ff27b0dbcf22b91d028e2f76930336eb1deafe04c9490c384ab6ed8e5b41df75

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
metamask.html
Size 27KB
Sample260723-g57ycsxthy
SHA256 ff27b0dbcf22b91d028e2f76930336eb1deafe04c9490c384ab6ed8e5b41df75
MD5 2a9b1e5a63116f0446ef72bd7461b3f8
SHA1 e33ce9967977c503437eb82e89b4574b0d1d6285
SHA512 767cf8634784e7e32c168267c5c94d6be277acb509fa63548350777583fe9efc2e4c3a339d400ef67a162b2c073b3db53c212405e4bd9344046e2307a2c76f3c
SSDEEP 384:NwlB72IrjgIFAFPAtmQa3Mu/of2pXRMmiz6zSJ:NI52Yk0K/oupXymiz6uJ
TLSH
T1DCC24EA0AA88E017F67B862E55D0F60875DAE60BFDF30C5DB454D1008FC7E5E2A792E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3476	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292614824902777"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{C7074651-E3D0-47EC-AE06-6F20D9FF5C6F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4908	4680	msedge.exe	86
PID 4680 wrote to memory of 5896	4680	msedge.exe	88
PID 4680 wrote to memory of 3476	4680	msedge.exe	87
PID 4680 wrote to memory of 5896	4680	msedge.exe	88
PID 4680 wrote to memory of 5896	4680	msedge.exe	88
PID 4680 wrote to memory of 2072	4680	msedge.exe	89
PID 4680 wrote to memory of 2072	4680	msedge.exe	89
PID 4680 wrote to memory of 5876	4680	msedge.exe	90
PID 4680 wrote to memory of 5452	4680	msedge.exe	91
PID 4680 wrote to memory of 5876	4680	msedge.exe	90
PID 4680 wrote to memory of 5876	4680	msedge.exe	90
PID 4680 wrote to memory of 5452	4680	msedge.exe	91
PID 4680 wrote to memory of 5452	4680	msedge.exe	91
PID 4680 wrote to memory of 3336	4680	msedge.exe	96
PID 4680 wrote to memory of 5852	4680	msedge.exe	97
PID 4680 wrote to memory of 3336	4680	msedge.exe	96
PID 4680 wrote to memory of 5852	4680	msedge.exe	97
PID 4680 wrote to memory of 3256	4680	msedge.exe	99
PID 4680 wrote to memory of 2736	4680	msedge.exe	107
PID 4680 wrote to memory of 2700	4680	msedge.exe	108
PID 4680 wrote to memory of 6112	4680	msedge.exe	109
PID 4680 wrote to memory of 4352	4680	msedge.exe	110
PID 4680 wrote to memory of 4352	4680	msedge.exe	110
PID 4680 wrote to memory of 4564	4680	msedge.exe	111
PID 4680 wrote to memory of 4564	4680	msedge.exe	111
PID 4680 wrote to memory of 5084	4680	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\metamask.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2e8,0x7ffe4019c188,0x7ffe4019c194,0x7ffe4019c1a0
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,12902541163290986919,12943965584593219888,524288 --field-trial-handle=2252,i,2887793398105056386,8107529801191613412,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,5615337394914429767,8537690666764205936,262144 --field-trial-handle=2252,i,2887793398105056386,8107529801191613412,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,6527559318714816503,7784490501392242254,524288 --field-trial-handle=2252,i,2887793398105056386,8107529801191613412,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,2643311651894508967,5487493493180534614,2097152 --field-trial-handle=2252,i,2887793398105056386,8107529801191613412,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,10931759379715917479,7243758085093174615,2097152 --field-trial-handle=2252,i,2887793398105056386,8107529801191613412,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,9050614398267510258,8104989489709322473,524288 --field-trial-handle=2252,i,2887793398105056386,8107529801191613412,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,6123478653663520408,7007773246441020471,524288 --field-trial-handle=2252,i,2887793398105056386,8107529801191613412,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,13383630769571711750,13351578680600084321,524288 --field-trial-handle=2252,i,2887793398105056386,8107529801191613412,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,13383630769571711750,13351578680600084321,524288 --field-trial-handle=2252,i,2887793398105056386,8107529801191613412,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,3380688354930851302,6848319387511414108,524288 --field-trial-handle=2252,i,2887793398105056386,8107529801191613412,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,14288693104636200535,11215383096284117249,524288 --field-trial-handle=2252,i,2887793398105056386,8107529801191613412,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,16209431072027340949,14602746225607643415,524288 --field-trial-handle=2252,i,2887793398105056386,8107529801191613412,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,15060891359500482036,12386832018424992433,524288 --field-trial-handle=2252,i,2887793398105056386,8107529801191613412,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,984560444509459348,5718400451958738354,524288 --field-trial-handle=2252,i,2887793398105056386,8107529801191613412,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5236,i,8223815681065707128,9655894593643244676,262144 --field-trial-handle=2252,i,2887793398105056386,8107529801191613412,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f2f688b18695fdff06c52a12aa8622c3d54fd15ac6a5405c4af7d8c0beae286c
MD5 2bf78f5832e8c52c85a3c914c117e9f6
SHA1 1f7e2b2b62f77ece8084a6ad23519e6d04828b64
SHA512 4bf9d0562ab105a4b38b376492ab538975d112d2d25477117d09743d7aaa899bdf874fd5d8264719dc5770bcda573f86832c526f5e04c384f134a5c3c225f879
TLSH
T195E02BABC821EC2709FD0718601D8746F70113272650898F3A3C924D8FB462B47C586C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 99acce8338e3ee7927e15549d5cb954293fc98d59f820922f1634596afe6f484
MD5 f771d9438e8deaf317fe91c19663ee39
SHA1 138b5f9c5c4a8185abc813f0094c304738773473
SHA512 6515ff6228c3c30720519777c367396942501104ce4668a930fcb17cc325b1748a06a1467c727bfbbabeb91fab4375ead379a4c846a4aa6b5f4a6b4994959461
TLSH
T1D831BEF783F4866E8A1196F0AA18BE2FCF2D0551432C7D9A85E4AF1793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4285fc61e16c0743919056a3711368be93e89acb344b80765795a8dad5fbc3d1
MD5 7a583a38d835162533b9c6346be83691
SHA1 d98d583d8b52f48c0d16c09f7344f702eb81751d
SHA512 fed162e7c70722fd42854ef941a0367e3e6abf726391e4c0aa6fa0d788a01af7691ded67920a804c4870f3a0c1473d1e634e11f704bc31f0491cbc9991b79a40
SSDEEP 192:sxZpR7yMqZjK1Ml8UQrbkq/fhsq5Zd1zodpHlHW6+WNGYvAWIVP2IIg5XzJ:sxZp0qMq/fhsq5zeFHbGTVfBl
TLSH
T13C62E91AAA3499778CDBD219F5457B53D2F91173E2904E84A9FCCB1C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 77853e15e04f66355f35d2b34b824c90ac30c8338b72540d7975c7625837b8ea
MD5 1019db34a08207eb63e1b9f5b8b87f6c
SHA1 57b60e3a4703a8e3a40d393f029c363b21115051
SHA512 f1f0981f2a436ddcb581bba5304256bf6a6c3c2a03e2de96814686f5f3d9f14f9e11fd8e12440efe974cf73f52aa4841777118d1d2a3d847487b1a03080391bf
SSDEEP 192:sxZpR7yMqZjK1Ml8Mkq/fhsswxaZd1zodpHlHW6+WNGYvIuWTP2IIgjzJ:sxZp0Mq/fhsswxazeFHbGTfjl
TLSH
T1FC62E8166A3499778CDBD219FA457F53D3F81133A2904E84A9FCCA1C05E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 934f069b6e748ce4a8a1ac6dbe01d9b5afcb84458914d5d9ca99e5dee13b7c1a
MD5 e784ed9833a9c9dd418aab2997a47e25
