a9d7620c3362a1afd48f21203b2f03ad9ed76322fbf0230da6680a59d9d0caac

Analysis

max time kernel
148s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LWC-Basics-Bike-Selector-Trailhead/selector/selector.html
Size 437B
Sample260722-erecsavxes
SHA256 a9d7620c3362a1afd48f21203b2f03ad9ed76322fbf0230da6680a59d9d0caac
MD5 51234db3afba12092d9b04337305e263
SHA1 232fa7b87589f8de69b921a0d2d25bf4f6680814
SHA512 2fb33b9f59b94b4b343b76b2b356dfe0b99cf712cd4f1aefabe31cdc2e4eb570be91e5755a1fe8c4c7100b87343b95c539926f878af2f39dc038219eace9b231
TLSH
T13FE09AA190F06077005690FBB6B01BD2BED8E00BA8760044B0BCA7690F82E03EB1B05F
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5224	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291670139926971"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{4F895646-E718-4450-99E4-6F9CF29C4FA7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 6052	1728	msedge.exe	86
PID 1728 wrote to memory of 5224	1728	msedge.exe	87
PID 1728 wrote to memory of 996	1728	msedge.exe	88
PID 1728 wrote to memory of 996	1728	msedge.exe	88
PID 1728 wrote to memory of 3372	1728	msedge.exe	89
PID 1728 wrote to memory of 996	1728	msedge.exe	88
PID 1728 wrote to memory of 3372	1728	msedge.exe	89
PID 1728 wrote to memory of 3172	1728	msedge.exe	90
PID 1728 wrote to memory of 3172	1728	msedge.exe	90
PID 1728 wrote to memory of 3172	1728	msedge.exe	90
PID 1728 wrote to memory of 2400	1728	msedge.exe	91
PID 1728 wrote to memory of 2400	1728	msedge.exe	91
PID 1728 wrote to memory of 2400	1728	msedge.exe	91
PID 1728 wrote to memory of 3356	1728	msedge.exe	96
PID 1728 wrote to memory of 3356	1728	msedge.exe	96
PID 1728 wrote to memory of 1212	1728	msedge.exe	95
PID 1728 wrote to memory of 1212	1728	msedge.exe	95
PID 1728 wrote to memory of 4388	1728	msedge.exe	98
PID 1728 wrote to memory of 6056	1728	msedge.exe	108
PID 1728 wrote to memory of 948	1728	msedge.exe	109
PID 1728 wrote to memory of 1924	1728	msedge.exe	110
PID 1728 wrote to memory of 5168	1728	msedge.exe	115
PID 1728 wrote to memory of 5168	1728	msedge.exe	115
PID 1728 wrote to memory of 6076	1728	msedge.exe	116
PID 1728 wrote to memory of 6076	1728	msedge.exe	116
PID 1728 wrote to memory of 4400	1728	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LWC-Basics-Bike-Selector-Trailhead\selector\selector.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x260,0x7ffe4019c188,0x7ffe4019c194,0x7ffe4019c1a0
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,4138105064845375199,3269394701185775509,524288 --field-trial-handle=2364,i,2561602992283827418,17216764434303150747,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,7919420995262173459,10312328093532491340,262144 --field-trial-handle=2364,i,2561602992283827418,17216764434303150747,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,9890227282044696954,12490508326416778035,524288 --field-trial-handle=2364,i,2561602992283827418,17216764434303150747,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15087888895226827314,13302378834258121224,2097152 --field-trial-handle=2364,i,2561602992283827418,17216764434303150747,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,8047647461343182410,6008528578078686458,2097152 --field-trial-handle=2364,i,2561602992283827418,17216764434303150747,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,3195025193984550620,4211473385710335829,524288 --field-trial-handle=2364,i,2561602992283827418,17216764434303150747,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,6547596380294998989,5483313841081919810,524288 --field-trial-handle=2364,i,2561602992283827418,17216764434303150747,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,17365657215818253982,17045547090613120441,524288 --field-trial-handle=2364,i,2561602992283827418,17216764434303150747,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,17365657215818253982,17045547090613120441,524288 --field-trial-handle=2364,i,2561602992283827418,17216764434303150747,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,18009842935628960629,11568024354233329783,524288 --field-trial-handle=2364,i,2561602992283827418,17216764434303150747,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:8
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,12764074102023817565,8806868530370091046,524288 --field-trial-handle=2364,i,2561602992283827418,17216764434303150747,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,6177436293827738165,14593996485576092626,524288 --field-trial-handle=2364,i,2561602992283827418,17216764434303150747,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,7905671502812430229,18326723264785724911,524288 --field-trial-handle=2364,i,2561602992283827418,17216764434303150747,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,8513712841823970763,17626943176437411463,524288 --field-trial-handle=2364,i,2561602992283827418,17216764434303150747,262144 --variations-seed-version --mojo-platform-channel-handle=1000 /prefetch:8
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5984,i,6299407527694821078,606623096014937536,262144 --field-trial-handle=2364,i,2561602992283827418,17216764434303150747,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

8ada1b07-1d53-4ae7-bb0f-e294950b177f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8ada1b07-1d53-4ae7-bb0f-e294950b177f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 73b6191c3d81b0be419a049001c98fa9e51bf22f78e86ffbafd07f8fecd5e46d
MD5 8cac617cce6a5b40684914363a987b91
SHA1 456702d2e219a5ba433c06540a9d2589062ccae4
SHA512 de458387dac13b10c55a858ffa56fa510ff8bf78b6a9a14e7fcb22950b024887ab7cfa211c3e8cc62c64f9d10255b08f993f09727574704dad975b3c2245a15a
TLSH
T126E02B6AC822EC670CFD0768B0094B4AE70013677740495F7B3C820C8FB062686C595C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c721b30b404359b9871d9263dd5462a5ccded966d382908f6c8ac2af3d10c1fd
MD5 f111b379af3e4f1667429056bc494100
SHA1 f9a076b402d68ed35e6d177f7acdb083821662a5
SHA512 bf26825063360d32a07447f0a9e332d17b67167a72d794ed1745fb3e82f165bda68116ec48b8764866c56810b21cea3a9faf3c1632a97b69e7290fdf8b42a120
TLSH
T1EE31B0F783F4856E8A0196F0BA18BE2FCE1D0511432C7D9A85E4AF1793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 af305bf44bf4e98b874f3ec15eb02d2ad94d4f9907a876a8120de06f01ff8c52
MD5 042652635c5b4f19d772d51bc9b977af
SHA1 6d638cd7b6c25ff4da6d574e4bfd55fe18a91a67
SHA512 722688e1b397fa9366bf9e6edfef6c12eea5b0ce9ba39f86205ab81a899c8189c6d3e532b8739e05201e8f9652e73e826290d287a94bf8c50675d05e0ea31643
SSDEEP 192:sxZ7RJyMqZjK1Ml8UQOkx/fTs2kCXZdWzodpHnHW6+WNGYvJaOFP2LIg5fzJ:sxZ7+qlx/fTs2kCXztHHbG16EVl
TLSH
T11F62E80AAA385977CCDBD219F6457F53D6F90573E2905E44A9FC8A0C00E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f24c984e98c15d5b8e782f8dd91102423fd3d0257a420b8d6a5bb7c00376d0d9
MD5 d65ccefe3776d5c50c0889046351aba0
SHA1 711f2c6580830d9099ecfbe7036666205362a100
SHA512 11e40e9d9a76e6bb69b88d04b20b1d9745471683da2c4d19cf87995d86a105f104305b62ce8d565a4bf39b1215181fd085c898e9d2bb89bcff4b4a99bdea2a8f
SSDEEP 192:sxZ7RJyMqZjK1Ml8Mkx/fTssDkCFaZdWzodpHnHW6+WNGYvIuaO1P2LIgjzJ:sxZ7+Mx/fTssDkCFaztHHbGLmEjl
TLSH
