a64a4545c3fabf2fcea35df1baf3e56a9662db3af045e35ba39509fffbe6e01d

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
medical/apexcare/services/pediatric-dentistry.html
Size 44KB
Sample260724-pl8dsaej8y
SHA256 a64a4545c3fabf2fcea35df1baf3e56a9662db3af045e35ba39509fffbe6e01d
MD5 9ffe618e19ecdd36851978b792563e0c
SHA1 9c099e94e2c98eb431e730d0ddad343782f95323
SHA512 fdb86afb2ce2f07aafaab0500102c1e1f1e6234a85ff0d6f76d198330ec8fc5c6acb4097cf6aae3b7b04b56d180b1ce0ddc4a1a203ad29d4ba6657a11e912015
SSDEEP 768:3xoYL2KMvQhhvecOKEXd3Rc7O0tj3HQXrOsOL3pd9bxkftrKJmmvi0I9wSkCu+8j:J3Xpfb
TLSH
T1E413862698C05023017382ED83B56B9CEBC681839F97590537FD1783AFF7D6AD99B409
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5748	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293700013566008"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{20B69E51-CF04-4CF9-877E-7884E5143758}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
720	msedge.exe
720	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 416	612	msedge.exe	87
PID 612 wrote to memory of 3492	612	msedge.exe	88
PID 612 wrote to memory of 5748	612	msedge.exe	89
PID 612 wrote to memory of 3492	612	msedge.exe	88
PID 612 wrote to memory of 3492	612	msedge.exe	88
PID 612 wrote to memory of 3912	612	msedge.exe	90
PID 612 wrote to memory of 3912	612	msedge.exe	90
PID 612 wrote to memory of 4440	612	msedge.exe	91
PID 612 wrote to memory of 5264	612	msedge.exe	92
PID 612 wrote to memory of 4440	612	msedge.exe	91
PID 612 wrote to memory of 4440	612	msedge.exe	91
PID 612 wrote to memory of 5264	612	msedge.exe	92
PID 612 wrote to memory of 5264	612	msedge.exe	92
PID 612 wrote to memory of 2244	612	msedge.exe	95
PID 612 wrote to memory of 2244	612	msedge.exe	95
PID 612 wrote to memory of 2244	612	msedge.exe	95
PID 612 wrote to memory of 3132	612	msedge.exe	96
PID 612 wrote to memory of 3132	612	msedge.exe	96
PID 612 wrote to memory of 3132	612	msedge.exe	96
PID 612 wrote to memory of 5216	612	msedge.exe	97
PID 612 wrote to memory of 5216	612	msedge.exe	97
PID 612 wrote to memory of 1248	612	msedge.exe	98
PID 612 wrote to memory of 1248	612	msedge.exe	98
PID 612 wrote to memory of 1328	612	msedge.exe	100
PID 612 wrote to memory of 2276	612	msedge.exe	106
PID 612 wrote to memory of 4352	612	msedge.exe	107
PID 612 wrote to memory of 2328	612	msedge.exe	108
PID 612 wrote to memory of 1120	612	msedge.exe	109
PID 612 wrote to memory of 1120	612	msedge.exe	109
PID 612 wrote to memory of 720	612	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\medical\apexcare\services\pediatric-dentistry.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffc0e42c188,0x7ffc0e42c194,0x7ffc0e42c1a0
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,2796778915297797155,12890174515470225260,262144 --field-trial-handle=2812,i,13060060509403288352,14288723811142291613,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:2
