0682b3e64928ec8c8a5661e20c68ae46f010617e8bbbc9276e7eff7ee88e32ce

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cippylearn (14).html
Size 1KB
Sample260804-aj461sswew
SHA256 0682b3e64928ec8c8a5661e20c68ae46f010617e8bbbc9276e7eff7ee88e32ce
MD5 207bdf9ead1796e0c5ed4f9ba85e6cad
SHA1 f70f4d89ede0561218f6f6cf1853a663f9d5c739
SHA512 285777a33ed7144b3d9e550e097c258d41ff9466fbd149505b0c5077ac4df7c14dab9510ae28cbfe94fb245d2aba709902d8a986b78f9aa5db475ef385685796
TLSH
T1D121565215D0510E7053406675C1E109AE50AE4B933F21A3F8AFCB65DFCA7A346B762C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2864	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302762305894706"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{F097F271-674B-4CE7-96EF-35DC015C6E03}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4704	4836	msedge.exe	86
PID 4836 wrote to memory of 2864	4836	msedge.exe	87
PID 4836 wrote to memory of 3300	4836	msedge.exe	90
PID 4836 wrote to memory of 3300	4836	msedge.exe	90
PID 4836 wrote to memory of 1100	4836	msedge.exe	88
PID 4836 wrote to memory of 1100	4836	msedge.exe	88
PID 4836 wrote to memory of 1100	4836	msedge.exe	88
PID 4836 wrote to memory of 5320	4836	msedge.exe	91
PID 4836 wrote to memory of 4136	4836	msedge.exe	92
PID 4836 wrote to memory of 5320	4836	msedge.exe	91
PID 4836 wrote to memory of 5320	4836	msedge.exe	91
PID 4836 wrote to memory of 4136	4836	msedge.exe	92
PID 4836 wrote to memory of 4136	4836	msedge.exe	92
PID 4836 wrote to memory of 2320	4836	msedge.exe	97
PID 4836 wrote to memory of 2320	4836	msedge.exe	97
PID 4836 wrote to memory of 3376	4836	msedge.exe	98
PID 4836 wrote to memory of 3376	4836	msedge.exe	98
PID 4836 wrote to memory of 4884	4836	msedge.exe	100
PID 4836 wrote to memory of 1212	4836	msedge.exe	106
PID 4836 wrote to memory of 5932	4836	msedge.exe	107
PID 4836 wrote to memory of 5232	4836	msedge.exe	108
PID 4836 wrote to memory of 4880	4836	msedge.exe	116
PID 4836 wrote to memory of 4880	4836	msedge.exe	116
PID 4836 wrote to memory of 4404	4836	msedge.exe	118
PID 4836 wrote to memory of 4404	4836	msedge.exe	118
PID 4836 wrote to memory of 2396	4836	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\cippylearn (14).html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffaa0d2c188,0x7ffaa0d2c194,0x7ffaa0d2c1a0
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,1083682954870910142,8463014680147609590,524288 --field-trial-handle=2284,i,16199491365143410975,3432811749423978989,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,2732771888950943984,8610503794407510007,262144 --field-trial-handle=2284,i,16199491365143410975,3432811749423978989,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,12999179076285016840,3831242285271875971,524288 --field-trial-handle=2284,i,16199491365143410975,3432811749423978989,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,1801951973292776183,17607090061549513811,2097152 --field-trial-handle=2284,i,16199491365143410975,3432811749423978989,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,2927955797165664485,14757272710109504995,2097152 --field-trial-handle=2284,i,16199491365143410975,3432811749423978989,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,12537730042875410750,4372320851268312177,524288 --field-trial-handle=2284,i,16199491365143410975,3432811749423978989,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,16536334367803411446,735704094346395489,524288 --field-trial-handle=2284,i,16199491365143410975,3432811749423978989,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,17222815193351702230,2696551986812337664,524288 --field-trial-handle=2284,i,16199491365143410975,3432811749423978989,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,17222815193351702230,2696551986812337664,524288 --field-trial-handle=2284,i,16199491365143410975,3432811749423978989,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,18144668280965556173,6672230600303086748,524288 --field-trial-handle=2284,i,16199491365143410975,3432811749423978989,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,17825204070157898373,16399996565413329127,524288 --field-trial-handle=2284,i,16199491365143410975,3432811749423978989,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,1366338082764601298,16334197960047956558,524288 --field-trial-handle=2284,i,16199491365143410975,3432811749423978989,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,11257165187885776816,7552700739484646749,524288 --field-trial-handle=2284,i,16199491365143410975,3432811749423978989,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,13956303262428341736,9086530076726608270,524288 --field-trial-handle=2284,i,16199491365143410975,3432811749423978989,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5344,i,2467385469370618664,3314464801417059594,262144 --field-trial-handle=2284,i,16199491365143410975,3432811749423978989,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c84dc6bda6afee9244e3fd4c7891632233721444447c128f74045894eb458c94
MD5 fe976b2b14c3202ff45cc461db6e624e
SHA1 021fb44bc40bbeb5eaf22c25150f3e673ae64751
SHA512 1a8113652844a709bc6b8324728bad0c646480f7c6cd7587f5e32e87e49c01280b7db2cb134e6205fcdf814f0970d42ac516236d10a8f038b0279b5542d38286
TLSH
T1B6E022A6C832FC2708FD076AA00D8B5AE755131B2A418D5F3B3CA1088FB462A85C585C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

9d9060c4-9120-48a3-b128-25468ed0b840.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9d9060c4-9120-48a3-b128-25468ed0b840.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 affb44fae25e43a0e1de0dd96fd0b48285d72a6133c355e698bf2dfd911d53cb
MD5 49a63f5e3f1570c3da4f97a0edc7bab7
SHA1 91fb2a23a3b64ab22435ea1971eed375417d01c0
SHA512 2a96193da1d8d87f4a2fbbfbf01b9c3a87e8d60671b22073a18f1cbb7bfe82083942cbc979cd78e2b8582cc769172dad3118706a980314ac43dd5a7b82b687b2
TLSH
T1F8519EF783E4866D991196F0AA14BE2BCE1D0515432C3CAA89E4EF5B93E2471E10275F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 45e78ac31fc2e140aa8366150df663b1bbb80d3dc394f12a3b33a0c28a7128f1
MD5 7e2aed128daee6d28393f5e8de10e446
SHA1 6d14d5f51c75caf7f8901139462a1c18aea0c8ec
SHA512 925e760fd465a094f175dca162b09026ac14ad06538bbb702393c6f9de33076ac9ccce47c2d836daecafee787c34cfdbed3ec8e09041b788431c3575deb01934
SSDEEP 192:sxZSR6yMqZjK1Ml8UQKka/f1ss7CZdWzodpHhHW6+WNGYv/PkK++Ig5XOJ:sxZSTqZa/f1s+CztBHbGNKx5a
TLSH
T14862F8156A789977CCDBD209FA497F53D2F81073A1A04E44A9FCDA1C05E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cbafa842831b7704741a564b14072ef9d6186f678472667363cf440976150bf1
MD5 d96c9868d12d61c1f6b72fa39614a59b
SHA1 f284564b430b5b8204af72e4a060cc654548e60d
SHA512 8e17513caef95747994c127e8179b3dcb9d8f3ccf3462fd5a5755e5749f9a5271f12f6a367672a5e04d2897791a317f559cb830dc32b79bcd98b9d9a963ed625
SSDEEP 192:sxZSR6yMqZjK1Ml8Mka/f1ss7CZdWzodpHhHW6+WNGYv/PiK++Ig5XOJ:sxZSTMa/f1s+CztBHbGLKx5a
TLSH
T15062F8156A78597BCCDBD209FA497F53D2F81173A1A04E44A9FCDA1C05E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e13175053dd4796869e879f792f0c1f37c9ae099ae5084a2b85d7e9cdd9136e5
MD5 99d4e0afba6a0d568316d5439d0cbd11
SHA1 3e11a6c8faecd5a8a04919e88b228313e6edd212
SHA512 8b0623267eed0b42970943d9f80ca5c79f8ae3dd369e242cdf14c59c65b45df1c60f9e063d66d10f88f34bb95984641fcbf645f4b44771fba56c136c80125b14
SSDEEP 192:sxZSR6yMqZjK1Ml8Mka/f1ssd7WaZdWzodpHhHW6+WNGYvIC+K+nIgjOJ:sxZShMa/f1ssdWaztBHbGrKCja
TLSH
T1EB62F8166A78597BCDDBD209FA457F53D2F81173A2904E449AFCCA1C05E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 40569129208743f2c7df3e4302bfa15788387c8f6d4868a9a364c8a84d4dedb5
MD5 335f3a1f47a61fde93bd14d2c9658d67
SHA1 89d97b91b322373b22f34b3c5654003626bc1300
SHA512 72f1512d7e102bddde9f19d607501bbda1c6c4da299adc2616acd601f68b0728a169cc0226eedd8f77cd5cd471718def5673439ca877c20511169f2232dc7c01
