bbc24cf0260b7c1dd0f7091fc4044dba4791902414003ee699f0ba031a6d5635

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
application/logs/index.html
Size 142B
Sample260730-pdvgys1vbz
SHA256 bbc24cf0260b7c1dd0f7091fc4044dba4791902414003ee699f0ba031a6d5635
MD5 d92311600f6632e0f98c0e5777acf431
SHA1 e799bd5ab234730a641b034fb62d5f7ca0461c50
SHA512 0f6c1d055daf7e1ddc565fd70c9a98f38fc3ee874141494cb2c4f3ed41f43b2d4304167592ae7e41ac95af257b92e2074f5ac82a8f4286624878ed402e1bd09f
TLSH
T1D3C08C66220C2C0C52F233B01AC02260219323C002032B255B8451233A1111DCDC218D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4464	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298872309426399"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{A47CC480-10DA-4609-AFF2-75054A6A6619}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 4432	4308	msedge.exe	84
PID 4308 wrote to memory of 4464	4308	msedge.exe	85
PID 4308 wrote to memory of 2672	4308	msedge.exe	86
PID 4308 wrote to memory of 2672	4308	msedge.exe	86
PID 4308 wrote to memory of 2672	4308	msedge.exe	86
PID 4308 wrote to memory of 5128	4308	msedge.exe	87
PID 4308 wrote to memory of 5128	4308	msedge.exe	87
PID 4308 wrote to memory of 2164	4308	msedge.exe	89
PID 4308 wrote to memory of 2164	4308	msedge.exe	89
PID 4308 wrote to memory of 2164	4308	msedge.exe	89
PID 4308 wrote to memory of 2368	4308	msedge.exe	90
PID 4308 wrote to memory of 2368	4308	msedge.exe	90
PID 4308 wrote to memory of 2368	4308	msedge.exe	90
PID 4308 wrote to memory of 5640	4308	msedge.exe	95
PID 4308 wrote to memory of 5640	4308	msedge.exe	95
PID 4308 wrote to memory of 5564	4308	msedge.exe	96
PID 4308 wrote to memory of 5564	4308	msedge.exe	96
PID 4308 wrote to memory of 3024	4308	msedge.exe	98
PID 4308 wrote to memory of 3932	4308	msedge.exe	117
PID 4308 wrote to memory of 1592	4308	msedge.exe	118
PID 4308 wrote to memory of 832	4308	msedge.exe	119
PID 4308 wrote to memory of 2420	4308	msedge.exe	122
PID 4308 wrote to memory of 2420	4308	msedge.exe	122
PID 4308 wrote to memory of 1400	4308	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\application\logs\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffc8260c188,0x7ffc8260c194,0x7ffc8260c1a0
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,17531218051952572010,2423485124846056243,524288 --field-trial-handle=2256,i,8618106648932548002,12637909313343155963,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,8514575351132918513,15667693277524706346,262144 --field-trial-handle=2256,i,8618106648932548002,12637909313343155963,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,11272767678130292379,10784999300910818900,524288 --field-trial-handle=2256,i,8618106648932548002,12637909313343155963,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,3705021205701286418,6214401044348426213,2097152 --field-trial-handle=2256,i,8618106648932548002,12637909313343155963,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,11266958171330043221,10916274454705040744,2097152 --field-trial-handle=2256,i,8618106648932548002,12637909313343155963,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,4441595124115678290,8121932077216359289,524288 --field-trial-handle=2256,i,8618106648932548002,12637909313343155963,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,13808799999741585836,2987015615792007284,524288 --field-trial-handle=2256,i,8618106648932548002,12637909313343155963,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,5218209262912188489,9950968278824064491,524288 --field-trial-handle=2256,i,8618106648932548002,12637909313343155963,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,5218209262912188489,9950968278824064491,524288 --field-trial-handle=2256,i,8618106648932548002,12637909313343155963,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,13176696235186659365,18313055214437599272,524288 --field-trial-handle=2256,i,8618106648932548002,12637909313343155963,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,17714475139268726472,9516888011107541621,524288 --field-trial-handle=2256,i,8618106648932548002,12637909313343155963,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,13977376733567145380,5647849637215000830,524288 --field-trial-handle=2256,i,8618106648932548002,12637909313343155963,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,4289785514628518309,17286076021054799088,524288 --field-trial-handle=2256,i,8618106648932548002,12637909313343155963,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6072,i,2163859480560936469,9149874289173082558,262144 --field-trial-handle=2256,i,8618106648932548002,12637909313343155963,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 17f230f08376cc3895cc245fe0e54dcfe431e34f19010c442de29d43e4cda13f
MD5 2de9b54ca96da5e3f65c51f3448f76da
SHA1 44ade773d9c960df3301ebd459f2ec682845d8c5
SHA512 450d26e498745341f521918c4724893e538dbb8b7a459fa362362b5ce877f5b474be95e0b728c4892a6505aed86392bfd0d55256e1404781865056099788b1a0
TLSH
T18BE022AAC832EC271CFD07A8A0099666E71513573A40895F3A3C92088FB063B86C5C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b30c5ed0c65e3272d99437e1b3b4dc1cd0b36022ccdc1a8933e16915cd556982
MD5 c8654b20a3ad37afb2363b37168bcc2c
SHA1 b25d1abfd4bf6dcfde06a891edc34887ad9aead5
SHA512 0eb8c9fe500ae0a2a9af9d510b5c600a3532cb79cf0c429d73f47aa86747e19e596a9460c662a51219201a1d1c5377e296b7fe6a6009b4dfba2daa274ac3294a
TLSH
T1A231B0F783F4856E9A0196F0BA18BE2FCE2D0511432C7D9AC5E4AF1B93E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8ba138eb37490f606be33776a5658d5494b3320cd61bcc9b6ca541ed7648fad5
MD5 56c8db5aa0f97817af085bc65910297c
SHA1 a2f7196b7e8f9c70455178fb0f731cd3351cc85c
SHA512 005ad539e3ed0350393696c734d56ec90f4dd748bfe4daaae1ced88b985e9cf7beb057ce2ef77f285c66728faea6792a240bc9e9eb27d4eb204d01031907ccb4
SSDEEP 192:sxZWRcyMqZjK1Ml8UQxkP/fbsGCvZdFzodpHhHW6+WNGYvs7lTBOIg5QzJ:sxZW1qCP/fbsGCvzOBHbGPx8il
TLSH
T1D762E8166A349D778CDBD219F6457B53D7F90123E2908E44A9FC9A1C00E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 abffcaa68ba8d21a5252357c5042ec3db64148d44e9643228053fe9da1472930
MD5 f34a231af859f3f3b712c317666d2744
SHA1 f6a289779d40f40683e460ca9bf557a24e966504
SHA512 a3bf7e02215dc7cc2f889f2968f6b7d52cfe17034c66b564ac9c52384a8731fa1d8c9d880f9b2d5353c5a766846b88834494c7d0d863f0a9d00fa65254a7db4d
SSDEEP 192:sxZWRcyMqZjK1Ml8MkP/fbss4CGaZdFzodpHhHW6+WNGYvIulqBOIgjzJ:sxZW1MP/fbss4CGazOBHbG78jl
TLSH
T10362E7166A3499778DDBD219FA457F53D7F91123E2904E44A9FC8A1C04E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 d36db667919874521f43f7ec7ad75ed4a46c584e48a59fcf2700ea6126c63b2c
MD5 d1ee36bb719879ad16ebc26f06d778e8
SHA1 cb57cd44231a0fcd05e8e702eae6afc45d4deef7
SHA512 8c3a0a23b38e4f5fc713b514a19350cd6d8db53c0889446e4ff26e9ee2936e9957c72bfc40a665e4369e93adb8fada4264f1b549f02f5adc05e0dc82596a6e6c
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGc:05ppxnY753RNBvRJJdt7p5J9rL9tvg
TLSH
T1E8B27A5A703E0212397E298CB39596364F4235A37058E4AF7FB814A14F67E224DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 93988f0d84ad044373061797e50c85db4f30217df36d480221afeea472db6d02
