c430a6802aa574bb46874cd15321b27a4ba69c55c04f1f83072acce7b5e8a452

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
README.html
Size 2KB
Sample260723-w22phahn4x
SHA256 c430a6802aa574bb46874cd15321b27a4ba69c55c04f1f83072acce7b5e8a452
MD5 ab3a8287f8e9ab6d80ab5870c9f844a6
SHA1 5e521d5161bfab7b2c041146aa1e12ee85a1ba4c
SHA512 1143e5a5dc825152d64a7af57c19f495a1a21192f3b16cd7aed9c6acfaf796d093f692655b74d7f516576acc96726b821cf8034978baabb9cbcd1783b8d48bee
TLSH
T11E51DC73D7926F37A163035E714AE3D82F11F1C19054AB18B2BA81D67DCA12B60673DE
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1080	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293047790669252"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{9EB01CAA-04CB-417E-9FF4-BE41C1140753}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 2892	728	msedge.exe	86
PID 728 wrote to memory of 5164	728	msedge.exe	88
PID 728 wrote to memory of 1080	728	msedge.exe	87
PID 728 wrote to memory of 5164	728	msedge.exe	88
PID 728 wrote to memory of 5164	728	msedge.exe	88
PID 728 wrote to memory of 1804	728	msedge.exe	89
PID 728 wrote to memory of 1804	728	msedge.exe	89
PID 728 wrote to memory of 5340	728	msedge.exe	91
PID 728 wrote to memory of 5340	728	msedge.exe	91
PID 728 wrote to memory of 5340	728	msedge.exe	91
PID 728 wrote to memory of 5492	728	msedge.exe	92
PID 728 wrote to memory of 5492	728	msedge.exe	92
PID 728 wrote to memory of 5492	728	msedge.exe	92
PID 728 wrote to memory of 5652	728	msedge.exe	95
PID 728 wrote to memory of 6020	728	msedge.exe	96
PID 728 wrote to memory of 5652	728	msedge.exe	95
PID 728 wrote to memory of 6020	728	msedge.exe	96
PID 728 wrote to memory of 4668	728	msedge.exe	98
PID 728 wrote to memory of 1800	728	msedge.exe	111
PID 728 wrote to memory of 3316	728	msedge.exe	112
PID 728 wrote to memory of 640	728	msedge.exe	113
PID 728 wrote to memory of 6000	728	msedge.exe	115
PID 728 wrote to memory of 6000	728	msedge.exe	115
PID 728 wrote to memory of 4292	728	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\README.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffcde21c188,0x7ffcde21c194,0x7ffcde21c1a0
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,7806984324098778674,2535632599913434398,524288 --field-trial-handle=2316,i,9761375062146822405,12379616882154263769,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,8230138854906432,17956117301629491404,262144 --field-trial-handle=2316,i,9761375062146822405,12379616882154263769,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,1728887696459448629,13789234002124436625,524288 --field-trial-handle=2316,i,9761375062146822405,12379616882154263769,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,14885200486105913004,8629680938684341290,2097152 --field-trial-handle=2316,i,9761375062146822405,12379616882154263769,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,7815091862552069759,15151958947702746913,2097152 --field-trial-handle=2316,i,9761375062146822405,12379616882154263769,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,3471415674498886470,17681863421058555690,524288 --field-trial-handle=2316,i,9761375062146822405,12379616882154263769,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,10651384413677932508,15232607190427690624,524288 --field-trial-handle=2316,i,9761375062146822405,12379616882154263769,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,207072505523422854,15417001230784266502,524288 --field-trial-handle=2316,i,9761375062146822405,12379616882154263769,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,207072505523422854,15417001230784266502,524288 --field-trial-handle=2316,i,9761375062146822405,12379616882154263769,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,16351331588794605233,13948269222860005309,524288 --field-trial-handle=2316,i,9761375062146822405,12379616882154263769,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,13506325972160933152,13732334583645073214,524288 --field-trial-handle=2316,i,9761375062146822405,12379616882154263769,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,830754184813696108,9237203099178124228,524288 --field-trial-handle=2316,i,9761375062146822405,12379616882154263769,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,4876296514449358060,870432378213603517,524288 --field-trial-handle=2316,i,9761375062146822405,12379616882154263769,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,5035984525952046118,16706746661836009047,262144 --field-trial-handle=2316,i,9761375062146822405,12379616882154263769,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cd0fa3f8098efa8d7596cc993e3434bb9ae45935e7e2e0158fcee33b05db9784
MD5 8387f3e543795b5337af87dced227b02
SHA1 ba7718e68b4ff0b183e9534d3b04442bba07cb38
SHA512 34b567da2ce1178c0e0446f141a85bcd56d164ad41f5e7f371aaa7e4f273135e45f11cd79dc02624c8b1d41f539e97144f18feae206b563a4f509225b5bc9674
TLSH
T191E022BAC822FC3B08FE4719B04D865AEB1013573A80894F3A7D82098FB0B2A56C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e23e7e45a033ca94382c780a909ad9b4091a8deba4a131851d08e916b7686a86
MD5 cd6eb460a380e1d85c62b5cd51f329f9
SHA1 8fa73d203a828f2d3b012f06d5f212db5af08a07
SHA512 c25374b18686acc539e0c42a21d80990c1784ce500cde4315012f72e9daa18829ff692bfff4d7df7c94d1f831ecf97a42d72f772c64a98268f104d9cff0edc67
TLSH
T19531CFF783B4856ECA1196F0AA18BE2FCE1D0514432C7DAA85E0AF1B93E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 356988abad928e765eb23a3cf9f127f03edbf55ad010b09aa15a56370ad5e8ce
MD5 2add6773e916c01bac832c4cffac9ba8
SHA1 af471d51edf20e30fe3696df44c924e09e9ee3aa
SHA512 4d2eb17b08c486bf2c4ef9eb77aac4d87a2f2c6e7764a759c2ec7df51411095edd449d8b8addfeda53c145c8831340067960f8b7e6a49a97aac190697b041c71
SSDEEP 192:sxZ0kRiyMqZjK1Ml8UQuk5/fp/snvzZd2zodpHDHW6+WNGYvLzBX/dHIg5PeJ:sxZ/DqF5/fxsvzzNjHbGgJlq
TLSH
T19462D7166A38597B8CDBD219F649BB53D2F90163E2944E44A9FCCB0C04E7AED320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8af07cf67fc06426895a05493b9f5fdc9f750ef6c89bec3ed6602924ffe1563a
MD5 40c5b457778054a5c0b12bce34eb8a62
SHA1 b9a60c3f2d5d38ba2cf44dd62e2d7584549f017d
SHA512 768ed5bc857927dcd875eeb332bddbb9920933552b87730b34cb2aa3b7b6aebb9afc0e1caf8849f75d06ea13bfdf21d0cbaa46c863afea863d8381a00051153e
SSDEEP 192:sxZ0kRiyMqZjK1Ml8Mk5/fp/ssAvOaZd2zodpHDHW6+WNGYvIuBX1dHIgjeJ:sxZ/DM5/fxssWOazNjHbGYJjq
TLSH
T1AB62E8066A38997B8CDBD219F645BB53D6F90163E2944E4499FCCA0C05E7BED320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3da7505351b9c8cca3b14bd92f09c15202cb0b56a7bc4432051313f7a71d1f22
MD5 b26969da64b42d76e12d93b573ff1728
SHA1 dc6f9e056b212537de3807703bcf6e0a978a1d44
SHA512 59882616f283d352be1722172c40e2112cd6c61f8101515befa7a4e85f6d1d0e0e390eecc31593533f5a15c1e99b3c78870fcc744b99b24a3a47a026a5427da0
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGG:05ppxnY753RNBvRJJdt7p5J99lH6
TLSH
T168B28A5A703A0211397E3988B39696364F4235A33058E5BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 76f7cfd97888efa83f7de0bc984e5bc0d73f04e95cc6a3455f5df89817871e6b
