b78b24122c916772367ff35c108457b9e859d68ccb8dc827e253febbceed3782

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clink.html
Size 1.3MB
Sample260731-akemrazdna
SHA256 b78b24122c916772367ff35c108457b9e859d68ccb8dc827e253febbceed3782
MD5 14de6578507540a3b6681f4203f5a6b4
SHA1 92a63adb6239670ae43a509c6d9a28642d83ca92
SHA512 98e93289952882c66989b5bcd6ff1a93822da8ade907757913fa4e12f85c4156df5c0295f20e9359fe59a20fb49508e1101b37c0747fc88687ebe18d65d7efa8
SSDEEP 12288:wulukA9gzd1HMcPQ/K7gRAoocYLrDwQ4KOmDx52s+KJB9oVJVtebW8sawvMIw8Xv:wuskAi7HMc4/69ToFDGrv5WkR4gJHC
TLSH
T1AE55E87241D4563B416342FDD2092B7AF2EB406DE3120BE4FDFE870B479AD906A272D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3392	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299306151725861"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{66C5A1F8-28B1-47E0-B854-B5BE27B34A56}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 3784	1720	msedge.exe	86
PID 1720 wrote to memory of 3392	1720	msedge.exe	87
PID 1720 wrote to memory of 4652	1720	msedge.exe	88
PID 1720 wrote to memory of 4652	1720	msedge.exe	88
PID 1720 wrote to memory of 4652	1720	msedge.exe	88
PID 1720 wrote to memory of 5728	1720	msedge.exe	89
PID 1720 wrote to memory of 5728	1720	msedge.exe	89
PID 1720 wrote to memory of 2280	1720	msedge.exe	91
PID 1720 wrote to memory of 2280	1720	msedge.exe	91
PID 1720 wrote to memory of 2280	1720	msedge.exe	91
PID 1720 wrote to memory of 1536	1720	msedge.exe	92
PID 1720 wrote to memory of 1536	1720	msedge.exe	92
PID 1720 wrote to memory of 1536	1720	msedge.exe	92
PID 1720 wrote to memory of 2324	1720	msedge.exe	96
PID 1720 wrote to memory of 2324	1720	msedge.exe	96
PID 1720 wrote to memory of 768	1720	msedge.exe	97
PID 1720 wrote to memory of 768	1720	msedge.exe	97
PID 1720 wrote to memory of 2524	1720	msedge.exe	99
PID 1720 wrote to memory of 4276	1720	msedge.exe	105
PID 1720 wrote to memory of 4284	1720	msedge.exe	106
PID 1720 wrote to memory of 2708	1720	msedge.exe	107
PID 1720 wrote to memory of 556	1720	msedge.exe	115
PID 1720 wrote to memory of 556	1720	msedge.exe	115
PID 1720 wrote to memory of 1880	1720	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\clink.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffc25c3c188,0x7ffc25c3c194,0x7ffc25c3c1a0
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,16373147593131189759,12729949175944756189,524288 --field-trial-handle=2156,i,11141264909055033793,3181283864724701339,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,4382926788251344376,5825473090038558836,262144 --field-trial-handle=2156,i,11141264909055033793,3181283864724701339,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,1354993724299663666,5086698363600517143,524288 --field-trial-handle=2156,i,11141264909055033793,3181283864724701339,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,16483738704812158427,8956954059687259294,2097152 --field-trial-handle=2156,i,11141264909055033793,3181283864724701339,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,8706060341548187644,6050700135707062514,2097152 --field-trial-handle=2156,i,11141264909055033793,3181283864724701339,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,10227349795949398321,17147259652135839843,524288 --field-trial-handle=2156,i,11141264909055033793,3181283864724701339,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,16065633334861871894,16266492431473210485,524288 --field-trial-handle=2156,i,11141264909055033793,3181283864724701339,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,13597477705085261716,14495363648865131947,524288 --field-trial-handle=2156,i,11141264909055033793,3181283864724701339,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,13597477705085261716,14495363648865131947,524288 --field-trial-handle=2156,i,11141264909055033793,3181283864724701339,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,13661317098080706317,11203573238946478134,524288 --field-trial-handle=2156,i,11141264909055033793,3181283864724701339,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,17340995523084283547,14203705590996398774,524288 --field-trial-handle=2156,i,11141264909055033793,3181283864724701339,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,11901181372532607176,14877839018565778637,524288 --field-trial-handle=2156,i,11141264909055033793,3181283864724701339,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3028,i,6858348051124887905,2471777074345852638,524288 --field-trial-handle=2156,i,11141264909055033793,3181283864724701339,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6204,i,9709585384009139130,1761746070477460952,262144 --field-trial-handle=2156,i,11141264909055033793,3181283864724701339,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f284bc6b8eeb0be6df8a6277ad72dc9ba25bf8b3de844c96ffbec6d91f3a5392
MD5 3fa5aa7caca140b974586dec51c0accf
SHA1 6c552990706c3f387beb2213f66aa5fc5088229a
SHA512 af7399708d09043a666f4c5a9faf3144cdf3fea6b56d8099cb6bc9490f223e1dac1068cc2d227a25e69190670cf18f5bd9e88bb14ad31f0a245b02c616377902
TLSH
T149E02BBAC921EC2708FE1B2960198646E74013573A40495F3A3C810D8FB472A45C9C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3fe116c3045fd42d413d87d1162bafbb54d1bc95923d5aa6dcdd1a9f8ca04bf5
MD5 a2d4efd5b0d3a2eb59fec12cd2f48b9f
SHA1 5eb964e3866674a55adf32ca571d9cf9173965e3
SHA512 dc5972dce2ec51039ea93c4a45780f35e7fd9cc9dd8ded711bf54e39a3d6d8059f311592305184feb292141da073297cab96e46d1c58f73eff956e1e72708953
TLSH
T11D41C3F783E4866E8A0196F0AA14BE1BDE1D0515432C3CAA89F4EE5B93F3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 61618c35109b0d1f297984f6f45f51cf731692fe4e7c911441045a229222bc70
MD5 514764d05d35f2ed9bba12b34c924387
SHA1 28af10769ff684cb9c6d6cdea23ccdd58d849ae3
SHA512 a7a5f00314623db33530057d964d8572658910a633b0afb6ea37790181b57fab878773e713436b2bc30f7931e8f9091565e540dda2257d17bdc96ca98517f97f
SSDEEP 192:sxZLRc7yMqZjK1Ml8Mkm/fqss/xQaZduzodpHDHW6+WNGYvIC+tiIgjnJ:sxZLaSMm/fqss/xQaz1jHbGrYjJ
TLSH
T13D62FA166A3499778CDBD609F645BF53D6F91163E2904E449AFCCA0C04E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9e0aaea8c49429cc120eb3786897c9f955965e6b4f829042b2c8b25766339c60
MD5 eae1222f739cd0a21633770924d00be6
SHA1 44a00f4a4edd89c4520bf6282261a853c372f6e3
SHA512 32f385ce6f0cab6295eb3db7793a48702ba0481cfc50d901fce1f0ed64a571c3f196a8441606d99989310013cb778da154fd6261d1e7c4223f566065f2f75b05
SSDEEP 192:sxZLRc7yMqZjK1Ml8UQ+km/fqsgxkZduzodpHDHW6+WNGYvtLjtSIg5ZnJ:sxZLaSqVm/fqsgxkz1jHbG4YbJ
TLSH
T1D662E816AA3499778CDBD609F645BF53D6F91163E2904E44A9FCCA0C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5301e0e17ea7e43402fa79af3d7f3d12f5986cee3c17ee14c3338e7709c1d828
MD5 7a336c541d80748d337e7f369ff939e3
