c5043ed2b52774feb48486ad11d5d062bbfb75f4ff0353d83ba49b86ba2f0060

Resubmissions

03/08/2026, 16:07

260803-tky6yabh73

03/08/2026, 16:03

260803-tht47seq5z10

03/08/2026, 16:02

260803-tgrmpavtes5

Analysis

max time kernel
150s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pawno/include/primeiro.php.html
Size 309B
Sample260803-tht47seq5z
SHA256 c5043ed2b52774feb48486ad11d5d062bbfb75f4ff0353d83ba49b86ba2f0060
MD5 54f83a3fb48795377dcfb82aee952b35
SHA1 d3c87b3a66f4cfefc7bbcfb6a8486bdc6b34fba6
SHA512 e9ed5e4f82b9b1f496c014044d0ddf485c1aa7ed91137fb2e65e551c9afa830bf52b6a517b374959d09c19370b7aef2a975d8cca0e07788da9c5ff95ff266a80
TLSH
T166E0E7F63205DC50C01734309BC951C16855814441C06DDC10DFC2B772D4B458BFF6D4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4228	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302467975404626"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{9AEE452A-C46F-4B0B-9302-44208E529783}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 3344	3712	msedge.exe	80
PID 3712 wrote to memory of 4228	3712	msedge.exe	81
PID 3712 wrote to memory of 3048	3712	msedge.exe	82
PID 3712 wrote to memory of 3048	3712	msedge.exe	82
PID 3712 wrote to memory of 3048	3712	msedge.exe	82
PID 3712 wrote to memory of 2784	3712	msedge.exe	83
PID 3712 wrote to memory of 2784	3712	msedge.exe	83
PID 3712 wrote to memory of 4964	3712	msedge.exe	85
PID 3712 wrote to memory of 4144	3712	msedge.exe	86
PID 3712 wrote to memory of 4964	3712	msedge.exe	85
PID 3712 wrote to memory of 4964	3712	msedge.exe	85
PID 3712 wrote to memory of 4144	3712	msedge.exe	86
PID 3712 wrote to memory of 4144	3712	msedge.exe	86
PID 3712 wrote to memory of 3028	3712	msedge.exe	88
PID 3712 wrote to memory of 2940	3712	msedge.exe	89
PID 3712 wrote to memory of 3028	3712	msedge.exe	88
PID 3712 wrote to memory of 2940	3712	msedge.exe	89
PID 3712 wrote to memory of 544	3712	msedge.exe	90
PID 3712 wrote to memory of 1328	3712	msedge.exe	92
PID 544 wrote to memory of 1948	544	msedge.exe	93
PID 3712 wrote to memory of 1764	3712	msedge.exe	96
PID 3712 wrote to memory of 4648	3712	msedge.exe	97
PID 3712 wrote to memory of 732	3712	msedge.exe	98
PID 3712 wrote to memory of 5200	3712	msedge.exe	99
PID 3712 wrote to memory of 5200	3712	msedge.exe	99
PID 3712 wrote to memory of 1656	3712	msedge.exe	101