SHA1 86853bd0d18d4218e3dfb098f58f460894c88310
SHA512 64d5d1b87e30407e240a296935448253a7d7c4368252ebe855c6f7fd9a9543df09207da3db433159e0fc495015f25ee9817b32a309edead94c643836756eec51
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGa:05ppxnY753RNBvRJJdt7p5J9j6d/
TLSH
T1FDB26A5A703E0211397E298CB39696364F4235A37058E4AF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6bec985aff65c2321be7bb3c62ddde964028a8dbc8a293c0d5777d6f8e687793
MD5 dfaa33f97b88c8d0187b4332d9d5608a
SHA1 eb81b50fdbb1278715847ae4d9f1712bcfbcac13
SHA512 080448916a6212fb029697976dc802836f43277086511c10925f5b23043638a583740b73eca18966940afcb81302c128a9ebe8145b15a4067b96d17676c98be2
SSDEEP 384:n1iFiZcIsX3sNO8TUNTUlI4IQckCr2U8phiftG4WXGXMLDlOObjI9G6w7mt4ty/J:8FQK3Hwg1kaKoG4+AMLDl29Mo
TLSH
T1ECD25B37E864CE77EDE78B95B74A3A079EF442638ADC4AC4D5D85E0C01975AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3787ccb1d783ae70ce886b82bbbd40c1bd7ceb4790f9ed17eca550a45b020ac3
MD5 9ec125d01e45b15f01927d73c551c400
SHA1 f5c84b47ece6e23cd49051ae5b4a400767c9874d
SHA512 b3d3e00d56622bd1dbe7763688715b4955b6cb260db1014da0b2fc7de5eb193cece9fa1bc1b34bc3bc77cfcca79376884141a9dd98866802568eb5d2b3d021c6
SSDEEP 384:nqiFiZcIl3sNO8TUNTUlI4IQckCr2U8phiftG4WXGXMtDlOObjI9G6w7mt4ty/79:hFQl3Hwg1kaKoG4+AMtDl29Mo
TLSH
T17BD25A37E864CEB7EDE78F95B74A3A079EF44263869C4AC4D5D85E0C01975AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 040db882fb35ad6a2f0bd30ea3c406df28348cea3658d6416da00fb601d8fea7
MD5 06eda6b1f244b8b1e5514e2f6d1dbfd0
SHA1 9704629c7d3c2fd7110c96df419f0bfbaebc19eb
SHA512 4c06d6556c4397c17f78081abdb33c0a1ab64421d788d3c307cec3d8571149c60bcd8fb9fcc76f17401927f2ae68db2257683eabe480f77e02b6cd0550d095e4
SSDEEP 384:np1iFiZcIl3sNO8TUNTUlI4IQckCrzU8phiftG4WXGXMtDlOObjI9G6w7mt4ty/J:p8FQl3Hwg1k5KoG4+AMtDl29Mo
TLSH
T19DD25A37E864CEB7EDE78F95B74A3A079EF04263869C4AC4D5D85E0C01975AD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 891c72b2be20f80418972082b0ac378a38522195b4f3067c1e470e6c170805ff
MD5 bd30f7339c03d3c855796b062f9bf546
SHA1 17fc08a107dbb904215b8b72f358a8d4fa0b5d0a
SHA512 ee5dbc9a58fd35d50e64be4e976cb5230dfda70f3038058f15c2fe121cf8addbc6bc5d515bc39760c3f6c9be7af117a2551c0cdda6ba2e3939404866bc2847a6
SSDEEP 384:npZiF9CcmyWCs3sNq8TUNTUlIm2QckCr9BP5phiftG4WXGXMwDle4KV8p0nLatyL:pwFccps3XwgbkU5noG4+AMwDlI8p0nLP
TLSH
T17CC25B37E854CEB7ECD64B99B74A3A03DEE0526786CC9AE4DAD81D1C00D71ED530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 34976f87b545a2d16455067dbcd3d855d23e5a04cad3ef31696991d4ef676c8e
MD5 b6cbf2546bfda3e0cbb3f7bf569ae391
SHA1 8992856d59e2d7870bdca884e1ec58a990c012c7
SHA512 6079c853856656000ba2c64c63d5e60a59633c3ef86ffa9e9e7963003397bab437288f3a225274de8d0bd1e1dff815b35c4489a89699809063652bb7e9791227
SSDEEP 384:np+iF9CcmyWCs3sNs8TUNTUlIm2QckCr9l3KphiftG4WXGGopJe4KV8p0nLaty/j:pVFccps3NwgbkU9koG4+pkI8p0nLP
TLSH
T1ADB25B36EC54CEB7EDE74F99B74A3A03DEE0526785DC9AE4DAD85D0C009719D030B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 69b108e1c303503a9a8464aa5c0cf769d5f4a45c1dd8e6b5a25f41ad70c5bb4f
MD5 00e8eef5448db9af95b9be2baa93e709
SHA1 f9903756875b76e5fb0a14e97fcead3f3c94fc14
SHA512 8f90ea228216e306b0004bd0acc5a175ce149dbdf37ea61b79f058ec67e1c3caeb5be7a944cb88f72a48ab718efcdff7b8257e8821dacf27cb813f5284f2586d
TLSH
T11541075CAAF91158B3B7AE4A9FF6A86E447FB9772F06845D00010D4E0723A41D9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3256-200-0x000001EF06750000-0x000001EF07750000-memory.dmp

Download