5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-429995-purrdu.htm
Size 194B
Sample260930-tkp82azbkh
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4936	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{55B72998-F2A8-44F7-83B5-5063C2B6F1E2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6052	msedge.exe
6052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 4072	1320	msedge.exe	89
PID 1320 wrote to memory of 4936	1320	msedge.exe	90
PID 1320 wrote to memory of 5964	1320	msedge.exe	91
PID 1320 wrote to memory of 5964	1320	msedge.exe	91
PID 1320 wrote to memory of 4980	1320	msedge.exe	92
PID 1320 wrote to memory of 4980	1320	msedge.exe	92
PID 1320 wrote to memory of 4980	1320	msedge.exe	92
PID 1320 wrote to memory of 3692	1320	msedge.exe	93
PID 1320 wrote to memory of 3692	1320	msedge.exe	93
PID 1320 wrote to memory of 5500	1320	msedge.exe	94
PID 1320 wrote to memory of 3692	1320	msedge.exe	93
PID 1320 wrote to memory of 5500	1320	msedge.exe	94
PID 1320 wrote to memory of 5500	1320	msedge.exe	94
PID 1320 wrote to memory of 3104	1320	msedge.exe	96
PID 1320 wrote to memory of 4460	1320	msedge.exe	97
PID 1320 wrote to memory of 3104	1320	msedge.exe	96
PID 1320 wrote to memory of 3104	1320	msedge.exe	96
PID 1320 wrote to memory of 4460	1320	msedge.exe	97
PID 1320 wrote to memory of 4460	1320	msedge.exe	97
PID 1320 wrote to memory of 5836	1320	msedge.exe	99
PID 1320 wrote to memory of 2732	1320	msedge.exe	100
PID 1320 wrote to memory of 5836	1320	msedge.exe	99
PID 1320 wrote to memory of 2732	1320	msedge.exe	100
PID 1320 wrote to memory of 1960	1320	msedge.exe	102
PID 1320 wrote to memory of 5300	1320	msedge.exe	106
PID 1320 wrote to memory of 2648	1320	msedge.exe	107
PID 1320 wrote to memory of 784	1320	msedge.exe	108
PID 1320 wrote to memory of 6012	1320	msedge.exe	109
PID 1320 wrote to memory of 6012	1320	msedge.exe	109
PID 1320 wrote to memory of 6052	1320	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-429995-purrdu.htm
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff924d2c188,0x7ff924d2c194,0x7ff924d2c1a0
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,9662822944588865103,1927366493422158575,524288 --field-trial-handle=2640,i,16710501314270994548,6312849207122025132,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,12167946056165559709,13241705267684199793,524288 --field-trial-handle=2640,i,16710501314270994548,6312849207122025132,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:13
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,5177988253059277589,1592946527089322961,262144 --field-trial-handle=2640,i,16710501314270994548,6312849207122025132,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3284,i,8938048825502416686,9930087772622813510,2097152 --field-trial-handle=2640,i,16710501314270994548,6312849207122025132,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3288,i,13304667055077640220,8862688389089566437,2097152 --field-trial-handle=2640,i,16710501314270994548,6312849207122025132,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,2175413788410839373,12425147381161089977,2097152 --field-trial-handle=2640,i,16710501314270994548,6312849207122025132,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,8818525229001140346,724806246006997963,2097152 --field-trial-handle=2640,i,16710501314270994548,6312849207122025132,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:9