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,12055020047308785351,820161350804545274,524288 --field-trial-handle=2812,i,13060060509403288352,14288723811142291613,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,11868184673825290128,12152846212064703397,524288 --field-trial-handle=2812,i,13060060509403288352,14288723811142291613,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,16494003389389307964,7706945059424643793,2097152 --field-trial-handle=2812,i,13060060509403288352,14288723811142291613,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,5154385640150247391,3118031052305359711,2097152 --field-trial-handle=2812,i,13060060509403288352,14288723811142291613,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5160,i,8629494420677782104,5962413555764765047,2097152 --field-trial-handle=2812,i,13060060509403288352,14288723811142291613,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4900,i,6369244952507959357,16049025614179296296,2097152 --field-trial-handle=2812,i,13060060509403288352,14288723811142291613,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,8245960631319697125,13901586945925029739,524288 --field-trial-handle=2812,i,13060060509403288352,14288723811142291613,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,13543598678920355683,3621656787698320322,524288 --field-trial-handle=2812,i,13060060509403288352,14288723811142291613,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,8366964061433515856,10430551682525676184,524288 --field-trial-handle=2812,i,13060060509403288352,14288723811142291613,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,8366964061433515856,10430551682525676184,524288 --field-trial-handle=2812,i,13060060509403288352,14288723811142291613,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,1986935204923912845,4259617672226241251,524288 --field-trial-handle=2812,i,13060060509403288352,14288723811142291613,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,966158864208903906,5614658130280325265,524288 --field-trial-handle=2812,i,13060060509403288352,14288723811142291613,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,880480038975509023,12537473582881292711,524288 --field-trial-handle=2812,i,13060060509403288352,14288723811142291613,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,6700779806667473972,5559781042171534961,524288 --field-trial-handle=2812,i,13060060509403288352,14288723811142291613,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5940,i,9790194298463193402,3854458265516076855,262144 --field-trial-handle=2812,i,13060060509403288352,14288723811142291613,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3d0ccafdd74171cfdd43605ce1d2efcb0ce0410b17c5ddc1360b766b8e0cb2c5
MD5 ffb61a3d3fa5ea23d0a37620245af3e9
SHA1 ecb5eab3695b267f1164d84c757a52c702d719f5
SHA512 9a77a30dfdc416e8681f992474981306dbdedd79432d0618f9d61bb709afb302480fa60e030243f7766448503caffd89f31e3bcc5d3f1aaa4b5b022fb0763bd3
TLSH
T15EE02BAAC822EC2B08FD0758B0098A46E75113373640494F3A3D820D8FB473666D5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5fed92c1-0ca8-43b7-9cc2-cfafff38acbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5fed92c1-0ca8-43b7-9cc2-cfafff38acbf.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9ea4fd8ef743817e26529c6a9d1fc085b7920950692d7158ec984d966a31a1e8