T1C662E80A6A3859778CDBD219F6557F53D6F90533E2905E44AAFCCA0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8627c806c3341123a45620a50b9dc1aff66c2882f736ff6f18adeaf9c4610521
MD5 c474c6e19b324630f4a784077ea3e881
SHA1 3e630cd3fb23c102f0e085f898ac52a47ee164a6
SHA512 29ca2b88a67feb7398a0c35fc888707638534b81b6482eebbe00f3b88ae9ddf16ecbc045df047743e31870a6c8b0ed092a260cb845ef437b53ebd17ad76cb8fa
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG7:05ppxnY753RNBvRJJdt7p5J9j6dG
TLSH
T1E4B2685A703E0211397E298CB39696364F4235A33058E4AF7FB814A54F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 215b98b669e3eb674f09e73df9f048c2abaaa6beed50ceb8e3b1a42b40ec7857
MD5 c6af44d270ec30a8fc5649f11fc00b3b
SHA1 e03852a05042e1deefd3965f74b9f17f7ab68039
SHA512 c5cf2b6e856cd0e8eca1b5d547635d258eb8063bec5e5f3e993ea2b3499adf6cb7848e03a16650cd8a2944b9d0dd74adce1a0c46699a0a9a4ef261d290c9cb17
SSDEEP 768:p4Fccps37wgbkUZioG4+AMAOUnI8p0nLP:6s31iLAlI8p0nLP
TLSH
T1C1C25B36E854CAA7ECD64F99B74A3643DEE0526786CC9AE4DADC1D0C00D71ED530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 df55d2fd89b1e05466f9064b7e58ebcf74a67878bb33864985b8d9937e6c3bc9
MD5 7874a2f7cca46223f77c04f2f56689f8
SHA1 08b648c844bfb575771185afd8f40398d47cc930
SHA512 80bafe727941a9bd9a3b49f168161a4d874b8a78fb976d47998abd4080dd68ceecca8b5700b098e6299e6ca0590bb34e5dc404ac6422a50fdae39753f5e7ec46
SSDEEP 384:npMiF1tNn/s3n9SW3sN+8TUNTUlI4uQQckCrmcH3phiftG4WXGXMAaU+AScjmwu7:p3F1j+973rwgAkA5oG4+AMAaUn1jw
TLSH
T141D25B37E854DEA7EDE64BCAB70A3A47DEE442A385C85AD4D9D82D4C00D71EC430BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7d5bb9e63fbcba9edfc5e71e493ef694d8b7a2beed5fb99f3ae3993accc88101
MD5 99062489e2b7d2a576de650b8c02bfd1
SHA1 e3cbc7d20f0497ffcebcc3befa56241147dcdd6c
SHA512 8bdf528c0f2bb4d40dcc5249daa7249298381fb923366a66bc4b82ad81f266487a688ab81fefe9cac152546e4d40066809ebc1deb8372a989629a36ca27827e5
SSDEEP 384:n5iF1tNn/s3n9SIq3sN+8TUNTUlI4uQQckCrmOH3phiftG4WXGXMAtU+AScjmwu7:QF1j+9+3rwgAki5oG4+AMAtUn1jw
TLSH
T14AD24B37E854DEA7EDE64BCAB70A3A47DEE442A385C85AD4D9D82D4C00D71EC430BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d05ab462220ffe0dce1973954376662fefa17b73f032c006e64c59c5a6c27173
MD5 3e15a98dbae4a26553106c30485dc422
SHA1 fba92bcf6bfcdff95c64ca937957977142d92afe
SHA512 74640ede976fd63dc8a790da67174f3fe047d6cef2e62420cfb1e39dbead7e1398f54e05fc585b88473958113dbe3eb27b91717f33f89c1c7df3cacedb66ba47
SSDEEP 384:np+iF9CcmyWCs3sNs8TUNTUlIm2QckCr9lEKphiftG4WXGGOpJe4KV8p0nLaty/j:pVFccps3NwgbkUekoG4+pWI8p0nLP
TLSH
T169B25C36EC54CEB7EDE74F99B74A3A03DEE0526785D89EE4DAD85D0C009719D030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b2aab95be9d5862e6bb105a8cb2996b958702c6dbc2d50e6441cf06c4210e873
MD5 9e81d58dc5fba9de9e9e69f5b25ee00a
SHA1 57196aca45fb561100b34cd263e8d64a671bf207
SHA512 7b7576e2231962f65ee828f9c5f39c81c0ef7e92fb072616f94d7aa0befa6d792d1b136fab07f8357634f879fa0f87af99ee70529a4c30b767d272b9bf636c6f
SSDEEP 384:nviF1tNn/s3n9SW3sN+8TUNTUlI4uQQckCrmOH3phiftG4WXGXMAaU+AScjmwutR:6F1j+973rwgAki5oG4+AMAaUn1jw
TLSH
T1C4D25B37E854DEA7EDE64BCAB70A3A47DEE442A385C85AD4D9D82D4C00D71EC430BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 670f7e004f4a4f5939498e7fbedf37611eee24cc3bd5f0da845754184b5c2865
MD5 c783f2153bf4f018190ea76ac86c02cd
SHA1 0a3cae54c073a170cc9f1113dd8ba56f47c4f94f
SHA512 aa012c2caa19788b949a7a6ff0be320be75e831740280a47b1ce5ebb89f971a9aec848830b11e78a1ab39b5538a4205e392f14b3862e746d8c63f5cef77035ef
TLSH
T13341F858B6EA1148B3B77E569BF2A86E487FB9772E0AD45E10110E4F0667E40C871B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4388-200-0x000001D9C04E0000-0x000001D9C14E0000-memory.dmp

Download