e2fb9dac2918e99e1801d25769a2bd0e906dfcfd95c7d13389e51a11729f83a0

Analysis

max time kernel
148s
max time network
123s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/07/2026, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Divine Darkwolf Gamer90 - YouTube (7_23_2026 1：44：38 PM).html
Size 9.6MB
Sample260723-wccdbassaz
SHA256 e2fb9dac2918e99e1801d25769a2bd0e906dfcfd95c7d13389e51a11729f83a0
MD5 01f2b74f63257a6e9ea8a188033b9335
SHA1 bccbf11be1afd8cfd3f026a17e7becaba3add106
SHA512 3e9ae051034002db10b2722a358a67d01be47bb46d8c5e897f7367cd74b42fbe9c1a8516224ebbc078a2bbe40012756bb20693a28aab44b8df4f0c9c9666e940
SSDEEP 49152:qSN9ayrK3BxGXCdQM3+Uz6Xh3ZrG5PBCaRXfw17itvYYMySFcbMN+lGxBAfANg5y:h
TLSH
T14DA6F1F0A65037BF89875CC8FEE16B1E7C07D193468A18F0C5DA567622EFCA47D18229
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3068	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293023882537909"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{C0EA1A8F-4A91-43BE-AE4C-9FBBEA4BBD36}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 3608	6020	msedge.exe	80
PID 6020 wrote to memory of 3068	6020	msedge.exe	81
PID 6020 wrote to memory of 2812	6020	msedge.exe	82
PID 6020 wrote to memory of 2812	6020	msedge.exe	82
PID 6020 wrote to memory of 2812	6020	msedge.exe	82
PID 6020 wrote to memory of 3524	6020	msedge.exe	83
PID 6020 wrote to memory of 3524	6020	msedge.exe	83
PID 6020 wrote to memory of 5360	6020	msedge.exe	85
PID 6020 wrote to memory of 1700	6020	msedge.exe	86
PID 6020 wrote to memory of 5360	6020	msedge.exe	85
PID 6020 wrote to memory of 5360	6020	msedge.exe	85
PID 6020 wrote to memory of 1700	6020	msedge.exe	86
PID 6020 wrote to memory of 1700	6020	msedge.exe	86
PID 6020 wrote to memory of 2444	6020	msedge.exe	88
PID 6020 wrote to memory of 2328	6020	msedge.exe	89
PID 6020 wrote to memory of 2444	6020	msedge.exe	88
PID 6020 wrote to memory of 2328	6020	msedge.exe	89
PID 6020 wrote to memory of 1316	6020	msedge.exe	90
PID 6020 wrote to memory of 3136	6020	msedge.exe	92
PID 1316 wrote to memory of 5536	1316	msedge.exe	93
PID 6020 wrote to memory of 4944	6020	msedge.exe	96
PID 6020 wrote to memory of 4716	6020	msedge.exe	97
PID 6020 wrote to memory of 4672	6020	msedge.exe	98
PID 6020 wrote to memory of 5324	6020	msedge.exe	99
PID 6020 wrote to memory of 5324	6020	msedge.exe	99
PID 6020 wrote to memory of 3224	6020	msedge.exe	101

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Divine Darkwolf Gamer90 - YouTube (7_23_2026 1：44：38 PM).html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x21c,0x7ffcedcfc188,0x7ffcedcfc194,0x7ffcedcfc1a0
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,11579137108141760688,13283435315963205111,524288 --field-trial-handle=1856,i,14742093581630138186,12017156923396914272,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,18123474112548651610,17287910063492970826,262144 --field-trial-handle=1856,i,14742093581630138186,12017156923396914272,262144 --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,10796106563099799368,16740145672782122328,524288 --field-trial-handle=1856,i,14742093581630138186,12017156923396914272,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:13
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,10548547778487419820,5530790347051928949,2097152 --field-trial-handle=1856,i,14742093581630138186,12017156923396914272,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,7765382328405365760,15983870563275345308,2097152 --field-trial-handle=1856,i,14742093581630138186,12017156923396914272,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,15984661091228946792,11810315113320523824,524288 --field-trial-handle=1856,i,14742093581630138186,12017156923396914272,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,11865721253673154662,2560639252929837637,524288 --field-trial-handle=1856,i,14742093581630138186,12017156923396914272,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,13881890726882691377,5766426417819327918,524288 --field-trial-handle=1856,i,14742093581630138186,12017156923396914272,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,17572712099962380884,4285088781531323724,524288 --field-trial-handle=1856,i,14742093581630138186,12017156923396914272,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,17572712099962380884,4285088781531323724,524288 --field-trial-handle=1856,i,14742093581630138186,12017156923396914272,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,11277994531718532940,5576978950251231891,524288 --field-trial-handle=1856,i,14742093581630138186,12017156923396914272,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,9310301002048354533,12407703895774600764,524288 --field-trial-handle=1856,i,14742093581630138186,12017156923396914272,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=568,i,10977112550170846401,3856720476008208619,524288 --field-trial-handle=1856,i,14742093581630138186,12017156923396914272,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,1683642279773734600,3300438096675560776,524288 --field-trial-handle=1856,i,14742093581630138186,12017156923396914272,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:14
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5764,i,12972653760434765070,11696067228930703777,262144 --field-trial-handle=1856,i,14742093581630138186,12017156923396914272,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ee067a9907f8aa30e669f95b9c2bc957f76b8ef11b5e1b462bac75380bbada54
MD5 27d6d73600a1f9a2725385f696d4ec09
SHA1 c19e1d169036091c4c0a138ea7682e9bacb31847
SHA512 5970385f99c2c2b69c5f5c8d089b5e18916c3544288d1df1374ce714ee80d6c7a6a78b7a0624d8af5c6d2a7a5619b4706a6080d9f424dd5840c6a0563a7f4a94
TLSH
T1A8E02BAACC229C3B08FD072978504746E71223663A41490F3B3D820DCFB463A169691C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e3879a4c349086c0e4b2f355cb19338c27cc95188933d378a5a3171fa12c562d
MD5 1958d3c6d5af4f552957171435d5e3b2
SHA1 560de1e0511c033f1a8efcc81cc79ba86af360b5
SHA512 e2a78cb96a4b9f641aa32cb3f8f625e716cdcc6ae79aa79e66ad7146ddd9bdf123e9ec9f1b23d51e13228185055bd12c3bc0d8f2b5afb6ec5ac9956dc8002a01
TLSH
T12331A1F743B4856E9A11D6F0AA18BE2FDE2D0511432C7DA9C5E0AE27D3E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5699a80ec84dfdf4b208b211354e8b6b7ba29a810160b5928e78fa6273cd02ef
MD5 f5d9a3369637055e44f1bc3f15541a42
SHA1 90696433e9bf63a2c90f259175f99051875784c2
SHA512 9678ba821059ffb3144313bd0736a9ce83441f4a111f7ee7912689cd484a56ab8c36df669e154aaa59f4cff350ed36c4266d3799501bfd7f3ba1fbb378b5b22c
SSDEEP 192:sxZRLRzyMqZjK1Ml8UQ6FK/fosKAT18KQ7Pm0gzodpEa/W6+WNGY0Zh3y7Ig50JS:sxZtsqgK/fosKATaV7+0DH/bG50OJS
TLSH
T10B62F9066A385977CCDBD219FA457B53D6F91573E2904E44A9FC8B0C00E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5d021120e90e9c86581a1211fa5fa685db5d6dce912dc6575ae5cc016a33f321
MD5 42437e509ade4b7c9e4727c9556611fd
SHA1 d3d3a84e3e038ef51464b0440d8e3d56f6decb90
SHA512 062a03ccf2fd8dad419c7f4ffd666e0a475d9d177e45f063ea22aa73587141ed87d1594b55b7f06d72d838fd00cb5b76af22a6b96d4b0155c2ac2e6221ce36a5
SSDEEP 192:sxZRLRzyMqZjK1Ml8MFK/fosqATeKQ7Pm0gzodpEa/W6+WNGY0ZYLH7IgjJGJ:sxZtsdK/fosqATeV7+0DH/bG5yjJS
TLSH
T14762E8166A385977CCDBD209FA457B93D6F91563E2904E44AAFC8B0C00E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 0dc0fb9144ea796d9550509428b3774afe788a480b5de36b3fa44af52d7ad8a4
MD5 a9d7f872b5a853cda67e2f78e6f01514
SHA1 526b636c3658443e2952d90146568b34eafec42f
SHA512 e79b80e2dced729501c6fb3ca5ae9fecfce52ca7fadb9733663d0de7e5160816f55a9f8fe090a8e73008512467c3e05f910f9f57513e1feb06c1bc78d61fa041
SSDEEP 768:XwZh38Dv2aFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV309Ll/lv0bzkro1o:XwZh38Dv2aFWRm6GQFmu1jaK09LplMbC
