f3a14d8666d10b647897f98af8b472ab9576740c6a7756977a87f8f2320c12ee

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
about.html
Size 20KB
Sample260703-alezxagy7s
SHA256 f3a14d8666d10b647897f98af8b472ab9576740c6a7756977a87f8f2320c12ee
MD5 812690c72f7373f34f1f27f1ab89c9c9
SHA1 53b7d6fac53319a6eea4d107b93ab2004d584bbe
SHA512 947a623aa631ede769fcdacef38c6e5bf572ce9d7c50565445e1ba827cb6736cd615d54590912f5ee5b9d13618d9736df5ae141ba7bb9563c3a5bfcfe9826ad5
SSDEEP 384:FLDDAWR0PTZFygeth5C77v04HKjInivV40ZbzNuf:FLnAW8Ts5C77v0oKjIne40ZbzNG
TLSH
T15A921C3468F2157B0087C4E42AB5AF1BAFE2C50BDA2B650572FC97C91FD3D428A9359C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1152	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275115099768086"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{6DE85A47-B59C-4F72-A7E4-B0179FAEE923}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5808	msedge.exe
5808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 6112	4720	msedge.exe	84
PID 4720 wrote to memory of 1152	4720	msedge.exe	85
PID 4720 wrote to memory of 5984	4720	msedge.exe	86
PID 4720 wrote to memory of 4916	4720	msedge.exe	87
PID 4720 wrote to memory of 5984	4720	msedge.exe	86
PID 4720 wrote to memory of 5984	4720	msedge.exe	86
PID 4720 wrote to memory of 4916	4720	msedge.exe	87
PID 4720 wrote to memory of 4352	4720	msedge.exe	88
PID 4720 wrote to memory of 4352	4720	msedge.exe	88
PID 4720 wrote to memory of 4352	4720	msedge.exe	88
PID 4720 wrote to memory of 2308	4720	msedge.exe	89
PID 4720 wrote to memory of 2308	4720	msedge.exe	89
PID 4720 wrote to memory of 2308	4720	msedge.exe	89
PID 4720 wrote to memory of 5832	4720	msedge.exe	110
PID 4720 wrote to memory of 2828	4720	msedge.exe	111
PID 4720 wrote to memory of 5832	4720	msedge.exe	110
PID 4720 wrote to memory of 2828	4720	msedge.exe	111
PID 4720 wrote to memory of 5104	4720	msedge.exe	113
PID 4720 wrote to memory of 3436	4720	msedge.exe	118
PID 4720 wrote to memory of 3532	4720	msedge.exe	119
PID 4720 wrote to memory of 908	4720	msedge.exe	120
PID 4720 wrote to memory of 5700	4720	msedge.exe	123
PID 4720 wrote to memory of 5700	4720	msedge.exe	123
PID 4720 wrote to memory of 5808	4720	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\about.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff97c22c188,0x7ff97c22c194,0x7ff97c22c1a0
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,13054600310569225645,5256129849062497432,524288 --field-trial-handle=2940,i,16768097474342079139,4315318903774796090,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,5140256780985851989,6856276028747752542,262144 --field-trial-handle=2940,i,16768097474342079139,4315318903774796090,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:2
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,561428192716043924,15522946398649820199,524288 --field-trial-handle=2940,i,16768097474342079139,4315318903774796090,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,6973216702551429500,1341672819167263280,2097152 --field-trial-handle=2940,i,16768097474342079139,4315318903774796090,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,15068855259791091865,5968781708919468054,2097152 --field-trial-handle=2940,i,16768097474342079139,4315318903774796090,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,4743707229481483059,16828930550070393467,524288 --field-trial-handle=2940,i,16768097474342079139,4315318903774796090,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,10236143377005158510,4747028848215683636,524288 --field-trial-handle=2940,i,16768097474342079139,4315318903774796090,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,6432372461497261411,6696236413299892287,524288 --field-trial-handle=2940,i,16768097474342079139,4315318903774796090,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,6432372461497261411,6696236413299892287,524288 --field-trial-handle=2940,i,16768097474342079139,4315318903774796090,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,10658240096422203471,16567611084985417052,524288 --field-trial-handle=2940,i,16768097474342079139,4315318903774796090,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,4764758775829204045,9914765841167464046,524288 --field-trial-handle=2940,i,16768097474342079139,4315318903774796090,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,1979816611384423064,5086956617512611457,524288 --field-trial-handle=2940,i,16768097474342079139,4315318903774796090,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,3990404328218607707,977149740629772119,524288 --field-trial-handle=2940,i,16768097474342079139,4315318903774796090,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6276,i,4327649524277719416,12725679531559750043,262144 --field-trial-handle=2940,i,16768097474342079139,4315318903774796090,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c4611fb59250ff1e1952689cd8212c026b9d31282dbcd58d80ee62f73a4da8e2
MD5 2edaeb3111359ccd918a96111d792995
SHA1 1dedc79e70ff5ed3e0b910a15e8ecbfd682dbed7
SHA512 e1e7c3df690bf8d008a390b4ce5194e92fb8dd40995f95ab3eb2c8a32bbaa39e19daa62e18aa9e7395fcb158884342ceab70ecd343d6081548f6b9ddf26ff571
TLSH
T1ADE022A6C822EC2B08FD0B68A45D874AE70113173B80994F3B3CC20C8FB163A89C9C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1526b6c0a10e9738dc74fe8cda3285f5001a4f26c82253cad8fc4e49dd03bed4
MD5 ad1193323c669000ebc00107a826e4e2
SHA1 6799130d97035c5bd20d2b11d7adf5a29865c0f6
SHA512 cdfbad1f233052c50faaee921bd79a180fcd87322f0165e36d8d446dd5fd122049068e873eb46420287274f341d3fdfb6409b4d0e38dfaa587ff6b53bfee1b97
TLSH
T19B6190F7C3E4876E891192F4AB25BE2BCD1D0516422C3C9A89F4AF5F63E24B0D14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f37dff89dc3b8d634f8145c3c4be30ec600b63f4076d951ae2017d0ca8f52e05
MD5 57003d5d027d5f8548304a0804f2e85f
SHA1 2baa8415dc9e135b9ab4bd090533cbeaac8c5765
SHA512 cd5fb41f8a7f28ff02c893347b941ecaa942ecbc9b4e0d2c458b4e7b6149a59dafeefe6cbf1aa4dd87a252dc0aa92718c738dd2e47446dbc1548b02a8f1e2c0f
SSDEEP 192:sxZWRhyMqZjK1Ml8Mkl/flsNrWZdJzodpHeHW6+WNGYvcj2SUIg5mxJ:sxZWCMl/flsNqzi+HbG0TM7
TLSH
T1FE62E806AA34597B8CDBD219F645BB53D6F91173E2905E4499FC8B0C05E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bcecbec472826283f1c9f76b7ee7fe1d8dd8091a41e8e66f33b0fc39e39dc459
MD5 fc17d95b6756a2a6dc6359aa3905fce3
SHA1 24608fb5615376db75c1a2ecdbde40e70aa3ae80
SHA512 53cb13d9ba0780934830def90190b6552fd54b5a193aa4ebc591746435e286669118690d584bb7521793907384cbdffae8b479f20b655358a15d6a72d4508edc
SSDEEP 192:sxZWRhyMqZjK1Ml8UQWkl/flsNrWZdJzodpHeHW6+WNGYvcj5SUIg5mxJ:sxZWCq9l/flsNqzi+HbGnTM7
TLSH
T10662F806AA34497B8CDBD219F645BB53D6F81173E2905E44A9FC8B0C05E7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 16535ac10b194e332aa99728a9c234795cc8ac08aaff070145d4c2aec46e73ea
MD5 f2d166726d657acaff95125d35b41f28
SHA1 8a6a47f4458e81ae6a41cb53db8956b7b2d81d2c
SHA512 0f91826adb1aa27cac92b6123a58b08d3194c90347d1fc01ce93cbba893527e5e3a9f625816adc9f3712196751d7e3864277cbcf3d320dce219b73c15c5513bc
SSDEEP 192:sxZqRhyMqZjK1Ml8Mkl/flssJrBaZdJzodpHeHW6+WNGYvIC+SCIgjxJ:sxZqqMl/flssJNazi+HbGrvj7
TLSH
T10E62E806AA38597B8DDBD219F6457F53D6F81173A2905E449AFC8B0C05E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 749fb6ddab1f4bd8e3dd7946d86461043fef0fa806986420fac529f512ede23c
