81b7b4b440566bae2c7c89a968fc035bbd3e3b6eba70c8228bb0aa7be81edf3a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tatib5/app/Views/errors/html/error_400.html
Size 1KB
Sample260808-ak5tyayxdx
SHA256 81b7b4b440566bae2c7c89a968fc035bbd3e3b6eba70c8228bb0aa7be81edf3a
MD5 9b0db8d0e88530fce14c2c4bc37eb44f
SHA1 aa538ee764348732640b7a370b3a5e3be192a2dc
SHA512 4e3bad2f01338cb22fa64d7524caf6d47b417ff0a67b122842e2f2ebea36c85ced3f757fa9e19349015f2d241a3f45566134dc60a1b345483e8aa5e39a3a6bc8
TLSH
T1BC41DC1A4AB306416C53E5E13BA593C42666910B5846CE1D3FCEB390CF8D666AED3A8C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2424	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306219816063893"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{639249BD-2AE7-4576-8D93-8D0E21DC6305}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe
5464	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5464 wrote to memory of 5576	5464	msedge.exe	85
PID 5464 wrote to memory of 2424	5464	msedge.exe	86
PID 5464 wrote to memory of 1520	5464	msedge.exe	88
PID 5464 wrote to memory of 5668	5464	msedge.exe	87
PID 5464 wrote to memory of 1520	5464	msedge.exe	88
PID 5464 wrote to memory of 5668	5464	msedge.exe	87
PID 5464 wrote to memory of 5668	5464	msedge.exe	87
PID 5464 wrote to memory of 1252	5464	msedge.exe	90
PID 5464 wrote to memory of 1252	5464	msedge.exe	90
PID 5464 wrote to memory of 1752	5464	msedge.exe	91
PID 5464 wrote to memory of 1252	5464	msedge.exe	90
PID 5464 wrote to memory of 1752	5464	msedge.exe	91
PID 5464 wrote to memory of 1752	5464	msedge.exe	91
PID 5464 wrote to memory of 1936	5464	msedge.exe	98
PID 5464 wrote to memory of 1936	5464	msedge.exe	98
PID 5464 wrote to memory of 5488	5464	msedge.exe	99
PID 5464 wrote to memory of 5488	5464	msedge.exe	99
PID 5464 wrote to memory of 112	5464	msedge.exe	101
PID 5464 wrote to memory of 4492	5464	msedge.exe	111
PID 5464 wrote to memory of 4984	5464	msedge.exe	112
PID 5464 wrote to memory of 5428	5464	msedge.exe	113
PID 5464 wrote to memory of 5136	5464	msedge.exe	114
PID 5464 wrote to memory of 5136	5464	msedge.exe	114
PID 5464 wrote to memory of 1880	5464	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\tatib5\app\Views\errors\html\error_400.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff8d5e0c188,0x7ff8d5e0c194,0x7ff8d5e0c1a0
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,13739030977507092484,11031080008440223659,524288 --field-trial-handle=2656,i,12984250980340539314,3275383410064360022,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,11225616783470136200,10382039653286477607,262144 --field-trial-handle=2656,i,12984250980340539314,3275383410064360022,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:2
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,1502456959865243850,6201040545137119853,524288 --field-trial-handle=2656,i,12984250980340539314,3275383410064360022,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,12557317273740980301,13223777316484855323,2097152 --field-trial-handle=2656,i,12984250980340539314,3275383410064360022,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,1918451811265453128,9616432094144725345,2097152 --field-trial-handle=2656,i,12984250980340539314,3275383410064360022,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,17670490574055866522,7227176537207162489,524288 --field-trial-handle=2656,i,12984250980340539314,3275383410064360022,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,3169258621943004063,17287291477164878385,524288 --field-trial-handle=2656,i,12984250980340539314,3275383410064360022,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,12569648942727429443,3482645745180086611,524288 --field-trial-handle=2656,i,12984250980340539314,3275383410064360022,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,12569648942727429443,3482645745180086611,524288 --field-trial-handle=2656,i,12984250980340539314,3275383410064360022,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,9466652739876640656,8263924711759889278,524288 --field-trial-handle=2656,i,12984250980340539314,3275383410064360022,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,14249776432706204802,8761006215281726332,524288 --field-trial-handle=2656,i,12984250980340539314,3275383410064360022,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,14705658590333768826,385966558503686192,524288 --field-trial-handle=2656,i,12984250980340539314,3275383410064360022,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,10760096319594681059,1587054710756895076,524288 --field-trial-handle=2656,i,12984250980340539314,3275383410064360022,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6256,i,15401849918140058967,8677030989710286879,262144 --field-trial-handle=2656,i,12984250980340539314,3275383410064360022,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 54eb894c18a1fc38b84410f9a5bc914fc4b133e10eb3f2e6dfd683f70a3eae70
MD5 4901bb5c53259285e8ab5db92e761dac
SHA1 6afadaac0728d73ec3b2e5935ad394feef69cf3b
SHA512 d8c0624995770db87179a1a548bd4b58ef138695e6812b03f52e22db0fa6a0c8cdc82f16caa99837345d77d448ffbf56eb2cb90f971fc3a5410f292ad3b07180
TLSH
T13BE022B6CC62EC2708FD1718A0198B46E74013172A4089AF7B3C82088FB062A96CA85C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2c854f6cf827760e158fa5324f86cb6721b382ba1dac8ef14052145efebd8c64
MD5 998cf9d246af82dddb1567679b37c9bc
SHA1 3a2b0cfc551c85edfc6f00e3219be3d2edd7156c
SHA512 aa3e14e7a9d9863780ce464fce5bb0427b6145fbb0ffd1596b33b5c23e9c5299d00a3a5ad70c4ccf1874cc40dd4b219a13aa0c376704ee721bde1017f1e09a95
TLSH
T19431D2F383F4856ECA1195F0AA18BE1FCE2D0511431C3DAAC5E4AE1793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0fe34205c042f7d90c0cbb975c050eea8cf7b66d16202f61a251a0bb0c8a014b
MD5 eb31f282258bcf807aada588caf8e07a
SHA1 026cb95d16bd96b95944bd654cc4252b80bbc500
SHA512 91c4dec2c8578e328f1d2eb24c8b06c90e7defb3886fecde49651d3ef997a8ee46949b638c33645620af9477b1693f4af2774452fe180a53eabe2978533bc078
SSDEEP 192:sxZRRGyMqZjK1Ml8UQtki/fksdL8ZdKzodpHJHW6+WNGYvmt4hNLIg55KJ:sxZRTqGi/fksdYzxpHbGfWljG
TLSH
T19262E716AA38997B8CDBD219F6557F53D6F90133A1904E44A9FC9E1C04E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cfe37aa8037c58c643a5606f389f847bbaebfa68e95f5248863655521feb133f
MD5 247b3e96e9b27cd1bbb5910425385966
SHA1 26a9b87b09f17a3e3cb21eabc24079c4b2f1e94b
SHA512 3c326c803959ce7a8e2f51c25d115d5c306ce3e038a259f990c899b528e0ebebd9f0ae37512328cf7133d3123adfa241b2954174da65d2ff42d7085850f5e2c3
SSDEEP 192:sxZRRGyMqZjK1Ml8Mki/fksspLWaZdKzodpHJHW6+WNGYvIu4/NLIgjKJ:sxZRTMi/fksspaazxpHbGxljG
TLSH
T1BB62E806AA38597B8CDBD219F6557F53D6F91133A2904E44A9FCCA1C04E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 7b7112334a0fa7751aad2e39d72677926cb10efd6c043d41890e69ea8240edc2
MD5 56bae00d0414d266e80cb3c5bf20bd19
SHA1 8bc9c745f6d1a85c50cfbe5a13cd5aabddc74223
SHA512 c5d069755f3a42b088234b4099829351e7cdb1c03b67c28c9870c7f3d302646c360ee030e8d9c44dfd2c4f4b4f2722965a11a3c770a24eb40354542bdd370367
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGY:05ppxnY753RNBvRJJdt7p5J9/nx+
