edd0278df4071d9b6ab8efad5e4259f1bf47b3e072b17d966fc3cc7644310d68

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
download.html
Size 91B
Sample260804-wywdbabq21
SHA256 edd0278df4071d9b6ab8efad5e4259f1bf47b3e072b17d966fc3cc7644310d68
MD5 aeb7c94a088b6f21cb6be038601633fe
SHA1 cbf79d55211770b836b6877511cc4623e3e8e948
SHA512 d90b0d34f7bb1e87dd2e001e6c8c4d33fb732ed3baf834a4de78917da57c2619feda4d7e2082009ddf2fbdf89e3db1babefaae5e312f5a1a6b37cf3202fb5de6
TLSH
T143B002FD5456614DDA1035A05DC13190589D43A2749187613ED0786E6554379DD8239A
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3804	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303412280570446"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{CCF052E8-DF64-4AF5-8B64-A934EE19304D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 1812	4732	msedge.exe	85
PID 4732 wrote to memory of 836	4732	msedge.exe	86
PID 4732 wrote to memory of 3804	4732	msedge.exe	87
PID 4732 wrote to memory of 836	4732	msedge.exe	86
PID 4732 wrote to memory of 836	4732	msedge.exe	86
PID 4732 wrote to memory of 1404	4732	msedge.exe	88
PID 4732 wrote to memory of 1404	4732	msedge.exe	88
PID 4732 wrote to memory of 3000	4732	msedge.exe	89
PID 4732 wrote to memory of 5000	4732	msedge.exe	90
PID 4732 wrote to memory of 3000	4732	msedge.exe	89
PID 4732 wrote to memory of 3000	4732	msedge.exe	89
PID 4732 wrote to memory of 5000	4732	msedge.exe	90
PID 4732 wrote to memory of 5000	4732	msedge.exe	90
PID 4732 wrote to memory of 2508	4732	msedge.exe	95
PID 4732 wrote to memory of 2508	4732	msedge.exe	95
PID 4732 wrote to memory of 2480	4732	msedge.exe	96
PID 4732 wrote to memory of 2480	4732	msedge.exe	96
PID 4732 wrote to memory of 2500	4732	msedge.exe	98
PID 4732 wrote to memory of 2584	4732	msedge.exe	106
PID 4732 wrote to memory of 5740	4732	msedge.exe	107
PID 4732 wrote to memory of 3452	4732	msedge.exe	108
PID 4732 wrote to memory of 5252	4732	msedge.exe	116
PID 4732 wrote to memory of 5252	4732	msedge.exe	116
PID 4732 wrote to memory of 1396	4732	msedge.exe	119
PID 4732 wrote to memory of 1396	4732	msedge.exe	119
PID 4732 wrote to memory of 2928	4732	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\download.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffec4d9c188,0x7ffec4d9c194,0x7ffec4d9c1a0
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,7242039586380797086,13099705776058629681,262144 --field-trial-handle=2080,i,15157903072298386723,13222243379057992587,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,11963683574638378666,6837657902390196381,524288 --field-trial-handle=2080,i,15157903072298386723,13222243379057992587,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,11635586222872169380,3979476338530869807,524288 --field-trial-handle=2080,i,15157903072298386723,13222243379057992587,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,9234256666006662834,2829701319683180067,2097152 --field-trial-handle=2080,i,15157903072298386723,13222243379057992587,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,174148257977998173,8902589920132547165,2097152 --field-trial-handle=2080,i,15157903072298386723,13222243379057992587,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,3272127212349018924,18410800355679602067,524288 --field-trial-handle=2080,i,15157903072298386723,13222243379057992587,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,2923593534189357427,2040957360413389712,524288 --field-trial-handle=2080,i,15157903072298386723,13222243379057992587,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,901208828918392947,15705665877785206122,524288 --field-trial-handle=2080,i,15157903072298386723,13222243379057992587,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,901208828918392947,15705665877785206122,524288 --field-trial-handle=2080,i,15157903072298386723,13222243379057992587,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,4020668356897249315,13699487159766974177,524288 --field-trial-handle=2080,i,15157903072298386723,13222243379057992587,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,7533245390728808555,7085562286280301883,524288 --field-trial-handle=2080,i,15157903072298386723,13222243379057992587,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,14713050778781649809,6069334714831979515,524288 --field-trial-handle=2080,i,15157903072298386723,13222243379057992587,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,14974379273867827048,17713323230820620448,524288 --field-trial-handle=2080,i,15157903072298386723,13222243379057992587,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,3470935582952190296,15688338487425993628,524288 --field-trial-handle=2080,i,15157903072298386723,13222243379057992587,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6156,i,4733680447496120276,16747738877899493529,262144 --field-trial-handle=2080,i,15157903072298386723,13222243379057992587,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 54a520352b3e4e661d02d93f216d339dea348a68e85a0d59f5cbf01bf6c523fa
MD5 64d26dee0d3082dbfbad24c576b19134
SHA1 d2a72f0d49cea5343fa78e14e0dc4de3dee24cdc
SHA512 5655051b0b054083a48a2380a3bb4a229a67af6cd5e18c00759e630679150b634fea0804631e5e45aba1223d62f4829899a746fec6e8c29217fb626179243e54
TLSH
T1D5E022A6CC22EC2719FD075AA00D8B6AE71213173A85995F3A3C91088FB4A3A85C6D5D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 90933ffd70f8d7e8479dd16e0b54ad0b61487e75420703280d535ed4460df918
MD5 4c500db312ea39ecff3c31e5fe9f7099
SHA1 f85e86c6bf833f379c58041be4c2f7dff9389e63
SHA512 2ffed310d01f0de7defd9ab37f203b6e11d3e9cc6e549f4a27fab90ca5b23763b93d6d8358da7198aefeaef4cc11a16b82ef2ab70dfe5cd34fa1a2f222747c5a
TLSH
T1D931E4F783F4856EDA0196F0EA18BE2FCE1D0510432C7DAA85E0AE1793E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 98eaeac5bb481709c885f01a0ec91284ae0f5ef0f568c4d54ca0f7149d5eb8f0
MD5 3e07057c09a4d1014037e05440903916
SHA1 f52e277131ce4c1e89410f2e6f2b406b3bdc03b4
SHA512 8fe6763d18d327900b2e350e9c0fe3878e9e18ec73c6149a8512208584f0e51420745cc63eeb2a655d6fd7202d21dfd3fafe7e550d216ee149c95aa24208ca18
SSDEEP 192:sxZhcR3/yMqZjK1Ml8Mkd/fVssJFkaZdEzodpHyHW6+WNGYvIuTd7R7+HIgj4J:sxZhcgMd/fVssfkaz3SHbGq79Yjc
TLSH
T1BF62F8066A3899778DDBD219F6457F93D2F91123A1904E84A9FCCE0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dd92635c0836aed99d726b55d547c5757d513ea6265b10e754921a5b33d91abf
MD5 83bd98ca882a44ac167f698897e6f336
SHA1 90892c0ef9790dd196b7532db604f430cd3ed0d1
SHA512 7f974a11329f22a19da38ab831b40ae4dd778a48b1286a6def5a902901f77cf8385c6247b81db6677b7ceaaa45a9962461c2faf893bac4f587f848096d6c4832
SSDEEP 192:sxZhcR3/yMqZjK1Ml8UQwkd/fVshFlZZdEzodpHyHW6+WNGYvuTXr7R7+HIg5t4J:sxZhcgqDd/fVsXlZz3SHbGZr79YXc
TLSH
T1EB62F8066A389977CDDBD21DF6457F93D6F91123A1904E84A9FC8E1C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8abd78b1bf671e12a47d721b66d6303b1266306fca64132391a4ece35c7f48d7
