406851464eb3f3264d0cd3baf4cb83b5e3a6973b24bd9f63915a9edf2e78b896

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NetworkManager-1.46.6/docs/api/html/NetworkManager-wait-online.service.html
Size 8KB
Sample260724-pg9faazdkc
SHA256 406851464eb3f3264d0cd3baf4cb83b5e3a6973b24bd9f63915a9edf2e78b896
MD5 5ca30194331918aee40c424725218f4f
SHA1 2c7d65f9c43528fe7444d7f6d426937546ddca0b
SHA512 90468ec585d5c05de51033e5750cbdfc5efaacbd74d8aaeac08c29ebdca90ada4e3cc7c5469f42de9927138f57212d9be7534e3883a8eeacfaed620413a99dd4
SSDEEP 96:Kolsr0fIm7l44YEZx3FJWYWCRFNUXqmI3GwP1mP8MuBRT9L8Jv6sF+0sqMR87igu:O0JxV1w0NUbo13MIVmA1/WwRh
TLSH
T106023213E3DC1F37091781A2EE496F65B2DB104EC25310BCB9BC833C9B87DC9566A65A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2112	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293692849143020"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{97E443E9-99D9-4F50-A4C2-708448875A63}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 3808	3992	msedge.exe	85
PID 3992 wrote to memory of 2112	3992	msedge.exe	86
PID 3992 wrote to memory of 5728	3992	msedge.exe	87
PID 3992 wrote to memory of 5728	3992	msedge.exe	87
PID 3992 wrote to memory of 5728	3992	msedge.exe	87
PID 3992 wrote to memory of 1796	3992	msedge.exe	89
PID 3992 wrote to memory of 1796	3992	msedge.exe	89
PID 3992 wrote to memory of 1536	3992	msedge.exe	90
PID 3992 wrote to memory of 1800	3992	msedge.exe	91
PID 3992 wrote to memory of 1536	3992	msedge.exe	90
PID 3992 wrote to memory of 1536	3992	msedge.exe	90
PID 3992 wrote to memory of 1800	3992	msedge.exe	91
PID 3992 wrote to memory of 1800	3992	msedge.exe	91
PID 3992 wrote to memory of 5812	3992	msedge.exe	94
PID 3992 wrote to memory of 5812	3992	msedge.exe	94
PID 3992 wrote to memory of 5380	3992	msedge.exe	95
PID 3992 wrote to memory of 5380	3992	msedge.exe	95
PID 3992 wrote to memory of 2288	3992	msedge.exe	97
PID 3992 wrote to memory of 1648	3992	msedge.exe	109
PID 3992 wrote to memory of 5520	3992	msedge.exe	110
PID 3992 wrote to memory of 4440	3992	msedge.exe	111
PID 3992 wrote to memory of 5384	3992	msedge.exe	116
PID 3992 wrote to memory of 5384	3992	msedge.exe	116
PID 3992 wrote to memory of 1764	3992	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\NetworkManager-1.46.6\docs\api\html\NetworkManager-wait-online.service.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffc25fbc188,0x7ffc25fbc194,0x7ffc25fbc1a0
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,8433758086932957447,17783790344057231152,524288 --field-trial-handle=2320,i,9911222126903598303,389343274767970963,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,18024748509681059114,1510599392261339992,262144 --field-trial-handle=2320,i,9911222126903598303,389343274767970963,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,16175445901838550070,17953739460214208354,524288 --field-trial-handle=2320,i,9911222126903598303,389343274767970963,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,132242484915308289,12811943509066667031,2097152 --field-trial-handle=2320,i,9911222126903598303,389343274767970963,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,16178876914516287204,542831243152489337,2097152 --field-trial-handle=2320,i,9911222126903598303,389343274767970963,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,9214352244603009932,11290764913109311228,524288 --field-trial-handle=2320,i,9911222126903598303,389343274767970963,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,5349282944850193006,4480140440142685254,524288 --field-trial-handle=2320,i,9911222126903598303,389343274767970963,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,6266382717047595370,6064666474133760218,524288 --field-trial-handle=2320,i,9911222126903598303,389343274767970963,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,6266382717047595370,6064666474133760218,524288 --field-trial-handle=2320,i,9911222126903598303,389343274767970963,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,15945025078519303148,9709795743109324170,524288 --field-trial-handle=2320,i,9911222126903598303,389343274767970963,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,3575809005201227772,2357323810166593452,524288 --field-trial-handle=2320,i,9911222126903598303,389343274767970963,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,16659810112942860678,6919924716927053307,524288 --field-trial-handle=2320,i,9911222126903598303,389343274767970963,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3032,i,14990801881733499131,10263618315094298089,524288 --field-trial-handle=2320,i,9911222126903598303,389343274767970963,262144 --variations-seed-version --mojo-platform-channel-handle=1004 /prefetch:8
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5808,i,4905076745435271171,7823579867535096736,262144 --field-trial-handle=2320,i,9911222126903598303,389343274767970963,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 494a7e7fcfabf27d4433475b8df0ec2640c2191927d183e610077b547e56c3fd
MD5 5447cfb8759c5249c39a141f652c95c4
SHA1 c137b4fa3b5f45bf64a789dd355878368c76bfa5
SHA512 7aac2a7771d0da872aad9cbda79077195b9a828352117a3998010294ec6cfd554526abfa796801e69036ca83aa519fcb1bcf362e1f6223a61c3c45b7abae06d6
TLSH
T1D9E0EDAAC822FC3B18FD0719B40D8B86E75013272B40894E3B3C820A8FB463A46C585C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f76a56c3c037a33d0e83151ce1a8e72d41e389087a5b373b421c9813c2e36ffb
MD5 4bbfa246ca88f338cd012d134d274cd3
SHA1 879d2175a9c1071e4c1c909ab91281555c2aebfb
SHA512 0056d073a51541750ce85f751d6e366a4015884362e58277b183d3bee44d319b88d8ca0e44bbfefb80b670f713519a8c59938dfba9e973ab0a23866594ca649a
TLSH
T1D831BEF783F4856E8A1196F0AA18BE2FDE2D0511432C7D9AC9E4AF1793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f4b34ee190c794a4076a3fcfbf1d551b863612642b7f14378d9f78435c34913b
MD5 0318cfaf0bc73f575a219b8c5f9a0aca
SHA1 51eaef734176e17ac775ff42f0f00857495afa66
SHA512 e32844eaec1fbfce3f5ad20a98cf9515132247120df0c37dc66fe8f6da7358f300c6a94f7ab39db006a9b6de18dd3cf52ffd736ca45f082869b054492fd60e5b
SSDEEP 192:sxZqR1yMqZjK1Ml8UQFkH/f7sNviZdFzodpHjNHW6+WNGYvI71kNIg5inJ:sxZqCqOH/f7sNvizODNHbGlEEJ
TLSH
T1BD62E80A6A3499778CDBD219F645BF53D2F90163E2905E4499FC8F0C05E7AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f87595347b1f84afa81111d5be5283e5bf57b7d22c6e9e72b5741c698186ca6e
MD5 948c44c39a4e12021f5a9a8e32286519
SHA1 501842f3aadf7eaa81df34d4afad45e0994dca15
SHA512 b197f962bd106c7d70d4559d17fd11c49c706d3985080a849af64e945a3e530c4cfa225403148b025386135903092586a3215183193cb615094f9c4beefeebea
SSDEEP 192:sxZqR1yMqZjK1Ml8MkH/f7ssZvJaZdFzodpHjNHW6+WNGYvIu78kNIgjnJ:sxZqCMH/f7ssZvJazODNHbGLEjJ
TLSH
T1D162E8066A3499778CDBD219F645BF53D2F90163E2905E4899FCCB0C05E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 ea7be5fe910a061d03f976d4a198863acbb3733ff54be96268879c71a8835f44
