be7ea3234a829c4f34ace7ba4cff470f50ac34f9f0b553b5a83b51fcd5960e2f

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/11/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
njRAT-0.html
Size 171KB
Sample261110-dppv3acf23
SHA256 be7ea3234a829c4f34ace7ba4cff470f50ac34f9f0b553b5a83b51fcd5960e2f
MD5 acfa1025f046bb195680d1f6f25488b0
SHA1 0fb8e9658dd4790d90ac497bd4f59901bfae1761
SHA512 9a484cd02e616d49a976339457fccf74e01660020a645669ecc3b6fda6b10f7096a8505504d73029ed06c929028db1f580bb432898ecc206daf092928bd152c0
SSDEEP 3072:U3cdFvWUOapgFnlTE3t/n80NB4G9p+H2WSM4MgwB9WRmH/EeLfWI0tGcQpZN5Zuh:LOUOapgFnlTE3t/n80NB4G9p+H2WSM4P
TLSH
T1BA04B5B1B035A53E022F26C6E2B1671493E7E31BDA8966F5D52FC2B452C7CD8FA53048
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2968	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{E7CC417A-8289-445E-BF34-05ADE0388636}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5844 wrote to memory of 1032	5844	msedge.exe	80
PID 5844 wrote to memory of 2968	5844	msedge.exe	81
PID 5844 wrote to memory of 5068	5844	msedge.exe	82
PID 5844 wrote to memory of 5068	5844	msedge.exe	82
PID 5844 wrote to memory of 4324	5844	msedge.exe	83
PID 5844 wrote to memory of 4324	5844	msedge.exe	83
PID 5844 wrote to memory of 4324	5844	msedge.exe	83
PID 5844 wrote to memory of 6072	5844	msedge.exe	85
PID 5844 wrote to memory of 6072	5844	msedge.exe	85
PID 5844 wrote to memory of 6072	5844	msedge.exe	85
PID 5844 wrote to memory of 4868	5844	msedge.exe	86
PID 5844 wrote to memory of 4868	5844	msedge.exe	86
PID 5844 wrote to memory of 4868	5844	msedge.exe	86
PID 5844 wrote to memory of 2528	5844	msedge.exe	88
PID 5844 wrote to memory of 1136	5844	msedge.exe	89
PID 5844 wrote to memory of 2528	5844	msedge.exe	88
PID 5844 wrote to memory of 1136	5844	msedge.exe	89
PID 5844 wrote to memory of 1076	5844	msedge.exe	90
PID 5844 wrote to memory of 2376	5844	msedge.exe	92
PID 1076 wrote to memory of 3456	1076	msedge.exe	93
PID 5844 wrote to memory of 1872	5844	msedge.exe	96
PID 5844 wrote to memory of 5944	5844	msedge.exe	97
PID 5844 wrote to memory of 2308	5844	msedge.exe	98
PID 5844 wrote to memory of 5220	5844	msedge.exe	99
PID 5844 wrote to memory of 5220	5844	msedge.exe	99
PID 5844 wrote to memory of 3464	5844	msedge.exe	101

