d2ac0349e286ec4594307a903877a3fabbad0b8fe32ffe126d0dfa0fb83f16dd

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
erpoir/goren/News.html
Size 85KB
Sample260723-allgpabm41
SHA256 d2ac0349e286ec4594307a903877a3fabbad0b8fe32ffe126d0dfa0fb83f16dd
MD5 fc593cfa586f5dd7c093326201b12a42
SHA1 a9529a59901bd2716bd235f7f5645ec63d87aeca
SHA512 c76f92a0c325166f2474d25496eeeda38e0857e4736a03cb54304b1f68b2b5e6190631a5a7ad90b58c3f8eaf20a44b7d99bf1dca293d086dc6977ff7673564f4
SSDEEP 768:GQEUQP2hNPgOHYfPiQm9XqIDG5ae+mYgcuY5CbStweMxlBqZq1qeClClF:GhU3cdm9XqIbjdtCEeCloF
TLSH
T14F83317284DD9A3FB52B778D2319531EB4A39B71DE070910FAB832D203C7F61DA1A54A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5592	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292396079587156"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{4F9473E0-BD48-4400-AA83-756DC70AAA5D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 4740	4568	msedge.exe	85
PID 4568 wrote to memory of 4764	4568	msedge.exe	87
PID 4568 wrote to memory of 5592	4568	msedge.exe	86
PID 4568 wrote to memory of 5320	4568	msedge.exe	88
PID 4568 wrote to memory of 4764	4568	msedge.exe	87
PID 4568 wrote to memory of 4764	4568	msedge.exe	87
PID 4568 wrote to memory of 5320	4568	msedge.exe	88
PID 4568 wrote to memory of 3828	4568	msedge.exe	89
PID 4568 wrote to memory of 5612	4568	msedge.exe	90
PID 4568 wrote to memory of 3828	4568	msedge.exe	89
PID 4568 wrote to memory of 3828	4568	msedge.exe	89
PID 4568 wrote to memory of 5612	4568	msedge.exe	90
PID 4568 wrote to memory of 5612	4568	msedge.exe	90
PID 4568 wrote to memory of 4512	4568	msedge.exe	96
PID 4568 wrote to memory of 4512	4568	msedge.exe	96
PID 4568 wrote to memory of 2928	4568	msedge.exe	97
PID 4568 wrote to memory of 2928	4568	msedge.exe	97
PID 4568 wrote to memory of 5124	4568	msedge.exe	99
PID 4568 wrote to memory of 6140	4568	msedge.exe	110
PID 4568 wrote to memory of 4060	4568	msedge.exe	111
PID 4568 wrote to memory of 4464	4568	msedge.exe	112
PID 4568 wrote to memory of 3452	4568	msedge.exe	113
PID 4568 wrote to memory of 3452	4568	msedge.exe	113
PID 4568 wrote to memory of 3504	4568	msedge.exe	115
PID 4568 wrote to memory of 3504	4568	msedge.exe	115
PID 4568 wrote to memory of 3180	4568	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\erpoir\goren\News.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7fff0b8ec188,0x7fff0b8ec194,0x7fff0b8ec1a0
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,18024482937822929366,538013150287170569,524288 --field-trial-handle=2856,i,5464585933311688683,1861458509824664782,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,15074664658104069248,9775571387612023274,262144 --field-trial-handle=2856,i,5464585933311688683,1861458509824664782,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:2
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,2638670464078938467,3381907911458698243,524288 --field-trial-handle=2856,i,5464585933311688683,1861458509824664782,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,15680006351163841625,12031740121303365866,2097152 --field-trial-handle=2856,i,5464585933311688683,1861458509824664782,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,9975421952625378939,5410386580298617201,2097152 --field-trial-handle=2856,i,5464585933311688683,1861458509824664782,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,16763113981155372145,17724700401733124658,524288 --field-trial-handle=2856,i,5464585933311688683,1861458509824664782,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,14160798285502175918,2517849636647956015,524288 --field-trial-handle=2856,i,5464585933311688683,1861458509824664782,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,3223275793572132994,5992777000607516031,524288 --field-trial-handle=2856,i,5464585933311688683,1861458509824664782,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,3223275793572132994,5992777000607516031,524288 --field-trial-handle=2856,i,5464585933311688683,1861458509824664782,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,12448358996831773232,401331097285176539,524288 --field-trial-handle=2856,i,5464585933311688683,1861458509824664782,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,7050392954015185370,2619883168961775525,524288 --field-trial-handle=2856,i,5464585933311688683,1861458509824664782,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,6406159185446974864,11621037635331101651,524288 --field-trial-handle=2856,i,5464585933311688683,1861458509824664782,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,14701824603594642315,6499492566941843101,524288 --field-trial-handle=2856,i,5464585933311688683,1861458509824664782,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,12921256264748411018,1646256956326799898,524288 --field-trial-handle=2856,i,5464585933311688683,1861458509824664782,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5996,i,5215757718369067499,854495952548089673,262144 --field-trial-handle=2856,i,5464585933311688683,1861458509824664782,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