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGH:05ppxnY753RNBvRJJdt7p5J9NpZ9
TLSH
T1ACB2685A703A0211393E2988B39696364F4235A37058E4BF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 dff9e19e96d2b9df9fa5de2c0113aa56905ba6c2bd8ecdd90421fb89d087cbed
MD5 bf69ce6cbeeb56b473226638f6e4c3e4
SHA1 2e9228a070ba65aca9e8188fb4e12b1a03c6cad4
SHA512 24714ac052cdd2a7eba1d4b292aed6ab5a00a5c9bad1e915e0b57b719192f4f9bb3ff84c226aa0beacb6bc4ca2c76126b4510cf087950fceb7cf59de4ab693c8
SSDEEP 384:nWEiFiZcIe3sNR8TUNTUlI4EQckCrv9fphiftGNZO0saBkyrwFABeRs9JKgqijU9:wFQe3owgHk8RoGNElswFATjKgqmUMr+
TLSH
T125D26B36D8A4DAB7ECE78FC9A74A3A03DEF04113C5889AD4D5DC6E1C00875DD530B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 725b20fce454ff8c842c213b9782b49d2435f6bb26bc9fbf45a7fa94c4cf753e
MD5 11d837b56a413a6dc0255ff9026af4be
SHA1 4e8bf2e801e5d272bed106884c114a5fbb252a24
SHA512 2704d7f98dbd8332c2bdc65b4ba53c2dea0ec9857af01d972bda8a10e718438dd4513b7fda02572dc78995c99dc8e70b302571a6bdf7e0b92cb56caa7a9d7342
SSDEEP 384:npziF9CcmyWCs3sNx8TUNTUlIm2QckCr9lfKphiftGNZO0saDrp6e4KV8p054HVt:peFccps38wgbkUtkoGNEsYI8p0gH
TLSH
T1CAB25D36EC68CEB7ECE74F99B74A7A07DEE01227859C59E4CAD81E1D00971DC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 574b0dd22115ac72cf8ef08c1637b6b7c5fcadecda1f7d0652216dbd218bbcb7
MD5 ead610644f1bd5a8b1e253f4e5e952b3
SHA1 8b3cb32778111ba3beb8a6e76068ffe6adf1fc29
SHA512 24fe47eeed0dc803437164915ca420c83db93a7f03bc908bb11619900e0db5898a4ac45ba53b2d0d6bcce693f86b3167cd0691c93ea02917f30836f60dfabf3d
SSDEEP 384:npqEiF9CcmyWCs3sNR8TUNTUlI4eQckCrR9fphiftGNZO0saBkyrwFACty/7Igm:pEFccps3owgPkqRoGNElswFAU
TLSH
T14AB24A36ECA8CAB7ECE74B89A74A3603DEF44267C58C8AE4D9C91E1C01D71DD530B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f3bd0710cde37a414854431a44d66efe68188fe98f04c83ce7b3e5ad98012f07
MD5 8dbc7e32261fb9921c2917f97191c2fa
SHA1 9aeeb480353ff862aff34057227d5475fefeb481
SHA512 776dc4cc5057903e0a6b39680ebd65e0a7a473dd22939367ee37afcd88a844f476a5b42b2a54a55c1c085f47a6243d58686d27007da5353ec3bf65a0eca6b568
SSDEEP 384:npLiF9CcmyWCs3sNd8TUNTUlIm2QckCr9kn8phiftGNZO0saBkyr5FAe4KV8p05o:pmFccps34wgbkU2KoGNEls5FAI8p0gH
TLSH
T12CC25B36EC68CEB7ECD34B99A74A3507DEE05227868C9AE4D9DD2E5C00D71DC930B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9562caa3b9b06fe619f6a3d78e934619ead2a7b6bb992dc29b06d866c687a217
MD5 19da7316caa9facfa64e2c851ab656f0
SHA1 a26b228ae0b7402e554df315ac2914ebc929c483
SHA512 6aee05d9cac9e25413eb59d9c7baaed9fba3c87c4016e611a6e0d0441dd1731def64017ddd115bc781cb57ba61e7e7d0c0959ac3245c8cf9d240a0417ee59894
SSDEEP 384:npqEiFiZcIe3sNR8TUNTUlI4EQckCrR9fphiftGNZO0saBkyrwFABeRs9JKgqijO:pEFQe3owgHkqRoGNElswFATjKgqmUMr+
TLSH
T1C5D26A36D8A4DAB7ECE78FC9A74A3A03DEF04113C6889AD4D5DD6E1C008759D530B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2a1cf10822b02b1707e3242123cb6ccd5aeefec9be00e689d58bd4820f982cc8
MD5 c6082ba4d88558e9865240d27bbe048b
SHA1 90759d5ad9c32e330d5e45e64f65715b76ef3fc9
SHA512 29160e5bd5869fab17aa58b3ba990216386cb971cb46d2922e35c564fa823412a3879843b840075242893814a6d8e64d4e6948e2a363d07a2c21f9ba754d3708
SSDEEP 384:nW1iFiZcI3o3sNR8TUNTUlI4EQckCrv9fphiftGNZO0saBkyrUFABeRs9JKgqijO:vFQY3owgHk8RoGNElsUFATjKgqmUMr+
TLSH
T1C3D26B36D8A4DAB7ECE78FC9A74A3A03DEF44113C5C89AD4D5DC6E1C018759C530B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4bc64df73a97ba780ea6d7b19c630c3b8af9a3b7c1c6f2a1df9f4569b8cb0a5c
MD5 a97337a39e2ad12a81fdfae7b3965dbc
SHA1 e5fb2cbfa797c4078217e11a83ba5d6ff8cc043f
SHA512 d55ec7b621c0d479da68f4791232824c640720f7b6c2fb65cec6d9b635a0160dc61b7a10427e6cda8977d25ae3b4c0e6f10862d2fc1c4d8f1a2c3901d4c0346b
TLSH
T1DD41F55CA6F9114873B77E5AABF3A46E447FB9772F0AD55D00110E4F0622A40C87173B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4884-223-0x000001AB2F330000-0x000001AB30330000-memory.dmp

Download