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,1708089547029814142,10249262149537447938,524288 --field-trial-handle=2640,i,16710501314270994548,6312849207122025132,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,6420673531388636743,7999380143755133983,524288 --field-trial-handle=2640,i,16710501314270994548,6312849207122025132,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,15412254157466038103,17343231102257531958,524288 --field-trial-handle=2640,i,16710501314270994548,6312849207122025132,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,15412254157466038103,17343231102257531958,524288 --field-trial-handle=2640,i,16710501314270994548,6312849207122025132,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,16469351938277548929,16007759472103380910,524288 --field-trial-handle=2640,i,16710501314270994548,6312849207122025132,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,13857808289580620696,8274720437507137318,524288 --field-trial-handle=2640,i,16710501314270994548,6312849207122025132,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,10284799442334540461,7180240479053942923,524288 --field-trial-handle=2640,i,16710501314270994548,6312849207122025132,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,13131168192512949730,9657211621377656154,524288 --field-trial-handle=2640,i,16710501314270994548,6312849207122025132,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5520,i,16713745955420632821,7157663153211359080,262144 --field-trial-handle=2640,i,16710501314270994548,6312849207122025132,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 84748bcd6c171a957cdd4ff15e3aa2d19fae332fc4bc2da46264b4c3da1fef41
MD5 05cdd891987d36f61a0e444cdc4fbb8b
SHA1 ad7ccf601067f36fe4d334bddb3bb57e3e63c082
SHA512 d3eb89549cd01c6bf908a9126f1f0ff19e711146d171e758959794cd0219e8d41795b2f8f212a183bef3608335be0fe6ba2ebd532f100a3c8e93d2c3df4c6770
TLSH
T14761B545464A0B96F7BB6439E1DE3D87353359A1D483FE0112E6C8BA660EB3D613D00F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b740.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b740.TMP
Size 3KB
SHA256 c52c7464db366e4a70701620a84605ebc7057461c2f77d8907e5e94b5d2403a0
MD5 340a6f0d9ef0fbbbb18d75577c225c4d
SHA1 039812cc9435f9a1e07bad08df4761d914b9a25e
SHA512 b38f50adc70181c0d1119f05dc32a0e1d37f072faee935f3188ab5fd2fadafc3e3ec44c3299a097359d9eb863a0daa5ca44f16fd81fcb28ba9d0f79a77164940
TLSH
T14561B545464A1B96F7BB6439E4DE3D87353359A1D483FE0111E6C8BA660EB3D613D00F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 88431d975ecde1e5b754129b6bd38412c78d10f9d013489b2be1e720dffbba77
MD5 70152541b6e4fb9c24a0dd8042da1fa8
SHA1 029c5e73da74b2ea2882926054b1e9c923493b3d
SHA512 dfd6092bd891817312a5b067e6a9f97164c9557dae2452eb6fe161c2a4dd6941d2d77813fbe08959d591f67b68286906562e3482c7442ce68f1af9aedb2db7af
TLSH
T112418DF3C7E8967ECD0156F0AA186E1BCE2D0915832C3D5AC9E4AE1B93E24B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9de10a287b1139103e49a71b46a2e554b4682a7b1e791f574b4d0a7e6bb1e7ef
MD5 c674651e8b4b7466af08c13e62129e9a
SHA1 02bceab2aa333ee7cc9c0643f390a65ae2a8b7fe
SHA512 da9178f8d462d79eaa4368ea0a99874defb1e80a4a0c2026f75c74ac15e628a0aa5a8736fcebd6dcbd43890050ee34b8e25c57f8e62093ff37316db365496d0d
SSDEEP 192:sxR0JR8b//fca+sXyQ7R7KSzoA8p4+/g6+WNIYlacseGiIgDaJ:sxR0Jg//fchsCy7Kff/5I2y
TLSH
T15132B8166E68AD7B4CCBE21DBA657F53D6F95033A0951E48B6FC861C04EB6DD120380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f6a5e1b419360f89e61ef1912eaa347029565c95b5d5cde1c6aba341d9037683
MD5 aaf1ce06ba84aad6233e62eddbe04bc9
SHA1 ca9a3547a3418609fd7843b970e13c2c99313d72
SHA512 26fcf1ce229cdf31b8a1c40ddc6bc4adcea3c3c9d072156735753b3f83973556bdca1ba7fd7c6479cc7c52351ba7749effd334099f7b16963d8eb09902e16bf2
SSDEEP 192:sxR0JR8b//fca+sZyQ7R7KSzoA8p4+/g6+WNIYlac+eGiIgDIJ:sxR0Jg//fchsgy7Kff/5IS4
TLSH
T12D32B616AE68AD7B8CCBD21DBA657F53D6F95033A0951E48B6FC861C04EB6DD120380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2025764c82d114aadef3450fe27fb7db37e417a6f579c983f716f054241d74db