MD5 5f26fef53f56815dbf1a2ef3a8140dfd
SHA1 85315f26d5edc0442c3e38b64334570e16700352
SHA512 0a3392a07e8dbcb2f7b768c3548bc455acacffad5a2204bc432e0331aa6bd5d0fd1a7b6a4bd14ff7acef69986cfa642f646c40fcce03d4160143a5fc16565156
TLSH
T183719CB7C3E8876E991156F0AB247E2BCE5D0516422C3CA689F4EF4B63F2471D10169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c43e3230f5b3a6c8a0bdf49288fde93f1e315669b2a1c6121e33114468cdd376
MD5 6e6ce7f09590ead7ede98f3cc7a2af06
SHA1 42a3dd47252fc763740d85f56539525a9551a04a
SHA512 d84cd6d836c30f76628e42d1850d5f664c24694df42819d3f7cc31ed5a91650333e6148072735856d93fcc9d0703c0e86351fda43ec19b9bde2671154a28769e
SSDEEP 192:sxZ+Rc7yMqZjK1Ml8Mkh/fpsUFvUZd4zodpHNHW6+WNGYvRnaM7Ig5/aJ:sxZ+aSMh/fpsUFvUzLtHbG16hW
TLSH
T1DE62D8066A345977CCDBD219FA45BF53D6F91573E2904E44A9FC8A0C05EBAEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6dd574df036653b2ce7ac421b038c8895ed5e57abdff11ce0e987b5e20af865f
MD5 bfccf672ac9607ebe6f37b8ade022405
SHA1 dc3dd160a5f5160da24ca0db7df0d7c278ae978c
SHA512 14cdd726236185c5019de61a118c482b36bbc94249d794bee60709f3ac0c5be248439c9b048955c4c75719e09777ab94f3e049300716114e5691802cf99f543a
SSDEEP 192:sxZ+Rc7yMqZjK1Ml8UQRkh/fpsUFvUZd4zodpHNHW6+WNGYvRntM7Ig5/aJ:sxZ+aSqih/fpsUFvUzLtHbGC6hW
TLSH
T17862D8166A348977CCDBD219FA45BF53D6F91573E2904E44A9FC8A0C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9237b18bf379dfbdd89da8496cfd8d9b480488d97fd4ed124b2cd818d14aacd1
MD5 f0584a80906d1d796150689826f6d0a0
SHA1 e5b9d6c678d711520c507a6851e2575570da617c
SHA512 fa466024512988df1eb8d7c9c701cdfe2eb42684b75bfb6f29c85cde2af7041fc55866820fccc4a942b009f2bc55a4ef7c49e329b109d956ef0b31e7a345feee
SSDEEP 192:sxZ+Rc7yMqZjK1Ml8Mkh/fpss0FvuaZd4zodpHNHW6+WNGYvIC+MTIgjaJ:sxZ+aaMh/fpss0FvuazLtHbGrkjW
TLSH
T18162D8066A34997B8CDBD219FA45BF53D6F81573A2944E4499FCCA0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 7d00e42a25ee4abee808dc0b0d1ffef919db937fa578d1f9883fe2ec881cb3b4
MD5 04f2a695a914ead859b0ace106a6e1b2
SHA1 c5aa979bae7aad956a3cc3cadfd3b342d17a63e7
SHA512 e0f4e784a0286fd53d5a7488817fa324de9d4d13f29788fffe8472b785eb69ca7d10e56da66ca0a149b01e4fe457bcf5e6d7013802791e613d8c5d1f5b1d9d45
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGt:05ppxnY753RNBvRJJdt7p5J9bPvR
TLSH
T129B2585A703E0211397E3988B39696364F4235A37058E4AF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
Size 24B
SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
MD5 e1edf83f1dbe0a1640e5800ef2f44b90
SHA1 58e8f31a1282e84a05c6960d6ab461d6ccef42cc
SHA512 151b19bcb34d72c304d02f2830f577036c5d2156499cb998643a87a3010544e5a4c236f8458786ea4b3416aaa4fd1ea96fc3bfe1ab0c5baebeac29e5427ca417
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e7af358a472a6fd9f9b4c96a549f54e18a8955b13c15ffe5a2f85a25a375247d
MD5 1d074eaf5357ede4b33731afd129671b
SHA1 b063d4ad81f59c7a1beaecdb536329218d0d55ea
SHA512 ccb26628862969146ec9540660f249dd891f92a5bfad1a3d5351b40fc89704d2e48c585e771aba8f5c324bd18278617e4510d68854c77b619b632b0eb512dfa5
SSDEEP 384:npiF9CcmyWCBusNI8TUNTUlI4xQckCrdx6pvtfxGp1UanuMX+jS4Re4KV8p00Lz5:AFccpcdwgUk6UXGp1UhMXMS4RI8p00LV
TLSH