1ec98e76-7fd6-4c00-a8ee-72c6e01b21ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1ec98e76-7fd6-4c00-a8ee-72c6e01b21ed.tmp
Size 414B
SHA256 99bccc241cc0861043ab8e8e024be3977629f92fde66d10801a499423d32371b
MD5 fb8177d04ebd3175b079c63371228cc2
SHA1 129245f261d206959965816107b1b8fb0b0637cf
SHA512 18a165bde6984ed5c2436f59ec515118862185ad63385dfdba8bb373f2891c78770613e44515a2f8ca9df55a3540a9b998bdd35d444b077678cc126ac4e0de6e
TLSH
T1B1E02B6EC921EC2708FD4718A04D8646EB0013177740998F3A3D92098FB46268AC9C5C
MD5 SHA1 SHA512 TLSH

Submit Download

96fa6084-f565-4a60-8ef5-9ec42b0846f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\96fa6084-f565-4a60-8ef5-9ec42b0846f3.tmp
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bf59cbf473f2e4adf954a302462e136ac11b82bbc9c9cfa386eea11e30a17396
MD5 13ee75d8f530c36648b5fef1b65fda3b
SHA1 9ed052a5438016734cc75b511aa51176c1198c9a
SHA512 f7e26085fcfeeb0847266f10ad8ea198e2b0f2d22a2db3bd77562bc50af68b204bf896705a0bd4c564711954dc3ce0eea9ee2b76964cdbd4b577ee6b2e83d124
TLSH
T14651AFF783E4866D891156F0AB18BE1FCE1D0555832C3D5A89F4BF1BA3E2470D10269F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bd0c45e7760b1cc3caa5a7ec345421702a3bad2c08b4f374ceec7eddc9102d2c
MD5 c732e7c860cf972fbc06250daca8481b
SHA1 63a199d3cfbc0c5ac06cae5d152cf7033227521e
SHA512 3ca5527508a330b22dbd122fc862ea93b63ddf533163d458e9ad620f2bc7bdbd8ed679515c9d96674f40cd055463fbf25c644258367dc0da09c90e5c77797e0a
SSDEEP 192:sxZy4REyMqZjK1Ml8UQ1k3/fXsSuZdkzodpHyYHW6+WNGYvVmq9KIg5hyJ:sxZzJq+3/fXsSuzX9HbGQsvO
TLSH
T18662D81A6A74597B8CD7D219F6857B93E6F91133E2904E4469FCCB0C04E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6588d3b34bf9784fbecdc845f95f9d042371f657125a968a2cab91e4c595abfc
MD5 441033825f6cd04df79519442a9bb694
SHA1 f2598e5e1a1e0528d6b450fade40a879b8f588f2
SHA512 7fd382fc564125b25510d106400627d09aee6e4af3a34338d31b6c5b38269296020e65036a015c7457927490beaaaa122a1501cc08d42c24bb42184b7d7ab7bb
SSDEEP 192:sxZy4REyMqZjK1Ml8Mk3/fXsswlaZdkzodpHyYHW6+WNGYvIumq9KIgjyJ:sxZzJM3/fXsswlazX9HbGasjO
TLSH
T12F62D71A6A74597B8CDBD209F6457B93D6F91533E2904E44A9FCCB0C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 f629198bb0fe1888f0852865e806f9d105729f7a208da12e455e706a21c08581
MD5 3a5e9103be34da381537cea48042b5a8
SHA1 be93acbec93a1d1ab149d0bfe5ecaf8564ea5dcc
SHA512 4ad4b73db6c2b13fe9d1d6b109b83a3a93fe9217e1f70f6284e5385ed85347b160d0519ab45766c45193d0fc65043e4f133f4be9d87ce0439f4be7c56c72411f
SSDEEP 768:0LppY93PBZJPtN53TiRMNB7/zy/m1ZVBtTChBG7Y:0LppY93PBZJPtN53TiRMNB7/zy/m1ZVG
TLSH
T1BDB27B5A703B0211397E2948B39696364F4235A33158E4BF7FB814A24F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7dd8040e3592815c19a79259553dd952751956ffbcd82dda8c0bd8af1c18ceaa
MD5 4e65cf03211f69a50f1317231d92f233
SHA1 a529ed0e1c0de2e3ac8621dd0603931b43bc3df9
SHA512 0bd6cbaf55bc39034cb9bd602595dd0d2c985ca0e81c716620fa970d7d8018571878296538cac08585ddd86522fd23f90fdf18c64b43bd2bf0ac33dd6553a3db
SSDEEP 768:DVFQ63TwgXkCS9MoGgLggmXLZt0k29MnY:Dk63JHS6eXYx2+nY
TLSH
