3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 20:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20260930-527357-rzxbvl.html
Size 171B
Sample260930-y48xpssx2q
SHA256 3e10b452175f0acbfcda6bc2487e308e0c5f4913f1ca5b0ed77be7a462a066bc
MD5 e082ebc14f6b24945336f6450b985e45
SHA1 df12ad35c265b0198582e2dc94e0a93048e4de82
SHA512 8dac8fb7101ee6a50ec58409a7d51009d9a3f6b1266377cad6f7f9001bc6f6734ffc067e7cfd0f17a1d0e288803fa8c8d37925590f6421772323ce99a4a9a1bf
TLSH
T1E4C08C7D10C13C150270A93C1DD3B397EC93198E01422B41308180232F35620CED32D0
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5704	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{BF463747-9143-4FBE-A2F8-C0DE34CA8513}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5152	msedge.exe
5152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5868 wrote to memory of 5744	5868	msedge.exe	88
PID 5868 wrote to memory of 5704	5868	msedge.exe	89
PID 5868 wrote to memory of 3228	5868	msedge.exe	90
PID 5868 wrote to memory of 3228	5868	msedge.exe	90
PID 5868 wrote to memory of 3228	5868	msedge.exe	90
PID 5868 wrote to memory of 5648	5868	msedge.exe	91
PID 5868 wrote to memory of 5648	5868	msedge.exe	91
PID 5868 wrote to memory of 3292	5868	msedge.exe	93
PID 5868 wrote to memory of 3292	5868	msedge.exe	93
PID 5868 wrote to memory of 3292	5868	msedge.exe	93
PID 5868 wrote to memory of 1404	5868	msedge.exe	94
PID 5868 wrote to memory of 1404	5868	msedge.exe	94
PID 5868 wrote to memory of 1404	5868	msedge.exe	94
PID 5868 wrote to memory of 5720	5868	msedge.exe	95
PID 5868 wrote to memory of 5720	5868	msedge.exe	95
PID 5868 wrote to memory of 5720	5868	msedge.exe	95
PID 5868 wrote to memory of 4872	5868	msedge.exe	96
PID 5868 wrote to memory of 4872	5868	msedge.exe	96
PID 5868 wrote to memory of 4872	5868	msedge.exe	96
PID 5868 wrote to memory of 3024	5868	msedge.exe	98
PID 5868 wrote to memory of 1924	5868	msedge.exe	99
PID 5868 wrote to memory of 3024	5868	msedge.exe	98
PID 5868 wrote to memory of 1924	5868	msedge.exe	99
PID 5868 wrote to memory of 6124	5868	msedge.exe	101
PID 5868 wrote to memory of 2800	5868	msedge.exe	105
PID 5868 wrote to memory of 2884	5868	msedge.exe	106
PID 5868 wrote to memory of 1212	5868	msedge.exe	107
PID 5868 wrote to memory of 5284	5868	msedge.exe	108
PID 5868 wrote to memory of 5284	5868	msedge.exe	108
PID 5868 wrote to memory of 5152	5868	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20260930-527357-rzxbvl.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7fff2e35c188,0x7fff2e35c194,0x7fff2e35c1a0
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,3130891038058403202,18371793842051459078,524288 --field-trial-handle=2336,i,14067160580162651564,4821373208987709183,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,16876611086443003203,18267329090906222443,262144 --field-trial-handle=2336,i,14067160580162651564,4821373208987709183,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,14124777950965867718,15680826741211593931,524288 --field-trial-handle=2336,i,14067160580162651564,4821373208987709183,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:13
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,11096027004728052160,932622666410983863,2097152 --field-trial-handle=2336,i,14067160580162651564,4821373208987709183,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,10801502052575734615,16998028141633821062,2097152 --field-trial-handle=2336,i,14067160580162651564,4821373208987709183,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4372,i,2179234476096180838,3196780741670135906,2097152 --field-trial-handle=2336,i,14067160580162651564,4821373208987709183,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,299542324796231012,15894443578751668667,2097152 --field-trial-handle=2336,i,14067160580162651564,4821373208987709183,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:9
