bf94319124c967db4a5736efb042ad37b9030dc874f6692b7965eea0df823a23

Analysis

max time kernel
148s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MbpsJohnathanAPDFFile.html
Size 5KB
Sample260516-xdarjsbz2p
SHA256 bf94319124c967db4a5736efb042ad37b9030dc874f6692b7965eea0df823a23
MD5 32d91a5bb8fd068271a573bc9eb1f548
SHA1 c8d1b32b488b8314740518bfbc0ae95e1562c2c7
SHA512 76dff92997396b38fd5ddc34db5913e0d6e3fca3a8e33a6565d86e0314a636b8263a1d54dcbc7daba9183131ebfc3cc1f65994e578e6da65a6b1937bd311f54a
SSDEEP 96:PNyXQtoXZzIEb0EaW87QQKdvCSbPbdJCd33QIeJH8LlOnTdbScYzueh8Eblmw:PNwQtkCBoC3lpEcLl8wlyxw
TLSH
T19DB13CF35C32502B97BA2BF250777318C3326046AF05D19AE688D71CC2D8F8F4155689
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2312	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134236934582006422"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{23C6E706-C4D1-4645-B931-8F942F0306A9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5252	msedge.exe
5252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
996	msedge.exe
996	msedge.exe
996	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 3288	996	msedge.exe	81
PID 996 wrote to memory of 2312	996	msedge.exe	83
PID 996 wrote to memory of 3572	996	msedge.exe	84
PID 996 wrote to memory of 5948	996	msedge.exe	85
PID 996 wrote to memory of 3572	996	msedge.exe	84
PID 996 wrote to memory of 3572	996	msedge.exe	84
PID 996 wrote to memory of 5948	996	msedge.exe	85
PID 996 wrote to memory of 4848	996	msedge.exe	86
PID 996 wrote to memory of 4848	996	msedge.exe	86
PID 996 wrote to memory of 4848	996	msedge.exe	86
PID 996 wrote to memory of 3364	996	msedge.exe	87
PID 996 wrote to memory of 3364	996	msedge.exe	87
PID 996 wrote to memory of 3364	996	msedge.exe	87
PID 996 wrote to memory of 6044	996	msedge.exe	89
PID 996 wrote to memory of 6084	996	msedge.exe	90
PID 996 wrote to memory of 6044	996	msedge.exe	89
PID 996 wrote to memory of 6084	996	msedge.exe	90
PID 996 wrote to memory of 5560	996	msedge.exe	92
PID 996 wrote to memory of 1048	996	msedge.exe	93
PID 1048 wrote to memory of 4932	1048	msedge.exe	94
PID 996 wrote to memory of 4728	996	msedge.exe	97
PID 996 wrote to memory of 5032	996	msedge.exe	98
PID 996 wrote to memory of 4560	996	msedge.exe	99
PID 996 wrote to memory of 5276	996	msedge.exe	100
PID 996 wrote to memory of 5276	996	msedge.exe	100
PID 996 wrote to memory of 5252	996	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\MbpsJohnathanAPDFFile.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffbb86cc188,0x7ffbb86cc194,0x7ffbb86cc1a0
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,3110712418912205972,13276648819659625407,524288 --field-trial-handle=2308,i,2564863389228775953,377764604979312886,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,1188580688809436497,8181128288204428092,262144 --field-trial-handle=2308,i,2564863389228775953,377764604979312886,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,17816426249070103874,17463319828771944976,524288 --field-trial-handle=2308,i,2564863389228775953,377764604979312886,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,7746481886258407932,16887869424939871932,2097152 --field-trial-handle=2308,i,2564863389228775953,377764604979312886,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,15095807913801983512,13405270779820461772,2097152 --field-trial-handle=2308,i,2564863389228775953,377764604979312886,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,7623950988396341540,6178843658477755768,524288 --field-trial-handle=2308,i,2564863389228775953,377764604979312886,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,1816450463861517656,15069830317697768899,524288 --field-trial-handle=2308,i,2564863389228775953,377764604979312886,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,1671975664941808109,1927137199351077084,524288 --field-trial-handle=2308,i,2564863389228775953,377764604979312886,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,1671975664941808109,1927137199351077084,524288 --field-trial-handle=2308,i,2564863389228775953,377764604979312886,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,3068747218908485178,796621059841108185,524288 --field-trial-handle=2308,i,2564863389228775953,377764604979312886,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,1206102902911022756,6922795980444219921,524288 --field-trial-handle=2308,i,2564863389228775953,377764604979312886,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,9831239027036725730,10086126528813521438,524288 --field-trial-handle=2308,i,2564863389228775953,377764604979312886,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,10239486383948621190,5671028847167673243,524288 --field-trial-handle=2308,i,2564863389228775953,377764604979312886,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,3837891289276908109,980260788973883947,524288 --field-trial-handle=2308,i,2564863389228775953,377764604979312886,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5892,i,584762200354021739,4301023210478363229,262144 --field-trial-handle=2308,i,2564863389228775953,377764604979312886,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 10ee015d29741fe94af81d0a6535c5b3f782e97ad971fb734314cc5460f3ee15
MD5 af70c74fd623569a6886845df808c7b0
SHA1 7283b96e2f363cbc77f18528037083c05d35df01
SHA512 1989349535147875e0917a7a35fd2cb1e1e741f5846462d938123b7666835145a4ef31f8ab92bc28673bb22a4f5729a6332b08190fb5ceef7804d0088c45f52d
TLSH
T193E02BEACD21983B09FD271D60546745EB0413971B414A4F3B3CC1088FB163A4685C7C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d4887e1763c5052e8bfad152b471390f3549e9519d89f04bffc0d7e45268ac2b
MD5 3aa4868d05cd35bb1ec90f59894f315d
SHA1 24fc70bacaaf3c8e62ac1bf69053669107ae720e
SHA512 22428195e787fe997ca20bbe7ae96b81fda94bd4322751628760719a8a9baba882a75a75f2393e259ac7a2c016475397314322ede033100a15f8f81d443cb3a3
TLSH
T18C4191F7C3E8856DCA0195F0B618BE2BCE2D0914432C3D5AC5E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bf476cb669baf16a590b953fcb5ad94a80c3dfc1cd7d96451acb62cf9b74494e
MD5 6ce5e05bbd1e27748d3fa2d4e03f5765
SHA1 7e4390927c3cbfd5e740b9a5462212c40998d074
SHA512 7b88e685df1a175a579af8281a422488d3d732fb83507053b5b81c37e88c4b3ca56aa75a08bb84f164682685789aa7dbb3211f4dda60eb04f88641618851a15a
SSDEEP 192:sxZVRjyMqZjK1Ml8UQuF2/fhsjvKTG5GN2vUwQzodpEW/W6+WNGY0h3m4Ig5tttJ:sxZVwqc2/fhsjvUei2vjr/bG5Zrt3
TLSH
T17B62F816AA24497BCCDBD319FA557B93D3F9157291905E44AAFCCB0C04E6AEC221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5477e842263ef0be4070b8a78a1b79b858655e92780f54bea6c56603fa88c089
MD5 d50bb9816c2b141f00fca296a14543d8
SHA1 6ded60a23b217b8ea3017a204d9d93a004e64865
SHA512 bae8bd1564889fd76c4c696251ba2904295b73c74108852aca09b99a0f5450a621d45f868565d9342975c400a8533fd941cab598680dde8ef0e655de54b5654f
SSDEEP 192:sxZVRjyMqZjK1Ml8MF2/fhsKPKTG5GN2vUwQzodpEW/W6+WNGY0htm4Igj+msJ:sxZVwd2/fhsKPUei2vjr/bG5Lj+x
TLSH