MD5 c382ea7c6c1f8d2976f648113d10ce21
SHA1 40413d31d2c23983bfd13a1fce16b5cbb7880e1e
SHA512 f8a70311e9811352e06790dada41e917d2869810599944056668c141f8592f1f86a9077ba04b1cf70d9da42ddeee169f1d45c5dea8f57f8c1034f4ba36cc0b5a
SSDEEP 384:nppiFiZcIk3sN58TUNTUlI4LQckCr4VAphiftGGr7DOYibj/+WAkMrHn2OObjI94:pAFQk3cwgKklGoGGr7cjGfkSHn229Mt
TLSH
T138D25A32E854CAB7EDEB8F85B74E3A139EE04267DA8C5AD8D5D95E0C00970AD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 77b8d4a34e19a284a97cbee44211a5bc4be1f3408d064f2f73055162dc9fc398
MD5 96ce37a045970e7025d6670e106571a5
SHA1 e6bea76ecc4358a879df424b49759dd542abbb8c
SHA512 44f84b3cb229a22510656f7fc48100d652735afbd75fcdc66a97ce2b9a419fd8297603fce0a873658c38752e990bb7f0f0be316b7a3cf76243e575db055c8aad
SSDEEP 384:nbiFiZcIk3sN58TUNTUlI4LQckCr4VAphiftGGr7DOYibj/+WAkMrHn2OObjI9GR:2FQk3cwgKklGoGGr7cjGfkSHn229Mt
TLSH
T115D25A32E854CAB7EDE78F85B74E7A139EE04267DA8C5AD8D5D95E0C00970AD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 34f49c6ec303ea189a7b9684861fc572d31d61e7d66bb1072cc2114eec22e697
MD5 5e0f39160844def4dee77892e4ac7351
SHA1 ea4a770b06a35783a4e22b2a75179562fa0956cd
SHA512 4091e9bfdda95a2bb9af06e9a637eb93eb9dc48b9eb819636baab9e47afc41e49bc5019e988a0ae3da129da41d9ed37ea70457e0bd4dbe90123efb102a78c30e
SSDEEP 768:p5Fccps36wgbkUQkoGGr7cjGffyI8p0IL9:Ls3sRsMaSI8p0IL9
TLSH
T11EB26C36EC58CAB7EDE74F89A74E7603DEE4122785DC59E8DAD81E0C00871ED130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9e1db56331cf83aa3113748129c218d52145dd73c8d034b6436385e42eba39a5
MD5 6f3b87c4bdcca3078e4d618e48bde141
SHA1 df99ee6871852c41f85c630cf9d8922ad7ee945d
SHA512 d0d3a830f063ae0985f6fc858ec0bdc6ff0c474f46520267f871149d7aabb0a61b0e0302e263d0def782dd35f7bbefe041cf772c597d2ee68a07ce5a147ad2bc
SSDEEP 768:pAFccpO3cwgzkpGoGGr7cjGfkSHn229ML:KO3MjsMa22+L
TLSH
T10DD25A36E858CAB7ECE74B99B75E3943DEE04267CA8C59D8D6C95E0C01DB0AC430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5bc3e2ce51a15ee859656a3f022318cd105ad1bec0d62e7658f8a97459600f5e
MD5 26e9e155bfc2fa6e5533279da1b30e2b
SHA1 f83b727caf01f5a840f6c867347ab48c2910cb73
SHA512 1e0e580824a1852f368d5808a96c4456d23cdf0ba706830f16e514ca5cc6e2a78e6a48f874c578710bc9c21834947f2d474928f988f2384543b64bb75a858e36
SSDEEP 768:pNFccps3swgbkUiDoGGr7cjGfkSbn2I8p0IL9:7s3uksMaKI8p0IL9
TLSH
T1E9C25B36E858CAB7FCD64B99A75E7543DEE4426786CC99E8DACC1E0C00DB1AD430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 60cdf231623f26d47b1f0c0dfd2533a6f526c5ca7aaf3bb18ea02ae62139047c
MD5 32bbeefd3f9ff09ce90a4afac93cc626
SHA1 73f288651086d64cf8e9d351b8bc220f5c88057a
SHA512 2b3ea2a8fbe4d683471794637dd0bd59981bbf09c89941a49c166905b9e5536c4ec87f525dd9425bd4efd01e165d7596d03136f9d71d6a6e44d5332c199dd85c
SSDEEP 384:nJiFiZcIlC3sN58TUNTUlI4LQckCr4VAphiftGGr7DOYibj/+WAkMrMn2OObjI94:gFQo3cwgKklGoGGr7cjGfkSMn229Mt
TLSH
T15AD25A32E864CAB7EDE78F85B74E79139EE04263DACC5AD8D5D85E0C00970AC430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f4b243a5ca589e26a704cf5d11a335590614a90c934e94bb16447bd2a70e97b2
MD5 386e573a57c38a7a33f63b4307d71734
SHA1 92300ec8cb3be246e9cbde7772383246312ff9c2
SHA512 a08c353bc09fccd72da70cd48c2351140bb8792b7c42516e34956bfc926ac78d73a5570c568deba1706829d905a2aeb3a5ec511fab704227fdacc855a9739c37
TLSH
T129410758BAFA1148B3B77F5A9BF6A86E447E7D372F06D49D00110E4E0666B00C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4668-198-0x00000210230E0000-0x00000210240E0000-memory.dmp

Download