MD5 49b4a5ee0da870a4ac30de798ffe6326
SHA1 b4c98b1674852dd1dc5b6811e5585780eae58070
SHA512 983eddf607d18fd6e07e7025ed2f39cf98a84b14f88c2ec1eebf00e2b7ca22dc74e1eb9ecc604da3b83afccb549245b56cd91c6b28a2b730fc8e8659e9364a3c
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGn:05ppxnY753RNBvRJJdt7p5J9zx/B
TLSH
T1DBB28B5A713E0212397E2988B39596361F4235A37058E4AF7FB814A14F67E224CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 290a87381c493208a221deb04ec1bead021ee62a532801f7d19e853eaf3b8a8d
MD5 8d42a5326ef6839445c1cbc93ffd2614
SHA1 498464a3efe0c3c691e8e25ff27d4e8f114eebb7
SHA512 faec910323e6517376ee1900e959ce49150178a6de9efe00e9eadf3081b12800a55bef53750575dc2eed8afe4925acd5c6db8f1df7aea06fe35547e59f854408
SSDEEP 384:nV1iFiZcIX3sN88TUNTUlI4WQckCr8cdphiftGnKBqYb4Ti5wBeRs9JKgqijUX8A:WFQX3dwgRkkToGwqYETi5wTjKgqmUXx
TLSH
T10ED24A32D868DABBEDEB4FCAB75A36479EE44113C58C9AE4E5DD5D4C008749D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9f00a4f014dc9c9fa533818734fbd3b61b68115b73d897794f7c45e82f0c6128
MD5 fda9f2600d54818eeb1dd71535bac326
SHA1 fabb2819e43c3b43bd632f2251667db8e933c7aa
SHA512 70b0692985369820e240c41d95c2c32a77a9df3f90a56df84287e5d09a60319c61257475925406565b29ac46134f48a9150dfa442cca4e47730cdbe386759ce4
SSDEEP 384:npHiF9CcmyWCs3sNJ8TUNTUlIm2QckCr9lbKphiftGnKBqYb4mrpme4KV8p0OHB9:pCFccps3QwgbkUtkoGwqYEm8I8p04n
TLSH
T1BDB25C36E858CAFBEDE74F89B71E7A039EE01167859C9AD4DAD81D0D10971DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4b0d3d997e5f4419ee410137280a666f5a55f68f5d59c87ed6402418eedd67a2
MD5 e5979183c285c3ad1822d06519543393
SHA1 e9f2a2a7ade768075b75a357aed533c376f9c877
SHA512 5e8ad522ad9bb4c7ed7fd49289725967e2925088d89219481989eb7de63d2b03c3ec363841629c41564351ff7fe46f554a92772f7c39c3605e247c592d7a46a1
SSDEEP 384:npriFiZcIX3sN88TUNTUlI4WQckCrMcdphiftGnKBqYb4Ti5wBeRs9JKgqijUX8A:pGFQX3dwgRk0ToGwqYETi5wTjKgqmUXx
TLSH
T127D24A32D868DABBEDEB4EC9B75A3A479EE44113C58C9AE4E5DD5D4C008749D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b95f6c743bb2c4bcb62c71e8f169f93ad814e69d1350bad2f16b36d60b93f07a
MD5 e2b7b9d32dd987e6f16d853e3dc0afcd
SHA1 c1fd0fb769e14c2688a306fb1edc92ff10a7138d
SHA512 307c3ac5e14b76f477816667ce41ac2bf0678c4ae4a62ddfa966704da543b8961b7d152fdbe415b58b69780212754ef8269c8f542697fda81d9b2f228c203eab
SSDEEP 384:nVKiFiZcIG13sN88TUNTUlI4WQckCr8cdphiftGnKBqYb4Tw5wBeRs9JKgqijUXx:HFQC3dwgRkkToGwqYETw5wTjKgqmUXx
TLSH
T163D24A32D868DABBEDEB4FCAB75A3643AEE44113C58C9AE4E5CD5D4C008749D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 be184d29a07c16779085cb85a7d8b7eb40ca49fddd9bfc4ce83a43c46cb07a84
MD5 a7650cbc1fa63457a493e4620630eed4
SHA1 703b1c1a889f14a8cb8530f29cfa3cad1db7c984
SHA512 c45b43dd5122c4e31248074eddea6915748f3710924cdab2b11fb263cbc3b7149fa8a51bde9c249bd1fa84edd4eb92909c688b02e4eccb2abed6bbcf2c479ff7
SSDEEP 384:npHiF9CcmyWCs3sN48TUNTUlIm2QckCr9EwOphiftGnKBqYb4Ta5we4KV8p0OHB9:pCFccps3twgbkUtwoGwqYETa5wI8p04n
TLSH
T12BC25B32E858CEBBECE74B89B74A75039EE04267858C9AE4DADD1D4C10DB1DD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f98175be49bfad0e3ec376ea9c27edb37f3bbea63609fa0f55a6949908b5e2d7
MD5 45c3393ea3bce8a1b5891f94e2063ec0
SHA1 e7913b7b646d1755c576e20acb5ec0bbcb7c91be
SHA512 eba46ab4da56ba0b7a724e22e69875dd1de5f7f233c102bb321749c9958712eee451640a1ba184cd69ae225bbe2f8f475738c079876ee23c3d4c5c6c690139a6
TLSH
T180412358A7EA1044B3B76E569BF3A8BE087F79772F06C45D10010E4F0A26E80C8B173B
MD5 SHA1 SHA512 TLSH

Submit Download