b32823cc949d117e7292eba76330e0c20a698b5fcbddb42c45243f5835eec4f0

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-1.html
Size 25KB
Sample260720-vrhcfaaz51
SHA256 b32823cc949d117e7292eba76330e0c20a698b5fcbddb42c45243f5835eec4f0
MD5 61e8b48f1cd8fb4fa1ba97fbc93e3d20
SHA1 7dc191bed90df0ea23fb3e4e464f700b33851250
SHA512 7585488c6fada0b16f92dc9cea799bbb6c62163919b002b42b2bf2b44489586e3002a2ed45daf8b229617837f2b784b294ffd6c79c38fd0476cf51bc0a255c2b
SSDEEP 768:TiKDb/GGCWeAeESkWNAehnKWMAev3WTAeeLWCAecCWxAesTWwAeq+W3Ae/+oWGA5:Tic/GGCWeAeESkWNAehnKWMAev3WTAeU
TLSH
T1E1C23014D362072742BE20C9F46B5B9460D3470E93965FE2D778877AB9CF87A760238E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290412331981204"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{0A9BBB1D-F6A1-4EDA-862F-69D16DB60701}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 5036	4560	msedge.exe	85
PID 4560 wrote to memory of 2988	4560	msedge.exe	86
PID 4560 wrote to memory of 4100	4560	msedge.exe	87
PID 4560 wrote to memory of 4100	4560	msedge.exe	87
PID 4560 wrote to memory of 4100	4560	msedge.exe	87
PID 4560 wrote to memory of 6036	4560	msedge.exe	89
PID 4560 wrote to memory of 6036	4560	msedge.exe	89
PID 4560 wrote to memory of 3368	4560	msedge.exe	90
PID 4560 wrote to memory of 5896	4560	msedge.exe	91
PID 4560 wrote to memory of 3368	4560	msedge.exe	90
PID 4560 wrote to memory of 3368	4560	msedge.exe	90
PID 4560 wrote to memory of 5896	4560	msedge.exe	91
PID 4560 wrote to memory of 5896	4560	msedge.exe	91
PID 4560 wrote to memory of 4804	4560	msedge.exe	100
PID 4560 wrote to memory of 4804	4560	msedge.exe	100
PID 4560 wrote to memory of 1056	4560	msedge.exe	101
PID 4560 wrote to memory of 1056	4560	msedge.exe	101
PID 4560 wrote to memory of 1340	4560	msedge.exe	103
PID 4560 wrote to memory of 3160	4560	msedge.exe	108
PID 4560 wrote to memory of 4532	4560	msedge.exe	109
PID 4560 wrote to memory of 1956	4560	msedge.exe	110
PID 4560 wrote to memory of 5672	4560	msedge.exe	122
PID 4560 wrote to memory of 5672	4560	msedge.exe	122
PID 4560 wrote to memory of 1576	4560	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-1.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc8260c188,0x7ffc8260c194,0x7ffc8260c1a0
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,5339598577000285340,9765237389785865587,524288 --field-trial-handle=2184,i,12577820523718421652,4865935547473185841,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,14375712001744821415,12648981952168681374,262144 --field-trial-handle=2184,i,12577820523718421652,4865935547473185841,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,16949300674194455824,11827858515619687979,524288 --field-trial-handle=2184,i,12577820523718421652,4865935547473185841,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,5183850189430347278,17147748693583576925,2097152 --field-trial-handle=2184,i,12577820523718421652,4865935547473185841,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,15897282258728953446,9336201952474075023,2097152 --field-trial-handle=2184,i,12577820523718421652,4865935547473185841,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,8378262005281678991,14528563587187530051,524288 --field-trial-handle=2184,i,12577820523718421652,4865935547473185841,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,9446536795136394826,17004276678028777442,524288 --field-trial-handle=2184,i,12577820523718421652,4865935547473185841,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,7337271813017326819,17707034224178881671,524288 --field-trial-handle=2184,i,12577820523718421652,4865935547473185841,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,7337271813017326819,17707034224178881671,524288 --field-trial-handle=2184,i,12577820523718421652,4865935547473185841,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,16815241393717037993,10487820916259514943,524288 --field-trial-handle=2184,i,12577820523718421652,4865935547473185841,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,8606773784940065791,12747818265835910122,524288 --field-trial-handle=2184,i,12577820523718421652,4865935547473185841,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,16879816815099772828,8943154177178514996,524288 --field-trial-handle=2184,i,12577820523718421652,4865935547473185841,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,1787276678104960126,4988529194615579499,524288 --field-trial-handle=2184,i,12577820523718421652,4865935547473185841,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6172,i,13313716927322907519,15059955134123382369,262144 --field-trial-handle=2184,i,12577820523718421652,4865935547473185841,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

824daa20-4b6b-4bde-aa31-6b682ce57bb9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\824daa20-4b6b-4bde-aa31-6b682ce57bb9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 61329716b157057d3d57491c75e2bbadc5c1831acd0526784653207254bf183e
MD5 da25678638f91f788389bc023bf0a888
SHA1 a2987372977c8ea945c90584fb4fd154f415ec81
SHA512 0c7e149267ec1de7eed3e3dc72f7bb268fb0e9f329f8ea770d4ac5184a6b6821a1395c14b1706f55ff7e5f27f0b21e544370fb3bf5849b91040db7650c646520
TLSH
T187E02B6AC821EC3708FD0758710D8646E70413172B40494F3B3C820C8FB062647C585C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f4c0d03707145fdd993840b7b5b09459fea63d1651059b6359d9ceb85657e95a
MD5 091ec78134c2a39010b5b0b6dd97e905
SHA1 5c6998fecdcc57b82a8e9f2045dd20c8b59912c8
SHA512 dda33144718706e1de71430c0006cfc20a18745b28509ceadf9c00481db013c394e47ab2ee0685e85b604f357504eb9f40663a3c652cb5ee85518219eb33c4d0
TLSH
T17441B1F783B4867E9A1195F0AA18BE2FCE1D0511432C7C9A85E4AF1793F3471E04165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fded8990c0172e2d18bc0a59e5c7bfe77cc504933a3e87f90e24df00a59fc243
MD5 6c6a7eee007da7679455cca129479296
SHA1 ddc63550dc5e61a04226d44ea239175dc06fcb51
SHA512 b1facc81b4e4c127528f550f5848ea7414ea3799e685fcd3758190f7dff275ee2ef707a90768be52fb19e9134899c7baef494eddbdd23379ffbcffe45f2e98c1
SSDEEP 192:sxZIvERLTyMqZjK1Ml8MkbP/f7msbBNsiyZdpuJzodpHIp4HW6+WNGYvkIxfbQbv:sxZHMMr/f6stNsBznHHbGERgl
TLSH
T1A362D70A6A345D778CDBD209F6457B53D2F91163E2905E44A9FC8F0C05E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7f19fe3744c4d6ee258b0209f12074ef87afde9e7835d6597d651b267693a3f8
MD5 451cc5db09a1d091906e05ffcbc29b25
SHA1 f8ad903ea55f9c98ec752385f1f842b9974efd10
SHA512 2adb54d412e2be513ed73226586310b46ec41be1793c5749d7fd3cd22fb1d9e4e72acab288adbb3b21d4f6b082ad83c176c6b82b40662ce6fffcba9c5f1efafa
SSDEEP 192:sxZIvERLTyMqZjK1Ml8MkbP/f7mssvNstaZdpuJzodpHIp4HW6+WNGYvIC+QbIIu:sxZHMMr/f6ssvNstaznHHbGrXjl
TLSH
T10A62E8066A34997B8CDBD219F6457F53D6F81163A2905E44AAFC8F0C05E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c79387661b637c4f294c4238109759f7499493dbd730e914a630c1953f13d675
MD5 cf040cad618418beb4832b051187f6f0
SHA1 67cc39d3e3e19503911b0c4639c5c415cba67b95
SHA512 3c935865acda52d7147df69222103ac1b4947a81956d642b00f2d63ce440ebc38a9d902dd81b6a7d5dde04c7a455425d74eaff2def233d6042a93f69d5a1ec76
SSDEEP 192:sxZIvERLTyMqZjK1Ml8UQbqkbP/f7msbBNsiyZdpuJzodpHIp4HW6+WNGYvkIxfp:sxZHMq1r/f6stNsBznHHbGxRgl
TLSH
T16662D61AAA349D778CDBD219F6457B53D2F90163E2904E44A9FC8F0C05E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5b69d6ada434b21aea76f9b492f9753de742c6afc8c687794e0aef26fac5528b