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\njRAT-0.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x284,0x7ffdc2abc188,0x7ffdc2abc194,0x7ffdc2abc1a0
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,344842358474347398,17209841387594546725,524288 --field-trial-handle=2180,i,17820968526199628372,7783025880208819087,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1376,i,14195344760423133334,17176158975680845760,524288 --field-trial-handle=2180,i,17820968526199628372,7783025880208819087,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:13
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,15827520070136842411,7307191670054964179,262144 --field-trial-handle=2180,i,17820968526199628372,7783025880208819087,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,12539963739699117710,11714241141891948342,2097152 --field-trial-handle=2180,i,17820968526199628372,7783025880208819087,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,120589767327716058,10765315520897909108,2097152 --field-trial-handle=2180,i,17820968526199628372,7783025880208819087,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,343117471735175463,2352886312408515251,524288 --field-trial-handle=2180,i,17820968526199628372,7783025880208819087,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,17716654323533812748,1223547537645718107,524288 --field-trial-handle=2180,i,17820968526199628372,7783025880208819087,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,10029346483195052561,13232322351054322071,524288 --field-trial-handle=2180,i,17820968526199628372,7783025880208819087,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,17453957070587549243,9531334178045886127,524288 --field-trial-handle=2180,i,17820968526199628372,7783025880208819087,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,17453957070587549243,9531334178045886127,524288 --field-trial-handle=2180,i,17820968526199628372,7783025880208819087,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,12614601207673020503,10944011117567007412,524288 --field-trial-handle=2180,i,17820968526199628372,7783025880208819087,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,14998754436778252994,9852092482642705940,524288 --field-trial-handle=2180,i,17820968526199628372,7783025880208819087,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,12342282746278081422,3891972988367981183,524288 --field-trial-handle=2180,i,17820968526199628372,7783025880208819087,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,9754618743101663299,9205226579734828029,524288 --field-trial-handle=2180,i,17820968526199628372,7783025880208819087,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6200,i,6209935166537662036,9126798341719812310,262144 --field-trial-handle=2180,i,17820968526199628372,7783025880208819087,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1615dd21-be5b-4ee0-b7b5-5fdf42e353e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1615dd21-be5b-4ee0-b7b5-5fdf42e353e5.tmp
Size 27KB
SHA256 315f3c865140f70e2932304b1df49763837569b3e7d91b33ef107709c48d4672
MD5 ff46d144bc727592733a8c72f501df08
SHA1 ed3c1e63096ffc7f282ad534ae55bfb1ba570a51
SHA512 cb5b3c8358a4f1810b9c6c1382e7a15cb445939326e2b07defebfe66b4cf86c791120d0ad7133fd682faebae464c3fbcbde73f205566e2215d3e0dcf2857c629
SSDEEP 384:n5iFVQkUSvy38Nc8TUNTUlIR2vCC7jJcxzyfoBj+d8qr1chGp+jCvtvaTZcsHMgA:QFvy3nwgRCZWdBsC0pMAtvaTZcsHrL0
TLSH