T13FD25B36EC64DAB7EDE78E95B7893A13EEF44123D69C5AC4E5D95E0C00970AD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9d3282026d7f29a71c76d6f12b64a6a4d1b26f3f8e35c66573644b41898b000c
MD5 adf96b5b113abf8c1514cc9499cf0894
SHA1 15a7a1b9afac17c7dc5faf13a2e8e30edfd4b34b
SHA512 707970ea7e02c736dbdd24f459c94d5fbec068185a14531954c62c5533fe7544321d62ab5b83923195ded9b620d318bac373dfade6a6da2f6d7d770c01b7c19d
SSDEEP 768:pQgFQ53TwgXkCS9MoGgLggmXLZ0k29MnY:O553JHS6eX+2+nY
TLSH
T1ADD25B36EC64DAB7EDE78E95B6893A13EEF44123D69C5AC4E5DD5E0C00970AD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 57a4c66c9f5e8b5f15585ea738d6b25e89ba91067a2d784e72e78cf6a93f3a96
MD5 4c49911f65d8fd16bcde628fceb8a549
SHA1 0a4f8ee610a1f55651833e39a24892780984beba
SHA512 bfc416b736a775c22028d1b2fb5238d939ed5f33b1ac8a8b0f33ba37deb473aeb1c04bb9299bfc755c15cdd79a7b8b92915f101d63c4a857de17b47f73078b2d
SSDEEP 384:nDJiFiZcI53sNa8TUNTUlI4yQckCrfSt9CphiftGgEM9Dg9gmtRFdZ0kOObjI9Gk:DgFQ53TwgXkCS9MoGgLggmXLZ0k29MnY
TLSH
T170D25B36EC64DAB7ECE78E95B6893A13EEF44123D69C5AC4E5DD5E0C00970AD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 72a120689b52652790a9fb26f847d328ba45234ed519fbd1125665e41c463adc
MD5 9a8064c4efc0d48848ad7927e1e70381
SHA1 ebe13e91d454a9f51929d27248138e4152908592
SHA512 bedd097aed8be22ea8fd06b0a4ef735fa7bce3fa48ecbde46c28369e7b4a74b168b95c56f3e9126ff0593bbe47bc23651cb3679c9aa7036a699aee027046e17f
SSDEEP 768:pQgFccpH3TwgikCr9MoGgLggmXLZ0k29MnH:OoH3gHr6eX+2+nH
TLSH
T1F6D25B36EC68DAB7ECE74B99B65A3903EEE44163C69C5AD4D5DD1E0C00D70AC430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a4fd0f02a130726bff1d701a4118f546fe9755d12f5cab5c52ce5ec6ff2c3527
MD5 e0a3a88786fa9cf0a4104e45197cd93e
SHA1 69db01dbb85e726ec280355301c0cccafa6d621a
SHA512 2e68b5bb7ab087f2b21febc4710a1f56f2a9d927b52be764ef3683b6be5e9f9eeafca81513290d6e23a171bc08dbe5820dbf9a17490566e1ce3f58cf03cbfbd2
SSDEEP 768:ppgFccps3jwgbkUYM9oGgLggmXLT0kI8p0KX:fos3tWaeXCI8p0Q
TLSH
T14BC25C36EC58DABBECE64B99B64A3903DDE04227C69C9AE4D6DC1D0D00D70AD430BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2ca39a730c66961fae4abf9b6f72c31acf4a8949c880eec64fc82a658b87b0db
MD5 db1a1bf538f84b8a26af307d259c3702
SHA1 01a7e2e2ea0cfa5626b599a4d1691329435c1229
SHA512 543b12915f9200c312bcf28273a5f044bf32f7fa8c6d63894c58c5c76972e4fe28e4da476b771c22597d26c36729949005cafda5c8a16a1f3a3303041d5a2102
SSDEEP 384:npIiF9CcmyWCs3sNy8TUNTUlIm2QckCr9liKphiftGgEM9Dg9gmtRFgWpAe4KV8x:pTFccps3DwgbkUMkoGgLggmXOfI8p0KX
TLSH
T12EB25C36EC68DEBBECE74F89B74E6A07DEE41267859859E4DAD81D0C009319C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c819489346de0855dc708c4d6ffacdb4dacf0f7e9ed359b555b2f98ef21f599b
MD5 e0e0b165bf25ec1c6f8956013c3f9950
SHA1 043655303bdde0166f68d6a8e5eef5d724338bd6
SHA512 477cb96992a32906aecfe9482f3db7ea342e0845b3c85cc50908b8fa15865808c2d4a6e3876d2fcd959860d7c677f33480b306500501cc58544e08ee35d6d7f3
TLSH
T18A412758BAEA1158B3B76F0AABF7A86D447BBC372E46D45D10010D8F0626A40C8A2733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5124-197-0x0000014F00000000-0x0000014F01000000-memory.dmp

Download