T10162F8066A24597BCCDBD319FA55BF53D6F9157292904E44AAFCCB0C04E6AEC221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 9d1d2b5fbed39dd86ebee6122a8eabd098e7764da8a3bdb7e8fe7946ffffb220
MD5 7c278efb7f0bcaaf3bbbbe485fd2b3a5
SHA1 d976f8f0131914ae4f59c5c3683c0cee5ec94d69
SHA512 c097d3af0bc0b3e65e4c16a3286d6c8bcccf8ccc027f8d2d0c05e78808b73d774b5cae8aa65b071a180d8250d9f185fd0cbf99dc6f4653841ecbaf8a50ba7a92
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3lzx4LlC:wQAKq8y02yqEnjbWRmj1QWTu1jaKlzxR
TLSH
T12C03FA3B680CCB7E4F804E9CED267E8A6DE8028BA698CD5447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 8e4f71329158b8a85facef30885579e0b752dc81bc978b64ff0e2af5f1e77385
MD5 05afc0f4105e83f4817dfb63d62658a2
SHA1 e08d1ae54be42244c60bd4b23410f3189a3f0cac
SHA512 bdc5672986cde7d229f02a18a2fcb970d0af084a17c993261d89b26df142d570bc80ee8823346644417a850a2cedc8cc7050f3a89952a35376fb1e56ce8869ce
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5+:GZLVDJjEDPV0/Zdkpb
TLSH
T129A26A0232BA42023C7E391893968B674A42F563305DAC7F7BB904B54E27E225DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 038d3a33d206e574885002af1cd80093df609feb6aa740f6f3f8df8f9dc93dba
MD5 0f9bf339c20be80fcaf8b74ddf84c690
SHA1 f72a67c5f95b9309768a5cece72c3351cecfbae1
SHA512 bb832925632d92e4f78bd61812ac0cfe527b5b82262c26a5e270ebba1f6586c8511d1dee8130ffb46aaa8b2356671c0e5751112b18bb454c6a41516f05fd584a
SSDEEP 768:GFccps3cwgqPUKekmm7BG7fOkhDI8p0vO:ys3NPMktUZxI8p0vO
TLSH
T120C25C31EC64CABBEDEA4F99F70E7A03DEE01167869C89D8DAD81D4D009719D134B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 076df9568728bd19e13b4bf8c4e3ad2c3d10b88a5d4879a9c00ffa6d658496a9
MD5 20d1aa2aeeae31416afbb713e05e1058
SHA1 4ef14104d54e23612528e9c0da951cf5a6fadcda
SHA512 09ad9b34cfe7fc0874c54cb7706ca990cd16243fb41616e07b427e768f10eedfcf1998417b986e0a073c0753007ade2fa0f7f297aa7244d12c669f0e8f1396f6
SSDEEP 768:cF4cpv3UwgSKekm0EG7fO9qNRSukaTbjzn:yv3zkbWqbaaTbP
TLSH
T157F2B2F598E789B6E89E0B87A73D2D029AFCC16775884894FB940D0DCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 45f7aa04e5675b726c2e3942fd2ada5752106821e35f29c407f41d70a613be75
MD5 f0ba5ea7e6fb07667328199265b7cc79
SHA1 74d152c63b33f18f655cfa688ea3ca02e41f1059
SHA512 1c552947ba9d58d2d1eba1c22f17bb2541991f9b1456bf9cfe4c3c7c4cdf877a933651825d158b4e84d42298b11acc9f1cb635b9897d7c4af4eb66a1bb5941bf
SSDEEP 768:SF4cp13UwgSKekmzEG7fO9qzRSukaTbjzn:U13zk6WqNaaTbP
TLSH
T189D24A35DC64CAB7E9EB4E98F74A7643EEE001678A8C49D8DAD90D1D008B1DD130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6d4d8e5235558cb3e1854f6213a881b30337ee36886d4ffb6cc1acc027d45592
MD5 192e81e7c3ce3d8f756e56dce81ada9b
SHA1 5149be24586cf237a05b1e714a5c6fa625da9f0c
SHA512 933f91d05f2cf50f832eee919445bc16094b1172aa68199d875fbd54b38dd1a1016578cbf568dac2c7a36b98b4f4d18afdf34453222bf5a51b413eb72a506324
SSDEEP 384:nXiF9CcmyWCQ38N78TUNTUlIREPm3ek32nn9hVh4Jf+8G7PHOZcEL5tGzRkty/7t:SFccpQ3UwgSKekmJEG7fO9qzRv
TLSH
T19BB23971E8A8D9B7EDEA4FD9B74A3603EEE00167868889D8DAD90D5C00971DD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8e0603b8897074272931394322851e439f589d990a5b0d2f2110c37f18773da4
MD5 84e91d28eb53ea38a92e807275c6602f
SHA1 62b09d6036f692580c5188ee1b44470142504b31
SHA512 a79317a7b847d0a2d34f5cd1c16b15cec97932bd05ae0033417567d5f308886aeaeabea2f1d68812736b401250577044c28dfc628424b55b3f085ae034065ed9
SSDEEP 768:nF4cp13UwgSKekmzEG7fO9qzRSukaTbjzn:r13zk6WqNaaTbP
TLSH
T1B6D24A35DC64CAB7E9EB4E99F74A7643EEE001678A8C89D8DAD90D1D008B1DD130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5560-164-0x000002628F730000-0x0000026290730000-memory.dmp

Download