T19DC25B32E8A4DDABEDEB8ED5A74E3647DEE04113C98C9AD4D5C94D1D00CB19E134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5720c85d-6156-4aa6-9021-6031f93acf59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5720c85d-6156-4aa6-9021-6031f93acf59.tmp
Size 27KB
SHA256 5be7d3ad61c255fc1b29d2700d436a824f01e55a87e9de8ab44a74b6f587ef2d
MD5 c9922a68f6a7cfe43622cb1858c92473
SHA1 4af5dabef041e4e47a266b48a4a54c4a96aca039
SHA512 8cfff92862a89d6399b3ff8c4203e4c4384459aced3d9286fdd9a334116f00c83482dad76b8c258ff10232b8285defffebc99812f5173051653b15b49f9de529
SSDEEP 384:nKiFVQkUSvy38Nc8TUNTUlIR2vCC7jJcxzyfoBj+d8qr1chGp+jCvtvaTZcsHMgA:BFvy3nwgRCZWdBsC0pMAtvaTZcsHrL0
TLSH
T1D5C25B32E8A4DDABEDEB8ED5A74E3647DEE04113C98C9AD4D5C94D1D00CB19E134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63341d97-37a2-41aa-8d36-edb65c37cdc7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\63341d97-37a2-41aa-8d36-edb65c37cdc7.tmp
Size 26KB
SHA256 5a53e82db1572038fa06ee02114eef437cd882481e05778ac060983fb349f780
MD5 1e325ec038232b99de4cb8a09d84f1b8
SHA1 2667334281c56bdbe54373c5235c2c1157235be3
SHA512 845a926adb84f327436229ad2c820ef6e62c3a7046a7e48a974d611c606fa38305b36c9415aa023c53053675082a73d0d4eef89fdf1ce4d9f474b0e99aa930d1
SSDEEP 384:nJiFiZcI638NQ8TUNTUlIxBCC7iFZxzyfoBj+d8qr1chGp+j/vtsa+VYEd7U1gLg:gFQ633wgCCe7dBsC0pMHthgbRg
TLSH
T177C25B32DC94C9ABECEB8FD6AB4A7603DEF04163958C9AD4D5C84D5D00DB59E130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69eab570-3116-4754-bd42-91afea26b15d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69eab570-3116-4754-bd42-91afea26b15d.tmp
Size 27KB
SHA256 664f849eaef69b349d7d27cf22985b65cf9290a974cd5109c53f31e2fb727079
MD5 c43bd91556b2ddf1ead77c2796504e5e
SHA1 074368883ac58d49cc7431b70f142ef0f574ab89
SHA512 5439e2421cb6136a7816267477934dbdb849bacecdb64480ff2996ea6d98b1ac913cbf333e9ff3b95d3ef1966eea44e16cf310496c7b9a80f4e08d88354f91d9
SSDEEP 384:n5iFzQkUSvs38Nc8TUNTUlIR6vCC7zJcxzyfoBj+d8qr1chGp+jCvtvaTZcsHMgA:QFds3nwgRC5WdBsC0pMAtvaTZcsHrL0
TLSH
T159C25B32E8A4DDABEDEB8FD5A74E3643DEE04113C98C9AD4E5C94D5D008B19E134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8615613e-4347-41cc-a06a-c3a721e8df4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8615613e-4347-41cc-a06a-c3a721e8df4f.tmp
Size 27KB
SHA256 316a7cdd9b30e39b58f9774e00c52eea61ae965aac4ff0065765f109b7b3a294
MD5 896297c8888bcb7cf435d6713e25ace3
SHA1 f6bd93be4adc8128612379c7bc0f453eda27040a
SHA512 1b1bcb80af2733ebf63ac788fd3c768888b5bf000d930b26d8dcacbb494523a4be882385c9989cd359892870cbffb019793235b22adbb2eb667b5786ef712e24
SSDEEP 384:n0iFVQkUSvC38Nc8TUNTUlIR2vCC7jJcxzyfoBj+d8qr1chGp+jA/tvaTZcsHMgA:PFvC3nwgRCZWdBsC0pMqtvaTZcsHrL0
TLSH
T1ABC25B32E8A4DDABEDEB8ED5A74E3647DEE04113C98C9AD4E5C94D1D00CB19E134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fd53d4e341ca585361bfbe699a2c8a3fdbc255133db935051b0958a30a7abf
MD5 e720824e80db33ac2843bf1ebb30faec
SHA1 f511d38f1de46ab026d3c6963050a3f1f512b92d
SHA512 09eb559f6018245581b30678d5f9952fcadb0adcee197127c7448f39c53ff841dddd8b077678d837d33d8e01126c7d80b7ec77764938cb5368f955ce628ed81c
TLSH
T1E3D02B5CEFD99290D436343A4035428531CFA904D1035200E090010319811410061865
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ef8e0a91cc3656fe639527b7c461215de3584a9b32168d8efc58c800c3fcf45a
MD5 7611be076e62556d26aa1ad65d6c21ee
SHA1 3b62033283275e165c1cdb998b2b174841695892
SHA512 949a38fce52f98059e4356f1465fa0cb57397b5b5a79c468fea50c81a884f46ee37ab38ecf492df88f7280e9e041eedad365f8eab019be95f1d7b37d95794929
TLSH
T110D02B58EFD58290D432343A4075428532CFA504D1035200E0D0011319C11410061865
MD5 SHA1 SHA512 TLSH