SHA1 b50c64bd567c16bc2c3395c0eff96388b1a0ce6f
SHA512 783f451f3ddd2f888428ad640fdfc15f037b41bd4257c935961a318514f8d57fb7a250ba5536a14b91a3d61cb87ece5674e9f8ff5bcd184a0914200fcf6a789d
SSDEEP 384:0LppY93PBZJPtN53ATy3jJlZEdQ3bvV7RMrbAxzdV:0LppY93PBZJPtN53ATy3jJlZEdQ3bvV5
TLSH
T131B26A5A703E0211393E2988B39696364F4235A37058E4EF7FB814A54F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 67e3dedcbcf7bbe6e6a19adf585c22651d190028a6f31322060ec4ca718a3714
MD5 b0eb505fc8a8183366aaab72d026ec5d
SHA1 1be6dfc33626f0c606706ada38b14414122c58f7
SHA512 374f8bfdb3f0b9de3a15b4133c5ea9ff67d6c788c616e64b6c6deca60e42cf748dd3c059f702175ba13084ae19252c163955304f00d4e90f2e88894014dcc918
SSDEEP 384:nNiFiZcITY3sNE8TUNTUlI4TQckCrYeTphiftGfFmmEEXIQ/4dWnjnsqqAOObjIX:EFQc39wgukedoGpENdwjnsqqA29Mg
TLSH
T146D25B36ECA4DA77EDE78F95B74A3907EEE04123DA8C5AC8D5D85D0D04970AC430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5638cc606e661a621dedf54afa8b902d87016e42bbd6649b34fc025eb730dcf0
MD5 36da0b63b83b9b3fff6b9fe6d2b3f268
SHA1 850355d4cf8ce47bc147e74e6d80549016648841
SHA512 a27360dc9230b188af795b58547fbfbe8e580264e449bef817100eb606062207f070539dd04b68da42d59b226930c0b971527be15edc3fe02ba33cbf2f1df710
SSDEEP 384:nTiFiZcIy3sNE8TUNTUlI4TQckCrYeTphiftGfFmmEEXIQ/4dWnjneqqAOObjI9h:+FQy39wgukedoGpENdwjneqqA29Mg
TLSH
T1DCD25B36E8A4DAB7ADE78F95B74A3517EEE04123DA8C5AC8D5D85D0D04970AC430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 04486279e54652adbd77e66b08b2e3ba5e532e86bf0abb36f5ef9295e7b3a44f
MD5 11dc44a66ae66d6af3b01744f59e379e
SHA1 a076662924ef8020b36efec5c58b4b25012c3e8e
SHA512 eae3db7bf135f68c280eb611ee43c4c2bd3b9cbe0261986aa996ab065bdae7056987e9a2ece8767c52bbc4aa52b0b2ce3c19131d997c7b4483be0f500602dcba
SSDEEP 768:pAFccps39wgukGdoGpENdwjneqqAI8p0Kv:Ws3KJHOUI8p04
TLSH
T1A4C24B36E8A8DEA7ECE74F99B74A3547DEE04123CA8C99D8DADC5D0D009719D430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e8dec9c1ba42a84c052b46a55238de9474bfca7bc925b9328e6cdd48f5b6760e
MD5 c4610ff9567d4aee996dcc7528381410
SHA1 9a0e748af7d738250f7af6f5b62c5b274b2b26b0
SHA512 a30e6bf0403532d5109f61ede41a7196bd8cfdde71df3d89f6204a8fa604d1f302994b3ecc8ff24d2238bc0fc85bac10981a795f726237e40153285a20c7a10d
SSDEEP 384:npBiF9CcmyWCs3sNK8TUNTUlIm2QckCr9lrKphiftGfFmmEEXIQ/4dWnj2Kpde4a:poFccps3bwgbkUFkoGpENdwj2eI8p0KS
TLSH
T1C7B25B36EC58DEABEDE74F89B74A7A07DEE0122785DC59D8DAD85D0D009319C430BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 59de1667a0b16502d9156ae2e72bb7e232a4bd1bafbb3395ed96fe5249c66c52
MD5 36134ba79862288bb184513cfb1bb26e
SHA1 8d2b05cbdab525d29dde73b67eb945a567c96904
SHA512 6ffd99aba879346021c36ad8cd49de3a0a07157b79082f15e782f66b8b69960a284efdb8d5bdf0beb5fc363b2f848c54978dc9dc9a0e71b94c3c7224c0aa9bca
SSDEEP 768:pIFccps3NwgbkUJmoGpENdwjnJqqAI8p0KS:Gs33KHOVI8p05
TLSH
T198C25B32E898DEABECD74F99B74A3507DEE04223C68C99D8D9DC5D4D109719D430BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b6a5ed654c786257142ae14b14d755d9b6d0d07b0de1f008eb64930456fdf129
MD5 389d62b9fdc38190e7d38dd9cef1d00f
SHA1 654a5155120de5c2e4e02ca22801439369fb8280
SHA512 4aa372dc6461156603cec85ad9694e3a547c8c1ec6225723c3f3614e4fae4b8b0a2644780e334cb43f13d8ff23b3e799ad5e26293e81788e87ee8dad27631ef3
TLSH
T115411C58B6F91108B3736F4A9BF6A46E487EB8772E07949D10110D4E0666F04C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2524-215-0x000001A600000000-0x000001A601000000-memory.dmp

Download