c6ea3c857c8b2a087a5a83
MD5 503ebb4ae6b0a384c458b6e815f23cca
SHA1 f2d8083e10d4928064e2420e5d3b980a5ef883b1
SHA512 b9219e5d91171983d5f6178233978e64517de20f9858407ea9cabc2516a810c505be8fdd972a9f24e561e0ba4f7087cb3ee2d23c2c12cb00be7dd2af72b7b2d6
SSDEEP 192:sxR/R+b1/fIsnqmBQzoA8p42/g6+WNIYdq8GYPIgIJ:sxR/q1/fIsnHBJr/5ICs
TLSH
T14D32A715AE68A93B4CCBE60DBB55BF53D2F95032A1D51F48F6FC861C04EA6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 07bac8c35eba0518a0fa01eda8376a0fdeb37326a5c0ef2d2ec3ce52d2b5b839
MD5 c49117ea0b6b196e117915206b182e46
SHA1 7a2032ba99f140b517bd180156e26115ba471e19
SHA512 c164115d6a6356284316fcda4401b3c7076d14fc1b34fe5afdd03258ae8a9d765987b49ca291eacb74cda30d9e45449fe2f68c0eb23397aeef25bf125c439769
SSDEEP 192:sxRMR+b1/fIsjqmBQzoA8p42/g6+WNIYdq8GYPIgD1J:sxRMq1/fIsjHBJr/5ICj
TLSH
T1F732A715AE68A93B4CCBE60DBB55BF53D2F95032A1D51F48F6FC861C04EA6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 cd5d62a129c55d5823751af2dd4ed847d231d989c85adf01ff5b19e4b52c28f2
MD5 27294526551e46a05dd81daeca7d4e7a
SHA1 c990ac5ed42a6a83ddc35c5e28eb65518cc53bd7
SHA512 214ab7b1fa4ba09cd0d78aeb1894dd2a985ccf61ee852772e36bead991491432d807b3b648ff82b0caa5980b0cc093945fc789752e02dda2ac98ae952e97119e
SSDEEP 384:qYe+z1ifCtgUGFf8SKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV269GGRLLroKrW:qF+z1oWgU6f8S8F1+UoAYDCx9Tuqh0Vz
TLSH
T1CCB2EA2B604DCB7E4FC01A9D9C196F976DA802CB96588D4047FED94C03C77EAA21A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

7fd6cec7-b7e6-4882-91c1-f3cd62bfd47c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7fd6cec7-b7e6-4882-91c1-f3cd62bfd47c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 2421551cfd91ef1962c5e91b27b01d867be7d0d13456035746cb428b0cca9656
MD5 388be4a5ac66a2e552981dd872ed51c1
SHA1 1ebe04297828d295ac6eb37d67d218bae84e53de
SHA512 54fe756b27db13b509f3ff52725c85f00f4282f2af9fecfa8ef609198cba33dcc4738f2139b74c2f742b4603649f9fa85bd9c87df2b4f46e11adc6bc6eedb46d
SSDEEP 768:G/UxvxjgC+13HQOYRnK3OYPoj1h3Yogkl5akl8pbHW0AWDQSHvP0Ug:7Zj3+13Hxoj1h3Yog05akl4bHW0AdSzg
TLSH
T12A03CF36EC79AD734EE6A244721AA357FEF4952356C45A9449EC9F0E028B3BD030BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 9b2a94e9d23ef23a538a33aab7860fdcc7f9b4c296d5d7eb989a6206647477e5
MD5 e26c07b7367b86f3d2bff83d0135008d
SHA1 f7ba8736f57ad934bca9ea6603164d679d8a8e75
SHA512 aa59d8404762f83029dbcb083d2dcd540cb5763cabfb002a7461aa05be0689fe79e2c519525eec1d8013351776e736d1b1a0e3819a7b3fddf798b1f5b524b721
SSDEEP 768:HFg/UxvxjgC+/3DwgeQOY9nK3OYPo71h3Yogkl5akl8pbHW0AWDQSHvP04g:fZj3+/3Yx271h3Yog05akl4bHW0AdSng
TLSH
T16C13CF37ECA5DD778EE69784B21E6317EFF4856395C096E496DC9E0D028B2AC030BC52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 551763a2ecaa4ab511b620413d4a4126c126045cc683a8c9f2ee2b40c7f544fc
MD5 5336106d1a794492adc421885ea148a2
SHA1 d57419b0670e4a886fb8c17b1fe9b88416e2c3b4
SHA512 b5df2423149a251b83a0f3ea440fff21583d7acb27f65a29303f4042f9b10496400cfa6b4038123569d1cae96279ebc176a25feedfd653a4793e2b3978eda281
SSDEEP 768:H/UxvxjgC+13qQOY9nK3OYPoK1h3Yogkl5akl8pbHW0AWDQSHvP0ADg:6Zj3+13qx2K1h3Yog05akl4bHW0AdS1g
TLSH
T1CC03CF36EC79AD738EE2A244721AA357FEF4852356C45AA445EC9F0D028B7BD030BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 5cd48437a875cf7ac5df52d43505b950e211ff3f2f365c69512205ede62e1098
MD5 9a1b4e2ac58d1bb5d18c83736dbe13f6
SHA1 522c5cac45c5b92273991bb5142a667c819039a5
SHA512 66e1e075475f9fcc7f42789f12e08f576594bae34b393d73794d726416a280463b57abfc77d90cb0030029524755ef5cf74076ab87a65b60d6f7ed0052f123b6
SSDEEP 768:Y/UxvxjgC+13qQOY9nK3OYPoy1h3Yogkl5akl8pbHW0AWDQSHvP04g:lZj3+13qx2y1h3Yog05akl4bHW0AdSng
TLSH
T19C13CF36EC79AD738EE2A244721AA357FEF4852356C45A9445ECAF0D028B7AD030BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf0421e8-2e3d-4378-9845-52c147a8723d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bf0421e8-2e3d-4378-9845-52c147a8723d.tmp
Size 38KB
SHA256 bd3cc9cad2b72a4d365d38ee9f8972da7584b1e6db9e8a7157e840adc7ea4b7d
MD5 3405b0486004ebb58b00cf9782da1646
SHA1 0abc7264f806a4237b16020894c18bf50a4ca4d5
SHA512 316fb504f6fe96847d2ce5809b83439cbfc771a76cfbcbc3c8b91820c4f54b97de585c729ef74acadb93021b1f2426ed736393c9630a97330967a8a834a8d1e9
SSDEEP 768:B/UxvxjgC+CZ3TFK3OYPo+1h3Yogkl5akl8pbHW0AWiQSHvP0Vv:UZj3+I39+1h3Yog05akl4bHW0A2SCv
TLSH
T13F03CF36EC659D734EE6A284721AA357FFF495235AC45A9448DCAF0D028B3BD030BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dde636e5-b75c-41ad-ab4f-d13c15703e16.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dde636e5-b75c-41ad-ab4f-d13c15703e16.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download