MD5 00f1b14e8f55fb8c4f58b05457afc79e
SHA1 b16e608b338d0bd3a20e56c7ec4f7a33629c3d35
SHA512 1a5e59cd0e3ac5d5aa3b6e90d131a77a1bfa4fc4203c7586e3161be63d7bbe8ebb99f6ad9bc5ef2fa753f748dd55acbd6e4b9099af2b7ab8a05f4ce1108fd0d3
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGW:05ppxnY753RNBvRJJdt7p5J9rL98
TLSH
T13EB27B5A703E0211397E298CB39696364F4235A37058E4AF7FB814A14F27E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b4fcbe143eb9aeb9d11a04445b10f66b27d2550bb4589d72bd5fc86a48eda850
MD5 e8cce6704dfd60bf1eec18d8848ec161
SHA1 5be5475113d0e3294ed5982c41a45f72a61053c1
SHA512 aa1c5b4fa9dbae2dbb29737047288686817e3e9fba9dc66510eb9e7cf889ca472f966e9fa5796a0aed91369dadb6c6f9eeb104195afde7936c9f60e0b9dab5d3
SSDEEP 384:nJiF1tNn/s3n9SwG3sN28TUNTUlI4YQckCr1vcwpvBftG0oDti/7cLZaexOObjIj:gF1j+923Lwgjk2k2jG02I72a+29Mc
TLSH
T155D25B36D854DE7BECE74B99B70A3A07AEE042638ACC6AD4D5D95E0C01D71EC430BD19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4767a64fe328e9cc83062f49a8b42aa5ecd81720157b6abedbc0a8689694ad6d
MD5 f9e7c6fe0af0cb09156118dcd433dd6b
SHA1 3db37116231069098fb316d71171a82ad54b1021
SHA512 736b6f9969fa51ddfcbb1f22f5965678d1e544e71854d830236944b3cb00c2a86bccdd9738c123132d2b9cc5b8f3a46134855bb3191b0ee6ecb53a4c155ca563
SSDEEP 384:npPiF9CcmyWCs3sN28TUNTUlI4DQckCr1ycwpvBftG0oDti/7cLNaexe4KV8p0+m:paFccps3Lwgck2b2jG02I78a+I8p0oG
TLSH
T118C25C32E868DD7BECD78B99B70A7503DEE0426386CC9AE4DADD5E0C109B1DD430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b11165b532f560f48421ab5dc942de130bb4512c645d66b500467ea1ed9d27ca
MD5 dcda1f785a2199994eafcfe2a38d4fb2
SHA1 b60037028d54961fd50c12c0164e523179cf9fbc
SHA512 c1403e827ca7ada7c90b5b60c64ddb96a86133988ac6617676e6954d63724eed71f39e1168f7ca9453d8137f36b9fb4fc71907850c9eb9b1b9fe685d274db9ef
SSDEEP 384:np+iF9CcmyWCs3sN78TUNTUlIm2QckCr9lRKpvBftG0oDti/7vfpje4KV8p0+HFB:pVFccps3GwgbkUTkjG02I7vNI8p0or
TLSH
T1E7B25C36EC68CEBBECE74F99B70E6A07DEE0516785DC99D4DAD81D0D109719C030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 06969d755e03da3bdf6a58c41f659b60346892dc35c74d3f9bb2389fdad321b3
MD5 38979da9d15609fa18689c9dd01152f8
SHA1 e33482129d97fb99789bf295b1c52eb27f646610
SHA512 ce15dff3f68b6cad0f17314c5130a9bf7cef542b814f9ad4f26082a9229078f8a8e2dfaf92aa9a947b7bf52ce87650f92c51b96a4dea7eadfd500361eb98f5ff
SSDEEP 384:nwiF1tNn/s3n9SC3sN28TUNTUlI4YQckCr1vcwpvBftG0oDti/7cLNaexOObjI9t:LF1j+9v3Lwgjk2k2jG02I78a+29Mc
TLSH
T119D25B36D854DE7BECE78BD9B70A3A07AEE042638ACC6AD4D5D95E0C01D71AC430BD19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2c22f09248e7ef5946e10dcc8c8af87a436597362c80f2b2875134f061d20ee9
MD5 598a9708d46186fe062609fc5251dbf1
SHA1 30369e71244464cf6fa1de148863a913c9ce3be6
SHA512 4a91c2490572c408745581969f639fe00da964e72984209992595cd49bf80fbb1500b98bd47c1ae5c999b85e3a6c1cf42637a6a99760440066158f8a01dc88b1
SSDEEP 384:np8iF9CcmyWCs3sNC8TUNTUlIm2QckCr96ldpvBftG0oDti/7cLYaexe4KV8p0+L:pnFccps3bwgbkUSTjG02I7ja+I8p0or
TLSH
T110C25C36E868CDABECD74B99F70A7503DEE0426386CCAAE4D6DC5E0C11DB19D530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8f9af0f65b3713d53324ba9c82b6e72c5914d4b2eb54461abd6cc2d74eb910e2
MD5 1a0b23700783742c9ce09619bf45b8c1
SHA1 aea10830b95a1173741b94ed1a84ab02ea76ea66
SHA512 0db8e7da6dc4893311aa3e92a7918d9fa29bb2356253afb6b2bbb82b2d8104f0490bbd12312ab51e80be1a866cae20d09a218d908cfad7e0aeb01b38b52c2680
TLSH
T18341F65DB6E91148B3B77F1A9BF7A86E447EB9772F0AD45D00100E4E0667A41C872733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1340-225-0x000001F7C7AE0000-0x000001F7C8AE0000-memory.dmp

Download