Submit Download

0fa69ebd-f94b-41ca-830c-4be06e53fd7a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0fa69ebd-f94b-41ca-830c-4be06e53fd7a.tmp
Size 414B
SHA256 b130b6e0f1798c0cb3b355cd99d758ed05f36036c68e4db8d6565bae9dabe588
MD5 bd56fc12f8f65d761a360637fc61cfd2
SHA1 817282733f32bc9807cd85abdfa000e8426e6457
SHA512 80e4ded796a44a3a3cc01c31715482f25506b6ed9b4bb3756483af4a61c86e72f4ce6c92a0a88a24a1778dd2f6d58a51c7c219d22c62eb2a4853ffbb87a0c819
TLSH
T17BE02BA9C821BC3B18FE172D24541B4AFA5413572B50844F3A3CC20C9FB563A8185D5C
MD5 SHA1 SHA512 TLSH

Submit Download

31468903-ca27-4942-8d92-65436c254ace.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\31468903-ca27-4942-8d92-65436c254ace.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6043ac8f-eacc-4ff8-95f5-ac06503ba67b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6043ac8f-eacc-4ff8-95f5-ac06503ba67b.tmp
Size 12KB
SHA256 db34677d369ff4acc36c20b6210562bc7a4ce3f52d26646d9328142f271a9e5d
MD5 1ed892549d9b4ce5e8716a025257316c
SHA1 0ea023f582cbf3fea442730a2c1ab9aecaeca0a0
SHA512 cd1013a1514f6e364d96f31ed6948beb9c0489d492e27ea021b98e1e642351229da5e7401cf8d565b9471560bbacf5d177670a0795adcf3b9b24118fe69c88b6
SSDEEP 192:sxZ4R0Fi/fXsw3kI1ZqMqJzodpEi/W6+WNGY0g7k2wuR4+Ig56KJ:sxZ40i/fXsKh7qyT/bG5Qs43AG
TLSH
T12C42D8156D24A93F9CCBE619BB55BF53D3F9543250901E48A6FCCA2C10E76DE220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0600c11b-b1ef-45b0-a638-444408a07b90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0600c11b-b1ef-45b0-a638-444408a07b90.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

1373dcd9-c138-4280-bc4d-c30fb8374beb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1373dcd9-c138-4280-bc4d-c30fb8374beb.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