MD5 a4633ac47389504f01a2cbbb5d96ea47
SHA1 6e3542d6806d067c359b6f1ccac3b4a04d610474
SHA512 4012444162f6e26e7d6fb4a8cff0558db472beab7ef5067bdf3629588f5da2f860da0cfdabbd8973f4cf6a6847011db99b77296a6a60d56fefcf0ccdb8102824
SSDEEP 384:n0iFiZcI5/3sN/8TUNTUlI4jlKQckCrLUrVcpvBftG0oDti/7cL1+9GrFjOObjIY:PFQx3KwgHkFqjG02I7p4rFj29MRN
TLSH
T11AD25B36EC64CA7BEDE78B95B74A3503AFF14123D6DC9AC4E5D95E0C00971AD430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f7738e10ac9410f3b723d5356c594f190a65562e2cc21feb8c10b9be7b608238
MD5 db3580d75f448c154a5130c1861aa74d
SHA1 759c8c99c8be53b3730aa28bb72c8f39cacd0a53
SHA512 c24ff2bc8c38c0713d7d37adce688f53a68b0581c348cbd912221f0f4b18bb2bef275fe2c5dd8544ea22ee1373558d8029a5a98bbf56ea303cd850776fb740c2
SSDEEP 384:npXiFiZcIp3sN/8TUNTUlI4jlKQckCrLUrVcpvBftG0oDti/7cL1+gWrFjOObjIY:pSFQp3KwgHkFqjG02I7p9rFj29MRN
TLSH
T1D0D25B36DC64CABBEDE78B95B74A3503AEF04123D6DC9AC4E5D95E0C01971AD430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f87867c7688746acceec8a9720aaa750f4d07fcbd54bc626b0c89a679fb56817
MD5 55e864c97aa93d09ea920dc315097893
SHA1 05e141bcd4d99220d3c12370f0e209a10acdec40
SHA512 1f2afc16fae7951acae3919a16344e58f148078357b129bdbd566120c8c3705046fd380d8866dbcfd36e2f5028204edfd45c0f431b2dcec336f9b1d66819c2b3
SSDEEP 768:pYFccps3awgbkUkHjG02I7pYrFjI8p0or:ms3MW5l7pktI8p0K
TLSH
T18CC25C36EC68CDABECD74B99F70A7503DEE0422386CCAAE4D6DD5E4D109B19C430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 aed881251fa24593ac7e9a0a58f7fdb5a664a920d10b66048b42838e117cc244
MD5 790f959dd7015c7ddaa40c16ad7fcbc2
SHA1 08f204f07188a6a909e3440affe094b968333e41
SHA512 44760a6a6ea9743852b18eff7e1d877123eb4cd13470182f10046e3323e8beba3dcd18e87927f8bb12effc8a04ae4ea6893ad041ad6c3b5fae62f93067e4b198
SSDEEP 384:np+iF9CcmyWCs3sN78TUNTUlIm2QckCr9l+KpvBftG0oDti/7vrbpje4KV8p0+Hr:pVFccps3GwgbkUwkjG02I7vrpI8p0or
TLSH
T138B25C36EC68CEBBECE74F99B70E6A07DEE0512785DC99D4DAD81E0D109719C030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a6ac97d77cb8fa7a2070147dda7ec47cde87b80af711afa598f78eb1d108fec6
MD5 bfaa76fdeb3eacb7b45b022e5828f35a
SHA1 ee32cf01363ee55ffcc308ecbd8f358a76f1ccde
SHA512 fb9b41f512f7328ac757e020f376e65143ae694caca86f88047ca7b57d1e225c220f92cb7613d09d94635f9590e8ca52461f2df9e409230c51b4d491aa1e790f
SSDEEP 384:nniFiZcIp3sN/8TUNTUlI4jlKQckCrLUrVcpvBftG0oDti/7cL1+gWrFjOObjI9i:iFQp3KwgHkFqjG02I7p9rFj29MRN
TLSH
T118D25B36DC64CABBEDE78B99B74A3503AEF04123D6DC9AC4E5D95E0C01971AD430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 53f0583a46fd6492b06ecab668f55dd04acb2379a1581a36d46a9df7d4999567
MD5 31e99bf484a2df991592c93c8bb1390a
SHA1 4b88eeea81cdafbd54838c16066b1ec9cd347b52
SHA512 f8398c83655fefa300c70514ec7ade3552f775a2b6e16c7666a7ae41cfc3f2195afe58971ccb7f9d62fb61cf45db4cc15439d305684c5476c4f3a3e6267484b3
SSDEEP 384:npXiF9CcmyWCL3sN/8TUNTUlI4jlKQckCrLsrVcpvBftG0oDti/7cL1+XWrFjOOv:pSFccpL3KwgHkNqjG02I7pmrFj29MRt
TLSH
T152D25B36EC68CEA7EDE74B99B74A3503EEE04163C6DC9AD4D5D95E0C019B1DC430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 296c38ac7350c181c9c9d56e5499d7781cb663fb170b2cecceed7961ef614233
MD5 037356f5a85a0b6b4631805c99774c5a
SHA1 6933c92b0c929996c54809d7328457ff05cc6699
SHA512 5213c4ebfd1e9c2a609c79c83b6363a659e6611cd3aca6fd44dc25d33e403b43751dde361c996e08af69220458f789cfaab7b26d7c56443d2feff04535013ec3
TLSH
T114410759A6E92148B3B72F1A9FF6A86E487F78772E0AD45E00110E4F0A62B41C871737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3024-201-0x00000202CD9E0000-0x00000202CE9E0000-memory.dmp

Download