MD5 78a79a2e0dee002a82c228fe8ab659d2
SHA1 5e87b25da5c450d6842e8589361ab955b0323ded
SHA512 5401eb2f0390741f8eb40630d250624f140d12b3dad403506411bcdb1a679e65f6ee9c44b41e548b11b8a850416d1df39f8e7fd5a0e5e3085ebacbe11afdc57d
SSDEEP 768:0LppY93PBZJPtN53ATy3jJlZEdQ3bvV7RMrbAxzdt:0LppY93PBZJPtN53Dbt
TLSH
T154B2595A703A0211393E2988B39596364F4235A37058E4EF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 23c02cff119ce8230748d38c133487ea973c73539b00a6e54e27a76e5cd7dead
MD5 31c3699f15936272908fd8ede89a64a4
SHA1 f7de5591438dcb031c09b32c8a3c1b5e2eda1598
SHA512 6cf9e6a5a26b42ca993b87f7500c445688c2152ce0ac9537c57f131ab146480a9ea8469767e4bfc8fdb98fef0564ee90619df7ece6e32cd182ef85ed9c09f82b
SSDEEP 384:nSiFiZcIH3sNZ8TUNTUlI41QckCr6rrphiftGfFmmEEXIQ/4dWnjngwXOObjI9GS:ZFQH38wggkpFoGpENdwjngwX29Mqr
TLSH
T1B9D26B36EC64CEB7EDEB4F95B74A3A17EEE04163C69C5AC8D5D85E0C00970AD430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 fe8aa643858e32975800ea19a75aedd8b44f57e78d492afe46b7d9397109fabd
MD5 ece35414f053d9f3189c844dc3d3e19b
SHA1 2bd0f5158af5e4e000a8978f596131c3c2ff7d4f
SHA512 ffbc6a2e2e63cc63ceaecf3a395a92ebdaa095700e1c3b6348a7c72c15b1823d98645999d40d9a91206c1cdd90c7c2fb682dff22b511fc0da2e5fa493fb0f04a
SSDEEP 384:nTiFiZcID13sNZ8TUNTUlI41QckCr6rrphiftGfFmmEEXIQ/4dWnjn2wXOObjI9r:+FQJ38wggkpFoGpENdwjn2wX29Mqr
TLSH
T19FD25B36EC64CEB7EDEB4F95B74A3A07EEE44163C69C5AC8D5D85E0C00971AD430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 db20623bf86ccff60a55e409f9b16df22bda8375c94a64251d20f44df29b81b2
MD5 d2142630205dc23f92acc1074564b72d
SHA1 1ed56a9821b1447b0fd261dbec8ccfd35989a5ee
SHA512 559d5e3edfc455229ebf53b958cf1ec1b38824f2322c2ab7e74126277fb059c44c5f801250ec731bc726a7628d62949cf0e2f001243b132d91318bda484ee521
SSDEEP 384:npBiF9CcmyWCs3sNK8TUNTUlIm2QckCr9l/KphiftGfFmmEEXIQ/4dWnj22pde4a:poFccps3bwgbkUZkoGpENdwj2SI8p0KS
TLSH
T196B25B36E868DEABEDE74F89B74E7A07DEE0122785DC59D8DAD85D0D009319C430B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 51f8acbe5d62ba90da0fa9b4b8f45ff905f517fdbc11166450f6b2b724e94e4f
MD5 7ca8ac6cbd624650a3ecf52c9857bc03
SHA1 a4b8e480c023e35820951ebf4e839508e6addc29
SHA512 4c974d830a7725e9bf7244253115ed579f136a8348fcb2eefacb54f7a3fce7f062dc876bdda411c87b033711be7ae66fa43f37108505bf41c13baddf24a6341e
SSDEEP 384:npEiFiZcIH3sNZ8TUNTUlI41QckCr2rrphiftGfFmmEEXIQ/4dWnjngwXOObjI9r:pfFQH38wggk1FoGpENdwjngwX29Mqr
TLSH
T1CBD26B36EC64CEB7EDEB4F95B74A3A13EEE04163C69C5AC8D5D85E0C00971AD430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1e54eb00b369e2f815495db86867e546ec5a4a77ca648152a1a16bdc7229549f
MD5 dd325027ae6894cef97aa97de3ff3752
SHA1 0740189bf5fb4adc4e1dcf10070af1424057f093
SHA512 1f43b7701d1d64d72f9269c38f2f067a8c438fae8f9a25be85413fd36a34f14108d535913d41650577c52933e327fae63736a661e46b11328c99e3efdcefdf97
SSDEEP 768:pUFccps3MwgbkU/+oGpENdwjn7wXI8p0KS:6s3OMHOXI8p05
TLSH
T153C25B36E898CEABECD74FD9B74A3907DEE04263C68C99D8D9DC5D4D009719D430B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 580d069da67cedc32dade367b3abd8714cc58de1db4228fb86273d2fb0e590a7
MD5 b1f784da52d4edae6fe4b197220a8474
SHA1 48a02dc6a7870f000eabd0c0177dac5a77087b76
SHA512 0b076f60c67deaf7bc5cdc5d8a01bf6f67a151486ef61c52dde4b285d5cf91ce8944a0ac3215b4565809b1f3490a534e64446c39bf0646fca60ce0215a06beeb
TLSH
T195412658BAE91148B3B76E56AFF7A8AD547FB8372E0AD45D00010D4F0627B40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2288-198-0x0000026B80000000-0x0000026B81000000-memory.dmp

Download