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\pawno\include\primeiro.php.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffbda6ec188,0x7ffbda6ec194,0x7ffbda6ec1a0
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1664,i,2875380777103222548,7810152698376328902,524288 --field-trial-handle=2028,i,13702759291102248585,9186657982860046612,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1516,i,12784569850511025690,12819582882037049853,262144 --field-trial-handle=2028,i,13702759291102248585,9186657982860046612,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,14529775727740533052,6177104365082835901,524288 --field-trial-handle=2028,i,13702759291102248585,9186657982860046612,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:13
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,1165641785519069241,9329089786174832944,2097152 --field-trial-handle=2028,i,13702759291102248585,9186657982860046612,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,146006193251028757,15609064215150313241,2097152 --field-trial-handle=2028,i,13702759291102248585,9186657982860046612,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,16282534901735236971,7989259945319621143,524288 --field-trial-handle=2028,i,13702759291102248585,9186657982860046612,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,830657190046537998,10212794768197571339,524288 --field-trial-handle=2028,i,13702759291102248585,9186657982860046612,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,16499406114169009285,9429393758189829336,524288 --field-trial-handle=2028,i,13702759291102248585,9186657982860046612,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,1300450634589851112,10346127609892013869,524288 --field-trial-handle=2028,i,13702759291102248585,9186657982860046612,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,1300450634589851112,10346127609892013869,524288 --field-trial-handle=2028,i,13702759291102248585,9186657982860046612,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,2999092065630298358,16656311013792243583,524288 --field-trial-handle=2028,i,13702759291102248585,9186657982860046612,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,8446435869145905801,5488200237118755160,524288 --field-trial-handle=2028,i,13702759291102248585,9186657982860046612,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,14174363701046073496,15681060991814242426,524288 --field-trial-handle=2028,i,13702759291102248585,9186657982860046612,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,3368857323844580682,12862032002215463478,524288 --field-trial-handle=2028,i,13702759291102248585,9186657982860046612,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5252,i,3919779494230845663,7747320109175675743,262144 --field-trial-handle=2028,i,13702759291102248585,9186657982860046612,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6fbe0792090fef4d2035a0f6432c1c4b2a0ea26c282c9dd0b275f425d7a2aad4
MD5 9eae83d8e9c9eeb46b8dac1ab5d02942
SHA1 955a12578e599f7d3fb5d089d04875a6995b86af
SHA512 5e4aa3f695ee6b7b6652083fdef70f252b4937c0dd17edd2e0d6ef8f9224f23f4f57a3aecec4cb08d6728fc2445dbd2fededfd3f4958897216eb15ceeb8a1023
TLSH
T116E02BAAC920AC2719FD0B1DE0A50649EA6013672680866F7A3D550C8FF572A46C985C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 81c53619b96bd4d3e2465fc9280a856e9a5264acce28832edc248b0888d4efb3
MD5 acbe83ebf4cb57f6bc0a5108b0c4d1a2
SHA1 d36a91370585feee38ad408a6adf51883e3fe5d6
SHA512 1e69234cd2626d4317fc54798f9dfe65d36fdfe6323e9247fd17153aac76e9b2a570bb6702b6935ed4a61cae5f90447631c0c8a9c91f0b985f48546caab674d5
TLSH
T17431C4F783F4856ECA1196F0AA18BE2FCE2D0514432C7DAA85E4AE17D3E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 19580837f3907f09d7a59549bf5a623ed9da0bb1d72533e9db2983fa67723cd1
MD5 37019cbb81e653235493f09185db56d0
SHA1 d346b6f8993f2d115e91043dfea2b6d91d5abb13
SHA512 b6c49f922ccd0bbb5c29d21c334e1fe110141f2636ab8f0267ec2d4fbcc874ab3202987a3f2c67fd9882a7588f4e82ed5d7b6983dfee2019d5c57a49c89d0242
SSDEEP 192:sxZ4RmyMqZjK1Ml8UQZF3/fXsSDTE0CXUizodpEL/W6+WNGY0dfgHsCU7Ig592J:sxZ4nqf3/fXsSM0LZS/bG5kuHC
TLSH
T1C2620705AA34A97BCCDBD219FA457F93D7F9147391900E44A9FC8A1C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 47077c351002ea0125d4f0067ff9062e32181af14558866c55802631973daffe
MD5 bd36b53f6cae83e3f9d76bb93aadce0f
SHA1 96d9cc8ca8fcf551a927ae764f24f1ab7e00593c
SHA512 54c860569288238ed767b0ea691595361330bb0203d5867fed26185052b6b56390c30198cfb7f2f2255c2c18dab3a3eba04b08dcbae2db1b00f1acc342c44305