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,14464392654110431757,4489896276909091613,524288 --field-trial-handle=2336,i,14067160580162651564,4821373208987709183,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,15236018565918554348,7708468007576324234,524288 --field-trial-handle=2336,i,14067160580162651564,4821373208987709183,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,7701616853565632047,15993828712111602532,524288 --field-trial-handle=2336,i,14067160580162651564,4821373208987709183,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,7701616853565632047,15993828712111602532,524288 --field-trial-handle=2336,i,14067160580162651564,4821373208987709183,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,5867200512226101973,14725007853815979050,524288 --field-trial-handle=2336,i,14067160580162651564,4821373208987709183,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,17776121655873662778,8198298465948216872,524288 --field-trial-handle=2336,i,14067160580162651564,4821373208987709183,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,11879082046603626536,8965170676403576844,524288 --field-trial-handle=2336,i,14067160580162651564,4821373208987709183,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,14349926948854844799,10077998375821798138,524288 --field-trial-handle=2336,i,14067160580162651564,4821373208987709183,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:14
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=832,i,7863279981047670694,14262616650528000894,262144 --field-trial-handle=2336,i,14067160580162651564,4821373208987709183,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 998f2abae9b354c1aa7027c70a0a68c556f64ed2acedba253ec7da012ab62072
MD5 967c92ab30d904a5207a58bf1a25d5c1
SHA1 eec1f76283f2f06525e1092fe64aa985bdf3b98e
SHA512 dbcdddefa32164f92b184cdc4c01bbe0b42a023edd2599fcdf57847e051ec14dd7d5fabc2d308b5ae74bf55205e8d5904cee644208af10538a6070282be7a634
TLSH
T16631DD8CFFA864E6F3A8057140CA3B5BF634ABE1D9CB1F0A146DC5FE9B467200100396
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 762b76322543c75178d36d29e73df89a30159e3ac222f5fb7a968e43b8fa053e
MD5 95007a9bb85a9c75649da706cd29c8c7
SHA1 1afaa8f83f5bff4ace0667f0ba63698683c9bdeb
SHA512 9a328e436aef4cee081880662ade661eaf784b520f31624f8d2eff2f1f7147a276296194f35e66944083358c20ef11adc7673adf9f2d8e74edf72447fef5e247
TLSH
T19441AFF7C7E8867D8A0156F4AB186E1BCE1D0955832C3C5AC8E49F2B93E24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8c3ab0595e6baaa9fa5f6ed02dd2799d3a7b2fa835f53dba1bf676a32b224212
MD5 bfdcb6da2a069028e061fe9e611147fc
SHA1 8820c7193f723e2ebc039937a0176b59a1e2e94b
SHA512 16aab8789eb3a3adc1e8e43c7ebc886a7000ca7cad951f1eccbdf4e4bd5c8581b6d4804047ee3efac4036cba4b327f8dc5ed305e07a9ed9c3148172d1d104530
SSDEEP 192:sxRb6RfbZ/fpEsdloK7xC4gzoA8p4p/g6+WNIYDFLGqIgIJ:sxROlZ/fGsd26ogo/5Iks
TLSH
T12E32C8159E68A97B8CCBE21DBB65BF13D2FD5133A0901E48B6FC861C05E66DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 42de223321711b685217c0dfcfe09eeb1a95d8dbbdf4912b276c99bdf5c4c028
MD5 cbbf979d539dac58d291bac482d74779
SHA1 678f9c780c14b97fcedf96949cc4dde6c8e2ef35
SHA512 871dd56e089cd0890ff15e30910804d4b111b8c41966401e78456d7aa2c76d4102d2e153c2dd146d2b08d428f9af7dc9e948f5698f7d87978e332097b7198e4e
SSDEEP 192:sxRI6RfbZ/fpEsARoK7xC4gzoA8p4p/g6+WNIYDuLGqIgDyJ:sxRNlZ/fGsAy6ogo/5Ila
TLSH
T16D32B7159D68A97B8CCBE21DBB55BF13D2FD5132A0901E48B6FC8A1C05E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ad4c90b50cbdfb978b8a78b74ee5d5506dd6ba1b1962a064bf5821ca9212d4b8
MD5 aa7facd4ec9ea060942c70fab81f86d9
SHA1 6f46a45cec2e44ce343b2ee8a192261ed1c981ba
SHA512 4a9005d9cda5efddf19062c74f36fe9ec9d73bb377d223774bc1f9ffc2a2bfe5a3fce4b280c408db80f0933803ae83b07fc525db0a23a90e0f242d645536e038
SSDEEP 192:sxRI6RfbZ/fpEsAloK7xC4gzoA8p4p/g6+WNIYDFLGqIgDQJ:sxRNlZ/fGsA26ogo/5IkQ
TLSH