TLSH
T1A4B27B5A703E0212397E298CB39696364F4135A33058E4AF7FB814A14F67E225DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 808d1bd26dc3330a05dc94a4c711f91a942b11d468ccbaf5ff7aac9eaaeb39d9
MD5 894c2b3b67e8a23930261131c86bb8f8
SHA1 e277dd68a5ec87f2b73a7f953aa8f82774827505
SHA512 8c3249627d6558015f79e55d303b689e4d0e95fe027b3a96fb408aca40779c41518431f9413d1106cc3fa7836b24b608b753c770e3639364f14c5ff2a16086ac
SSDEEP 768:plFQk3owgPkVrzNDG045Zcd2pi/fwnewBKZOc0Q:Sk3Uerxyc6iAnevZ/z
TLSH
T14BD26A32ECA8D9BBEDE74B89A74A3603DEF44263D5C86AD4D9DC5D1C009719D030BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e94385b0a7f315de9a4dd34904a33ba817527e3623a544aff420e5dd1de5f645
MD5 4eec1ac1b997fd2dfb081202e7f3f2be
SHA1 5f4f04af66b029623d5e19ef72b57974037a178c
SHA512 8843b32eac8b703bdb202da6796c284507bf6c39acf998c7eb83a71e81a63eaaad8cc9b94afe62d3526b137ad4409f5fad8e8e41649969927aa40e34a4916536
SSDEEP 768:6FQk3owgPkVrzNDG045Zcd2pi/fwnewBKZOc0Q:3k3Uerxyc6iAnevZ/z
TLSH
T1F4D26A32ECA8D9BBEDE78B89A75A3603DEE44263D5C86AD4D9DC5D1C009719D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 08d7c9c0330bdb6200fef7572bd19043d9b85b958470e6fa6f9543428a22b4b0
MD5 ed49ab240e08e563cf1ba20a250e2e8a
SHA1 fbff721732d1fbf4d87ad760a2d8b26e9042fca8
SHA512 52e6f9751cf00cc5134f138f27487cee11215e058114177ac6957a71555672364515f3434ffd5d85dfda73e9c8a6c6fb1a685eca70b560e0037a0bf282a1bb1c
SSDEEP 768:pLFccps34wgbkU892DG045Zcd2pZfwI8p0MLC:Js3aWYyc6GI8p0MLC
TLSH
T15CC25C32EC98D9ABEDE74B98A65B3603DEE04267C6CC99E4D9DC1D0D00971ED430BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0f3ec86b19bf4bc37773d977181a1094cc55a4b1d3e9b00d101afa59f7818e03
MD5 d6d084d17f53937bee49cd9831acbbd5
SHA1 fe20d8c46bad0058d79fbd21aa76ff005d4132b5
SHA512 4bd695e06a5418c1da519e0b60b292d0bd53d668e00638749767440e7d6362cc2dd533246fe1b50c2200ce2edab446f2b485560032d38cbf1f3b54cc531a038e
SSDEEP 768:9FQA3owgPkVrzNDG045Zcd2ppDfwnewBKZOc0Q:8A3Uerxyc6pMnevZ/z
TLSH
T1D7D26B32ECA8D9BBEDE74B89B75A3603DEE44263D5C86AD4D9DC5D1C009719D030BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d2d5bd9d3ba25c883e441004bea1589d8fde9d32c547a9cee8f3c19d63c63a8b
MD5 fd6ed5c505718ecdf2c5afe31d13556e
SHA1 824048fc8d41fea85f729b6b5ab2792e8568445a
SHA512 0064e3a44319ca786d845c9033cff55fcb56835189e2cde4b28820be73b9e2f56fdff9a89f1deda349979395a3f84f69427146329c0ce9da71a03f27ec1cabf2
SSDEEP 768:pcFccps3GwgbkUUkDG045Zcd2ZnI8p0MLC:Gs3olyc8I8p0MLC
TLSH
T117B25B36EC98D9B7EDE74F89B74A3A03DEE0126785D859D4CADC1D0D009709D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d0c33beea86aa2c9c923f418ccef674775be21ea18bb7d102c1f0c3fc0151581
MD5 22353cda6a6b678af3c85cf81ba8e044
SHA1 576e8c0c931cd8ee01d526af2470b179f3f2c53f
SHA512 00ef3527d6fd87f7fb3e06ac377161b3115272c7e1d75b55829e3824f5a9a0cc22679bc9696c10cd7cb5e5a9156138587a66bf3b31844576a0066c5db82b2ae5
SSDEEP 768:plFccpe3owgKkVlzNDG045Zcd2pK/fwXN:Pe3Helxyc6KAXN
TLSH
T168B23932ECA8DDABEDE74B89A75A3603DEE04263C6CC59D4D9DD1D4C019B1AD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2c802db9b5582d1008ede0e6baa6af2fb0a05a8ab198bf628afebfe2f59a2d71
MD5 2e13a2b065c220be854a3ba419ab2146
SHA1 5a79ba37d945d9c9eb0df0774fbf977877a97abf
SHA512 198baaa0367523c78929cab4c0e1112846e893a3ab4a287af46ad62cf4d67e413016f4b385c1f05e0adc08750678ec78be5af724e4950268c924490a31c87bb0
TLSH
T145412758B6ED1148B3B37F5AABF2A9AE543FB8733F06949D00110E4F0662A44C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/112-197-0x00000185AB8E0000-0x00000185AC8E0000-memory.dmp

Download