MD5 16cf13f57912ac4dde0092b361a36249
SHA1 5dd8d04b5f4899d274f93fd50a21b2a56b1cf62a
SHA512 640e919b525b0b5abda0ce058957095dbf69a3b0a1ad89aa35cd991ea830795d6729e091f26b16d5488b6cd6acc36e002c87ff23ec1f8aa1df8395772d1d6a30
SSDEEP 192:sxRvJR8b//fca+sPyQ7R7KSzoA8p4+/g6+WNIYlac+eGiIgIJ:sxRvJg//fchs6y7Kff/5ISs
TLSH
T17332B7166E68AD7B8CCBD21DBA657F53D6F91033A0951E48B6FC861C04EBADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 de70a292ebd8fd4e3be7cb7286099b97b26c249c8d3418f5c3f7048a940cb30c
MD5 c8e7ca6a5aa4c0319b71f55e6b2f5af1
SHA1 d66da21346fdf40edfbbbba3662d48b8da997a46
SHA512 d9f3d3576e165f9f83b0bf7227c79e89ea5a76174334adb69ce1e7d7f4acd7d4beeff327299423a62da76145f14edae3bb42254f2e8acb85d9045cc4f53a9bbe
SSDEEP 384:kWdRdcVfCtgSQFffTKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV4A9+mRfXroe2e:ksRdcJWgSwffT8F1+UoAYDCx9Tuqh0VO
TLSH
T128B2E93B644CCB7E4F814AEDDC196F976E9C02C796588D8047FE984C02C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 05321b3da9890b4fda291ee7ea9ade8cfe7daf855c7a8f4d9872eaa1cf7a6142
MD5 cff595166ae68e5d8a97dfaa57ec6882
SHA1 1f3989a2153105a89e92cb4a83e84b299f016a85
SHA512 f589e2566c9b4c633c24294e31fcbaa77de65307109593f1c9b32063f95c176e3e88aba4f19a28c7bb0d285fc1fee4e5cacece30968bf1b7cc356e46901fec4e
TLSH
T196518E50327B6241387D25899174C71F624231B23068EA6FFBB91176CAAFE094DFEDC9
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a514e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a514e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b4bd6659cc31df284a42a8070ffbe2ee1469b7cf2dbe61b5ade91f6db03ecf75
MD5 b7f7e37df898a0e19063a34851d6c5e8
SHA1 653e01e1de8e319fc104991fe6f2585a4f555cc7
SHA512 6765205fb399055aa95073e9ce2b5a60678d50498a3c96e8545f9940bdb090e9ebb3c77cfb626e127ab91a585a907f1a21828629e355648aa55293b499dc58c3
SSDEEP 768:Vi3G+PKSFajatsnqMwQi5BgK5/CwYcZM2sc0:Vi3tKpVmBg8/da2sc0
TLSH
T1E3F2BF31ACF18EB75CFA9244B2877706AFF49113D9C9099894EE5A0D0297DEE030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 db007380b5bf890024e9376ef639e307d19987a184b332664f7aca508723675d
MD5 8b8d83d114f288466b8794a556d503f4
SHA1 ffe0f831dcf052f474a223e8be864f5f37218eaa
SHA512 a5aa83f7b41e23ce66bbbcc6d8e7aea4e4cff0900c1a7df8b4810f40e1e16625ed5b908a67bdb59fc659fdeea1a42a74be9e63fd9dc6722dc72a11f88e79fe47
SSDEEP 768:Qi3d+RKSFajatKnqMwQi5BgK5/CwYcZM2sc0:Qi3UIVVmBg8/da2sc0
TLSH
T1EDF2BE31ACF18EB75CFA9254B1877706AFF48153D9C9098894EE5A0E029BDEE030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 041e60ce3f8f6dc244e8479582411ccee6f2a163bcc66d71b58dd1eeec3940c3
MD5 070c28022e34b78bae76c5db424ab0d3
SHA1 4faac848acaf6d74bb48bc18c6fe13197444ec0e
SHA512 efa96e9206328b7049647ba73b92075fa8e154ad7e08076e032f8279d8696d2a2c4ede8d7e38b78943db6f36bb2bba661f39a9d291c2ad9d225ad15863f308d7
SSDEEP 768:iFQH3owgz+PKSFajatsnqMwQi5BgK5/CwYcZM2sc0:5H3DKBVmBg8/da2sc0
TLSH
T199F2AE329CF4CEBBACBA9644F6877306AFF48163C8D9559496DE5E0D01978ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 50afd51c99a83e14e769e299f4bce00d4cffa246f67a06790644b80df43ef898
MD5 30418ee89661cb8f064f86a7b423eade
SHA1 d7ce37dc4ef12f7a8bf40e9d3003448d0aa8ee01
SHA512 8337e60be925d8f6b9532e78c4a42dad635ee01c0f7fd02f50e6831cea41a2e12a4a4e4de93da25a123348078797f340bb06541e167155dcaccbdedb47d79439
SSDEEP 768:O/UxvxjgC+Ft3/cGSFajatDnqMwQi5BgK5/CwYcln5A8Dea:DZj3+Ft3/bmVmBg8/dZ5A8Sa
TLSH
T12A03C036ECF19D7B8CF69254764A638BEFF451A3C584089849EE1E0E03D7AAC130BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eaa2d9d9-c609-4009-8dd5-21df431e6c13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eaa2d9d9-c609-4009-8dd5-21df431e6c13.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download