T110C24C36EC68CD7BECD74B99B74B3943DEE0516386CC99E4DAD85E0C009B1AC530B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 25249fb3ccb7b629c0c1d7e23d222159b29ee7ea2db619f3f2e71af97247bdb8
MD5 5cdb1742f89c0f417597a9d1d9de01c5
SHA1 6c1bdb0900478ba8e9c74d7c846a81b43edee490
SHA512 17776c9fe335afe19ac5af9cc21896c8c6ca366c716c31f01ded618d6a2f7b6232303cb6ecf254bd0aec1417f5d80e9b502d044b23d0cbe3ff8d8f2d35d8bbda
SSDEEP 384:npiFiZcIjusNiS8TUNTUlI4bQckCrdx6pvtfxGp1UanuMX+jS4ROObjI9G6w7iY+:AFQSTSwgGk6UXGp1UhMXMS4R29MiP
TLSH
T1B5D24A36DC68CA7BECE78B95B74A3A43AEF45163C6DC5AD4E5D85E0C00975AC030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f153eeef1681622394f3cb0a4568d39dfa68b2ada36fb1e8e54acba878483185
MD5 80bf6566aef613abd3e8f45c950b232a
SHA1 c35350dc9c4767be3f8a6a55b22e0e613c1405df
SHA512 612009306f32f22c55e4cbb834d6931567613fe4705888fcba43be897400faa9216d7effe3fa910554d59220b6b5188b34c2c818f05b0ac406140169a00659c5
SSDEEP 768:poFccps3dwgsk4UXGp1UhMXM54RI8p00LV:Gs3wu1iXzI8p00LV
TLSH
T13DC24B36EC68C97BECE74B99B74B3943DEE4516386CC9AE4DAD81D0C009B19C530B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d6db63dca74ee30d6cba6936ba0f77e261b357c8d4a2cdf6a721b3c6a919b302
MD5 57c33baf4498137134ce419c6f52b70d
SHA1 a611facb5f3258d9b9fa35d732988a54f8a872c5
SHA512 4d1786aec7235234af7623ca26b6adea98037146e1c0e3113f261bf6132382ded21defa0a3a7d1ce2d2b280a57b87bdf41e58e282acc5debce3cecd3a69668da
SSDEEP 768:pVFccps3twgbkUdU1XGp1UhMXMC4RI8p00LQ:ns3XHi1iXSI8p00LQ
TLSH
T1C2C24B36EC68C97BFCD74B99B74B3943DEE05167868C9AE4DADC1D0C009B1AC530B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f007bc198ff21ed66cbf2d3ec8a159eddb0ce2e4df7ed7c5970773db1b3bc253
MD5 68812a146e08e70e9a361221a1da221d
SHA1 8086e1def91b2db6531d48f03cd982ee4070da16
SHA512 0603cb4f5b5b4f229d17ef61ca546557ae56e85ffc9d6cadd2031352582d33cbaf30766ea0072686ba1cbec6f62221b622126f4a1f1b2772761b7f0ce9d52d7e
SSDEEP 384:n0iF9CcmyWCCsNI8TUNTUlI4xQckCrdx6pvtfxGp1UanuMX+j54Re4KV8p00LztH:PFccpCdwgUk6UXGp1UhMXM54RI8p00LV
TLSH
T197C24B36DC68CD7BECE74B99B64B7943DEE0516386CC9AE4DADC1E0C009B19C530B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 fc52d5e930ba92ffc7f805fa5a8be6d60e356dc74e8885b01d894914ef451599
MD5 b711422e9aec6e15a722b88f2c7b4788
SHA1 16baf1c276d3f4b82300a104de2944ed320c9344
SHA512 ec7ed148f30cf4f8182c0ed285303d1d06a74a97c160eacdf2da9a1470ba227fde7149dc003078c317d568f31f10b9542d4623e3aed4ed32414c14b8a4f81e65
SSDEEP 384:npriF9CcmyWCs3sNTQ8TUNTUlIm2QckCr9lRUKpvtfxGp1Uan1b9pye4KV8p00LQ:pGFccps3BwgbkU3UkXGp1UwbSI8p00LQ
TLSH
T156B26B3AEC68CABBECE74F99B74B7A03DEE01167859859E4DAD85D0C009719C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 da8ae0da7d37e6e98decf50a6df08d967902227bcab2974307f6b279c0cc76af
MD5 9450e1816ebc1a8a9ea3985d08af4a9a
SHA1 652528833368d7cf238c3a753cb5008f5f24f5d5
SHA512 0b2fdb5ff0460daac9dc6c051de23ecb7be23932d8ab63bd7d71339ee2de368ed9d1f32ec1ea6a2e7ffe7fa3bfaf6dc4107fec5f1f38d1670067ceb954ea351d
TLSH
T13B415A5CBBE91148B3B3AE5A9FF6A46E047FB8772E4A849D10000D4E0A76B44C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1328-253-0x0000024252400000-0x0000024253400000-memory.dmp

Download