9c5591c9-19e8-4d00-aab6-6090791313e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9c5591c9-19e8-4d00-aab6-6090791313e7.tmp
Size 2KB
SHA256 df394784096124c768718fcdcf449210ab64104a082b67cd1ddd452f99ce7f6a
MD5 a0e012fc046b2adef575884bc9ab934e
SHA1 95c0093687a3cebaa6d972fcb6abeff14ab46c8d
SHA512 93be7360bf8b50e0707abaa39613987d86aa1c5d39e60d1ecb5bed886d76808144d2612a24e8d5e3415c915d1aff5b4d03758d175e9ef90e82b637fbfe990771
TLSH
T18B4191F783F4466E8A0155F0EA18AE2BCE2D0516832C7C5989F4AF2B97F2471D14165F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e7e4fbb21e0acee55a00871f465f38974c61ba892419344d1fc05fe97e2556fe
MD5 191402ea992d5a219486d60d8c10b714
SHA1 8592ddffb0d5f5ff81cb15e586b3b1d2d3cc0d96
SHA512 7695f168b8e0f7cc17ae1650e502024e3011de4e356b65ebc9ff7343ea42e89c194e01db412395d77499770289f9b12cf2181f0b0fe3fc21da5cdc98e50c646d
SSDEEP 96:K4JaKygi+ZSKiIX6cKTKE+9eKOUV9eKukoWtGKEgrhOKKQk6QgKFKWDCK4AiyAgy:ohdNdBzXXFPXgRbKvtp0JlzngdVq
TLSH
T1BEB2545030BA12593CBE290891B59B2F528131B3711CE62B7FFD50A68E6BE485DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ae09fcd7-10fc-4822-a96d-41e80042f7f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ae09fcd7-10fc-4822-a96d-41e80042f7f7.tmp
Size 12KB
SHA256 337d5d5d646107b19548dac7077ed7b02925d1bf7e6b3ce4a4827a5bc25a2501
MD5 3d358c1954b6d3ffd4e7ff8015c0b161
SHA1 2f8e44ff33aa1cc592ef81bd64e31fe5953f9ed0
SHA512 5aeae5215c0a5ba3adbb3065c5bb87b2f23305f7db7cf07144dd7a8c372b28a80dbf5eb86174fe7bf299e637c6a344e6feb56ee12b8805f1457dc6ecebee2fdc
SSDEEP 192:sxZ4R0Fi/fXsw3tI1ZqMqJzodpEi/W6+WNGY0g7w2wuR4+Ig56KJ:sxZ40i/fXsKy7qyT/bG5QQ43AG
TLSH
T13642D8156D28A93F9CCBE619BB55BF53E3F9143250901E48A6FCCA2C14E76DE220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de23911a-ebf0-4d69-8377-3fe1caa59bb6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\de23911a-ebf0-4d69-8377-3fe1caa59bb6.tmp
Size 11KB
SHA256 c14b9aab8117e17bb79eb2c2c72ceee25194d8f7c767e38b66dadcb382e49a8d
MD5 e1aa606aeea8695d253f8bdecafc078a
SHA1 4a5c2199180c238b1b90483896a9345dd219d0ef
SHA512 0d28f21a24e585d3d9bf2f105c0e5f1cb580bd11514f0f6bf97d7abd01cdee9638b73d3d2a1f50d9df873f65277a710ae9281b2a9597cb6c90bc8e16ee507950
SSDEEP 192:sxZ4R0Fi/fXsq3tI1ZqMqJzodpEi/W6+WNGY0g7wCwuR4+IgjKJ:sxZ40i/fXs8y7qyT/bG5QK43jG
TLSH
T19142D7156D28A93F9CCBE609BB55BF53E3F9143250901E48A6FCCA2C10E76DE220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0d3c868-c92c-43f9-b338-eff441bc9b01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f0d3c868-c92c-43f9-b338-eff441bc9b01.tmp
Size 28KB
SHA256 fab72c4fe3c99ab9934eee2cfcc91283a80567fca7823fdade8be2534bb752d6
MD5 6c4e55d79d9c24e573bcbfa1c93df27c
SHA1 4d5967ef799200ed9ffea00654c29a39439ccd29
SHA512 bfcfb3540a21332267332106fb17852b74ca0e61d49f727a7f20d1f446e070d8423dd743951d3689bbf687051d4d0a4dc8c5a5547cff96d7b46235aa0a4197e5
SSDEEP 768:AvmgC8Ba29tWRmpbQPL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3HgLl/jR0sVYroTN:AvmgC8Ba29tWRmpbQPLu1jaKHgLpj+sH
TLSH
T127D2093B640CCB7E4FC04E9DDD266F966EE802D7AA588D4047FA894C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df61b869-7313-422a-bdbe-04db8154f888.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\df61b869-7313-422a-bdbe-04db8154f888.tmp
Size 25KB
SHA256 2f928516abf1f8b3849ffc9b2d8c5357e52efe4a4248d0170ddb8aeb298b65e2
MD5 80a2d536ec48df6e1818b74746dc328a
SHA1 6c9d4b7f9c349f95a7193c9a8810f65f9d775717
SHA512 69594a0264497e0311b9b86300f5a17fae578fda1e2f3013456f628de6514891e75209a27c66afe33189a3c837437eb4af959ac8d5b4ba81fb0269842f36945c
SSDEEP 384:nviFiZcI638N+8TUNTUlIxBCC7J8xcxzyfoBj+d8qr1chGdQzysa+VYEd7U1gL/I:6FQ63BwgCCqxWdBsC02WhgbRg
TLSH
T1CCC24B36EC94C9BBE9EB8FD6AB4A7613DEF00163959C99D4DAC84D1D008719E1307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2376-262-0x0000025D3D3B0000-0x0000025D3E3B0000-memory.dmp

Download