T1AA32C815AE68A97B8CCBD21DBB55BF13D2FD5132A0901E48B6FC861C05E66DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 3ee52a18b58cd28b7ea79f34eda93e3531ba8740b6031b03f1cc61910241fbd5
MD5 11d216c33af63aa20035277df4cdc61b
SHA1 0fb90119aada97c956181dda1d166645a6563f93
SHA512 8e168c47d3d0ccf589ee298059522586d137ff2b139731d2c415f978e4e087b1bd838bd34fc17b2bc1aea1285ce5a775c79fc7a2293c8c2e343385dbd8d693e5
SSDEEP 384:ScwYbpGfCtgaEFfA6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVO+9W+R9AroTyL:SzYbpUWgasfA68F1+UoAYDCx9Tuqh0Vj
TLSH
T13FB2CA2B640CC77E4F804AADAC196F977D9802C796988D4047FE995C03C77EBA11E4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 945056ff1bb5459caa8c282db532686310751fd69c8d8b7dbd6bf0c079529216
MD5 abedab412c00b00f30c776207b7b74ef
SHA1 1071cb6ad2c9bcad2c882a0df3afa6115265829a
SHA512 0d6e14c5f9340209bf904cfa1b2200a0ebece476ac2a9341f676063164cddde06498c2a8b4631dbabcfb734cc415975b20577c726f7580cbc63e6ceddd94210b
SSDEEP 48:KYfIlKI8MHyNfIFKc0YsTI1KEsQryVrI9KQ0oj5U3T5q:KYfKKI8u+fGKc0DTqKEs+GrWKQ04
TLSH
T1D0C1C2107A7E020039BE290981B4D72F11927773745AE63B7F7C40A59A67E086DFCCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f2fc3ff7-7133-4e59-b340-37feb5ed248e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f2fc3ff7-7133-4e59-b340-37feb5ed248e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 330b9fd1445b31334e8baa3dd3a6eb1d04c23e08480fed659557c7adf908b950
MD5 b1aef1d96f35e169e5e16a69a7ee3b04
SHA1 69e4d39209114bd12886bde75cea34c4ec3082f0
SHA512 2d61ee590f8a0927c0dc7c2137490c760aeed84f5c7d0791d0ed0999451b0d870703028356973901bc837a4af9f65de1660b7f844065c7058c0a65fd668bbbf8
SSDEEP 768:br3lgoSybNbwbxOeRFZD1fTos7RjG2scz:br3WNOY1fT/RK2scz
TLSH
T172F2AE36F8E45DB34CFAE244B24AB6427FF45563CAC9558844DD5F0E058BBAA034BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1d9b53b437553cef33c331ced705f01124ce3e8127e023d13f8a5a396ba623c3
MD5 e3062db9225e5429a9c5da72e91ca615
SHA1 0497ca7cc97123f05637bd3cd628921576af0cc2
SHA512 dc6c0a71b6a68a5ba03572ed9b89fe926372966d66d5e3fa64cc014a352ca944727e08eb7a8982587129f122b0d55a6c6a176b266193d43d0fa2c49dcf745e78
SSDEEP 768:+/UxvxjgC+O3YgdSybNbwbxOeRFZD1fTos7RjGKNp:zZj3+O3/wOY1fT/RKKNp
TLSH
T1CD03BF3AB8E46D738CF6E244B24A7787BFF45563C9C9189849DD5E0E09CBBAD0307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 4efefb58ee1aa1a7d58e09f938459fb1aecadab55b4faf3bba3f0b3d84bb6412
MD5 0b7533b7e7af60e5b84e83f019a5aed8
SHA1 f99219272fdb94be03b7ca1a52cb0139fa7086f7
SHA512 aa1a66a72701220022cc4aeea1496c876dbcb6a16c41344fbac27c1b5aed4cfef0a48672295b2a4f1840553e0bfc952704b687f98187f01a6e19e7e03714e22b
SSDEEP 768:Wr3YgoSybNbwbxOeRFZD1fTos7RjG2scz:Wr3/NOY1fT/RK2scz
TLSH
T154F2AE36F8E45DB34CFAD244B24AB6427FF45663CAC9558844DD5F0E058BBAA034BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 db0e185fd9fa8ebb94ce73bf534e7acba16223059d6b3aead9a55bf87475b1d6
MD5 91080013ba95445fe58de7e968b4b7ef
SHA1 3045b1afc8b4af71e5f59a85ff6397eb287ebaae
SHA512 4da312adde40e15175e5ed4f58902556be26d19e025cd21a2aad96e9a6c404e9d138e469a9198da397697fb23bcaeb7900633c8627c598da4a616fe00fd65ed8
SSDEEP 768:1FQa3qwgYgoSybNbwbWOeRFZD1fTos7RjG2scz:Ua3kNjY1fT/RK2scz
TLSH
T164F2AE33E8E48DB79CFAD784F24A7602BFF45163CAD9958895DC5E0E0187AAD034BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 c94207521e5aa58ce794d0008857ae86f015c9faa0ca59b5f90cdefb46578e67
MD5 03c974be8c66e3d657cddb179a2ede15
SHA1 10fe6352acc7f748f108ef227add30e500262b78
SHA512 b89e2c3a0f05b260e8124219e05638bea54405cf34f9a51b5d4e50d683a286683c4c834644804c2d2bf311df8940d089eda5e9afdeca3b932b966c526e3259c7
SSDEEP 768:z/UxvxjgC+k3z0pybNbwBOeRFZD1fTos7RzL/+Pu:GZj3+k3zS+Y1fT/RPKu
TLSH
T13D03CF3AF8D46D338CF6E244720A764BBFF415B399C91A9809ED6F0E158B79D1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

611565fd-1f2d-4f38-b6dd-238d110688ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\611565fd-1f2d-4f38-b6dd-238d110688ce.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download