TLSH
T119E21B3B280CC77E4F844E9DEC266F966ED802CB66684D5447FA894C03CA7EF511B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 7104f8a1a13a850da27b98f6f23d418b9da59537874d6a65e1e76b2adec2c75c
MD5 34ca3163566878590ae08e256b183356
SHA1 ae70c6dfae77921cc5a810d04b008a0ca4b4842e
SHA512 280f877ef2059ce3e6e2417eb93ee47ec66531b15a116b113fb1da08d31168bebe51d1b6c0d0539df63cc9d7c445ebb4e35e2a6636c3c7bb6206154dbe9e2873
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlNwTkgKWCBG9MIspMiBs:ctGj+BCNC5qFVpKxpHm
TLSH
T16AB2891632BA02023C3DB91D87A5DB375A42B1633018E93B7BE854B64E67E215DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 67dd121f9a3b32fa442f9b9a30b61e371cf6f0c62b574013b446b8c009bf0aa8
MD5 50ac843660b853e94cd222cb1b1434bc
SHA1 ab63463790d8b984dc94d2c4dad6a697f90a4cb1
SHA512 28068eaaefb2473de8c6cd02312cdb9a24fe7f1f4e72b1bc40a99aa3c0025938ef445493c95e208534efd90877121c430e09b37959c9e1643dcae989dbdd8c59
SSDEEP 384:nTiF9CcmyWCs38NF8TUNTUlIxBrk6oDjF1ifbLokoK1+K0SvJe4KV8p0v1ty/7Iq:+Fccps3Cwg4/juo6+K0SvJI8p0vc
TLSH
T1A5B26B32EC59CAB7ECDB0F9AE74A7A03DEE05167858C9ED8D9D81E0D008719D134B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4e96042007730decb739e10320b8ae2022b433456cff34b27411ee4804171486
MD5 126d54412ae14da1ba3c4b68125162f8
SHA1 fb8901116c0a5c6e00cf50c711da75d8c79d7fcc
SHA512 5e3320fb5508a2a6915390477b5b0857ac489fe6348d84543af92ffa9d3da5306031a83af11fb10362f793e6c99b7a02e8230ae30069630320541796e6384177
SSDEEP 384:nWiF9CcmyWCs38NE8TUNTUlIxBrk6pBB71ifbLokoK1+K6XIRHAe4KV8p0v1ty/f:9Fccps3jwg4SBco6+KiIRgI8p0vc
TLSH
T167C24B32EC59CAB7ECD64F99E74A3503DEE05167868C9ED8D9DC2E0D009B0AD570B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3a7125be313b226c5699a784e4f522da097bc09375c64bb02617a071494cca7f
MD5 4ae4e9f7344fdb94aa7dfe6fb2f33254
SHA1 7b1b1fe8ec95e12b5cb7bf3fbbcd382565089028
SHA512 e366d056d130d87ee99d6d41e2123c603f3c6d93746060e15813b16e6b6bbc4908dc9b456ba36e66d5a9a05a48d1afb9a0e0e406fe9bc8e9f83247eae775ee0a
SSDEEP 384:naiFfCcmyWCy38No8TUNTUlIRlrk6Rkh491ifbLokoK1+K6XI4HAe4KV8p0v1ty+:RFacpy3TwgMb4mo6+KiI4gI8p0v5
TLSH
T199C25A32EC59CEB7ACD74B9AB74A3603DEE05163868C9ED8D9DC6E0D009B09D130F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 106d33a831e5561508f49ebf74a1f3236d67dd9284d8e971dfbdda0bb990a274
MD5 caa0c7ef26c62973b6c622a72ef87a80
SHA1 c41259e39654487a0ac1c368f2a1a85737ddabd1
SHA512 4e6aacf282d297b3fa39e4f9e4e69daa6aa8b0911db7f19da72261efc264362e7d3dd7107db0d994f09459b90b2b7c1aebfcb36bfdfeb162020319572c09be06
SSDEEP 384:njiF4ZcIA38No8TUNTUlIR+rk6Rkh491ifbLokoK1+K6XI4HAOObjI9G6w7mLAnz:OFGA3Twgrb4mo6+KiI4g29My8
TLSH
T153D25B36DC59CAB7ADEB4E96B7993603DEF04163C68C9AC8D5D96E0C009B49D070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6b6d2c1526fc97a7a618b13b64cd7ed82a0c5080f1829e4e5a810f6d452e6995
MD5 e215a5120bad2396588e3ab3c3aee394
SHA1 f6e1055a4b0c6b549e3edc60a276db07d9fd6caa
SHA512 90ab19723b4f503ca2a7b96e973b8d03f72f1aadde243d17fb7aa0f6adb96c686bd1414ada8e0f27ba3284d33aedf3198584c9c213fe4570cc931624e6e3f8b6
SSDEEP 384:nYiF4ZcI438No8TUNTUlIR+rk6Rkh491ifbLokoK1+K6XHYHAOObjI9G6w7mLAnz:jFG43Twgrb4mo6+KiHYg29My8
TLSH
T168D25B36DC59CAB7ADEB4E96B7593603DEF04163C68C9EC8D5D96E0C009B49D070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 15f42b662d45eab54b11960862d16070645ba5fbbeb62cb214c55c14138fbda8
MD5 501d9b6b226f3aea33adc730fb611a81
SHA1 7105045d927b80a3170b76a0683ab2001e497429
SHA512 7773460b5022cb7afba2f614e1ec3c7f28609b293fff350f7b9c3a62a6b7738b79674eb90f57b279dd8b3a9dbb7ffe100c484e97dbaf8ad9e0e0f3fc89a8921d
SSDEEP 384:naiF9CcmyWC638No8TUNTUlIRZrk6R1h491ifbLokoK1+K6XI4HAe4KV8p0v1ty+:RFccp63TwgMO4mo6+KiI4gI8p0v5
TLSH
T105C25A32EC59CEB7ECD64F9AB74A3603DEE05163868C9ED8D9DD6E0D009B09D130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3136-189-0x00000139ECE00000-0x00000139EDE00000-memory.dmp

Download