MD5 9b87d00bac7fb25a689bf1a830ec3148
SHA1 b56da714f7c201769e35c593e2e7481510ae9066
SHA512 72860a525e74c329885be04dc0253cf6ba4a2ab4da974dbc25b274b4ccca178a2c12bdadd343eecc7760cb5a20f0bab03542338e6208aaebbe568cde37d794c2
SSDEEP 384:0LppY93PBZJPtN531A5sAe+OrWXwQ4nqSnwYfqAFdu/DFXHqrQnLRkqVI9FYr5:0LppY93PBZJPtN53Jpe
TLSH
T106B27B5A703E0211397E2988B39696364F4235A37058E4AF7FB814A14F67E224CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 41ccbf1fb377e5b2751385bf920a7a1ecb8cd3b6dc4d08676f53dcfcbcc9513e
MD5 127d445c9cb67fd9d04b04cc7045053e
SHA1 d96348ead63f2a01aa15f70c76d7d170020852c9
SHA512 3f4c69381d20d27e51e1b81b1988b424a497f3710d84def49d34ef0a72ca1fb26c8e4e3f6fcd171f513c9e59d78bd1409e797f5aae996a59174a4fd112709cc6
SSDEEP 384:ndiF1tNn/s3n9Szd3sNV8TUNTUlI4JQQckCr9cKpvBftGp+Mgj4Q4Lm3hOObjI9I:UF1j+903swgc4kJkjGPVQp3h29MZ
TLSH
T12FD25A36E864CA7BEDE74BD9B74A3A17EEE0026786DC5AC8D9C81E0C01D75DC430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 57ed8c0bd689f18c26f03f255c14e0059993eaa84b189bd8d50ba22a32cd7609
MD5 eb969d2e726c545df28a4dcb8f8633d1
SHA1 c96259d926c05a92f67aa6827770750749cb4247
SHA512 50dc4f8f9d9016abd442374e8294eb155cd7211b2ac8a0e96504fbc668c315918b43e576a3799630ca091a5aecddb24af2d33037254e744ce8d8bccc2f815278
SSDEEP 384:nviF1tNn/s3n9SJ3sNV8TUNTUlI4JQQckCr9cKpvBftGp+Mgj4Q4LR3hOObjI9GN:6F1j+9w3swgc4kJkjGPVQ+3h29MZ
TLSH
T1C0D25B36E864CA7BEDE74BD9B74A3A17EEE04267869C5AC8D9C81E0C01D75DC430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 5fb822905372ab63b0bdd6e50310f8117c91dfd54b60a38a24b2787c74fe2497
MD5 47327a47b25032e874fcb882facf24ca
SHA1 38e912cd771c761a4b1d8889234a228cd93a049c
SHA512 ed0e91b132c2c768fe3367a15dd8c506ee7eb04e9c04412c1511bd785f0ddf43fc4289dad412a8584da1b97404e395fd620693e8033786993b0501b302c6ffe4
SSDEEP 384:npLiF9CcmyWCs3sNV8TUNTUlI4fQQckCrncKpvBftGp+Mgj4Q4LW3hlhgty/7Igy:pmFccps3swgE4kvkjGPVQf3hlo
TLSH
T13EB23936E8A4CA6BECE74BC9F74A3543EEE44163C59C99D4D9D81E1C01DB1DD430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9cda1d0a0ea479483afcc5ebc8ebb999d78c7949b21ac01c85fede1298a6982a
MD5 4580cc15f96f8cd9b1e775857ff40fd1
SHA1 81ac1a8411958373a17255a4fbb2d028ca5675b6
SHA512 230e8a1492e0f0661693c56188bdceb12bae46e31ec858a411fe9dca6008096ec3b02fcfb7770af7b969c0392f4b9dbe9b93734dcc5f264cf682c2cb40bf9afa
SSDEEP 384:nppiF9CcmyWCs3sNb8TUNTUlIm2QckCr9lOKpvBftGp+Mgj4KPphe4KV8p0PHTt+:pAFccps3iwgbkUIkjGPVK/I8p0PU
TLSH
T121B25D36EC64CABBEDE74F89B74A7A03DEE0126785D859D4DAD81D0C00D71DC570B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7e378618c0df597aba7c273ad29382031aa9947a6362b3cb9b7da6e098500483
MD5 706399283b2c1ae9c581dfbf33e66b30
SHA1 d155cb5e8c5ac40c77b98b278f971085af448467
SHA512 40a0cb0bd74ff8bca6df2c35c195127b340190756f883648c212ad509ed8bf59e5e4d3b8c82cb26aa8083d5e763eeca6aa1ba40cb25c4a6febd6c1822f54bc02
SSDEEP 384:npmiF9CcmyWCs3sNp8TUNTUlIm2QckCr9r7LpvBftGp+Mgj4Q4Le3he4KV8p0PHU:pNFccps38wgbkUHljGPVQp3hI8p0PU
TLSH
T157C25B36E864CA7BECE74B99B74A3503EEE05263C69C99E4DADC1E4C01D71DC470B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6c92798115d01bd8688ddd70db83b4e987948f4fa4ddd4bdfb56c26880a8a79a
MD5 7dc2bb6df80be5525ae768eb11e1a03f
SHA1 19561f7c8cc90d02649dd33028f8df0beb89b85c
SHA512 2b07ff7ca77b738bfaec4b6937383d5b4f6e84101d6789cedcdf884c71487bc02f19a0f163e8fa1dffa5334f0a916d0b847f98ae69f8a2e1f4c96df08a4e6cef
TLSH
T113412958B6F91248B7B76E1AAFF6A82D487FBC372E46905D10110D4E0A26E40CCA1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5104-250-0x00000213A31B0000-0x00000213A41B0000-memory.dmp

Download