SSDEEP 192:sxZ4RmyMqZjK1Ml8MF3/fXs8+DSxE0CXUizodpEL/W6+WNGY0dR6IsCU7Igj2J:sxZ4nd3/fXs8+G60LZS/bG5rujC
TLSH
T1AE6207066A3469778CDBD309FA457F93D7F9157392804E44A9FC8A1C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 203cce1c4bb7086bf045d43912169a83adc65717c7b46dd51e88ab586e835b9e
MD5 c9821a650e1491ab2fab27fefc745a82
SHA1 3ea8a2b8ff01a01991c000fb740f506901f57279
SHA512 ec28c1925e34ca9914b2b22b4d8ebdbc04e95fecb3a0206730cad06b2a23429bff4d7e4a301a29b943a6e02bb5e5710113a1d59e8c719f29fe83597336591358
SSDEEP 768:ciWKy8Eq2+dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1A:ciWKy8Eq2+dWRm5rQW7u1jaKTQLpCFsy
TLSH
T117E21A2B280CCB7E4F841E5CEC266F966EE8018B66A84D5447FA494C03C77EB511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8c7d768f98bf76f9cc12cd8a771c24d17cb6a691613b81f6777a6f6fa2010c4f
MD5 d19bc32b6379b155209905d2055de463
SHA1 74b7274bcf5e41827753b926ca46d764fcb0fb38
SHA512 58302d45dc3ee3f01c0c70b6013fe34c2d872c715bb7c9200e8894bf9574fb9a09d84724b5da80948592db783eb1143ce8b87cb035c37e12235094415cc03206
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7GxT:AFBHhTofhno2mB21q3Llbfe3sLDdeEpm
TLSH
T177B28156717B12023C3E290CA7929B370E4272A33458A56F7BB900BA4E67E615DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3af25de8b04394080a4c233e12e4218a207d601e403a06e62a40db2c281b45b3
MD5 234c8b0be4a566065ff5ebd496cf9033
SHA1 9407a02a31e4c7098c1ee723dd7c7a5f585cf266
SHA512 9c440fac23eadcf77dee52460b0714fbf358196a58bc184d722e9c55cc659f50a767eeb56ea531fb6e4c76aff338aea96b8830736de206e359daab49b7833452
SSDEEP 384:n52iF9CcmyWCs38N18TUNTUlIxByd69pHjkpfb7oV9Ph7OSmdl8uhkP+lFYS/Tsc:TFccps3qwgVpgJoPMquhkoFYS/r
TLSH
T1AFC25B32EC98C9B7ECD64EE9F64A7907DEE041A3868C9AD4DAC81D5C00DB19D570BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 847ae0df4d54c484768d15ff3259cf3792c2e73dfe32b661ad2a55770bb72f43
MD5 d78e34f205aee42cb029501ec53091d8
SHA1 51325b7e88527f29b8507c72e44f76bb2c8d98fb
SHA512 17fab35a9982549fbccd743f79c4e3728fe2a7f616a03fa8e6c61245a5837e92cc0191212b40bcc8a6e9381d8a06c3d778a10e32fd3563b106d8146c4b01d40e
SSDEEP 384:nDiFnZcIF38Nh8TUNTUlIRSyvEbmjkpfb7oV9Ph7OSmdlNu6HlytEDq14WZHy/7W:uFPF3awg2b/JoPMLuoy6DqyWZ
TLSH
T15ED25B32D8A4C9BBEDEB5E99F64E3A07DEE44153869C9AD8D5DC6D1C00CB1AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c76b636f966e5199609687cab4b931221f6f95fefe1a0a85302b1ccab27f45be
MD5 6ae9e0d8d40ab0ded45ffba485e283f0
SHA1 f4f63c02e19dd1cb616f82dde77903841f27d66a
SHA512 f6884d1b45e636acb2f7b056040a8229d9a16637e2d7f6d9cb33241a08f521647757611992915255229e3e5faf6df74e16f054436a6406d4a67aceafe83c8bb2
SSDEEP 384:n58iF9CcmyWCs38NzA8TUNTUlIxBydvioKajkpfb7oV9Ph7OSmdnqhkP+lFYS/Tn:xFccps3CAwgrx7JoPMnqhkoFYS/r
TLSH
T145C24A32ECA8C9B7ECE74FD9E74A7A06DEE011A3858896D4CAD81D5D00DB29D1307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 09a48413dda605054931190a0fdc1cb6d9586abddf2fe34c5446dad46325ea11
MD5 cc2b493db138981a04380c582a4de08e
SHA1 92bfb893ddc10fcfaba9c2614fd3389fe46e00b3
SHA512 ff4b2905b45e8653a695b230af5e61bcfb4f818d6459e33ab46dd7d589c8cbf1ec9870be81e86fc28abab9e76a4cb42e1541cec2dd61169ddaefbccf7d90c8b3
SSDEEP 384:n5OiFnZcIi38Nh8TUNTUlIRSyvEbmjkpfb7oV9Ph7OSmdl9u6HlytEDq14WZHy/C:3FPi3awg2b/JoPM7uoy6DqyWZ
TLSH
T13ED25B32D8A4C9BBEDEB5E99F64A3A03DEE44153869C9AD4D5D86D1C00DB1AE030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 98443cfd3b1288d9857c8847d1fa4ed3f8f73f9da54d1b731f5e7afb8703348f
MD5 1a740ad75301a6a39479d13269915794
SHA1 f2eb591d674638f50d4e9ada7b2be615a152c7ac
SHA512 8b08b7f4686c0e25bb7e65d2a41d46a25ca59aa1cbe42a72d72f0b8a0b23660c502b914b4bd5f0d7eecf3f8eebaa41ef4f3694ec2a5989a4c77624ea6b815ef5
SSDEEP 384:n5OiFiZcIS38Nh8TUNTUlIRmyuaEbmjkpfb7oV9Ph7OSmdl9u6HlytEDq14WZHy6:3FQS3awgg7b/JoPM7uoy6DqyWZ
TLSH
T164D26B32D8A4C9BBEDEB5E99F74E3A03DEE44153869C9AD8D5D86D1C00DB1AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c9e62d81ad8614e6db58aee135561a4d29ab758f2c797a2eb28513b5b821ecb3
MD5 4dcaa184cbf703d91d795e42bf092107
SHA1 8b22fba00a6a0d4e9582a425be9dcf21c40ed533
SHA512 612f6b5cf6a64c2a60ceb70f684a04fe846c5b3d674a77b68e2fb8134ea4d577fb0fabffe21dc8fa79204aa07bbee2cf9b8cb320e9638d660742c6eb9e2885a2
SSDEEP 384:nciFnZcIi38Nh8TUNTUlIRSyvEbmjkpfb7oV9Ph7OSmdl9u6HlytEDq14WZHy/7W:HFPi3awg2b/JoPM7uoy6DqyWZ
TLSH
T1B9D25B32D8A4C9BBEDEB5E99F64E3A03DEE44153869C9AD4D5DC6D1C00CB1AE030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1328-192-0x000002FF143A0000-0x000002FF153A0000-memory.dmp

Download