8153ae628fa7eaa76267ee84247319847ba7811f4d98a30600c403b7d462aa83

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Murrsuits.html
Size 32KB
Sample260809-espj5shk41
SHA256 8153ae628fa7eaa76267ee84247319847ba7811f4d98a30600c403b7d462aa83
MD5 76d89cac4c4e2e44258558f6b39ecc9d
SHA1 576af98603a468ac0e8640916da6b35276289349
SHA512 1ad5f90712202dd80c4f74e310fd8ef9e399a468b88cdec04b10e50a5a74701efe9aeb1273f641f23e53574959d82f5e16c310f6c1d122bc5892fb09db797e1b
SSDEEP 768:544LghSsD7BLkhFrsJR9MsIPfrYCrzNu8eM/2:F61khFOvM3fL9mMe
TLSH
T133E2A5F71EC75A1B165142A4B6202E68F523A10BD5A5CD5EB5BC07C72FC8F78AC33289
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5828	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307224178392562"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{B6C894B4-D333-4785-BC4D-702C07D155B9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4280	4572	msedge.exe	87
PID 4572 wrote to memory of 5828	4572	msedge.exe	88
PID 4572 wrote to memory of 3492	4572	msedge.exe	90
PID 4572 wrote to memory of 3492	4572	msedge.exe	90
PID 4572 wrote to memory of 1320	4572	msedge.exe	89
PID 4572 wrote to memory of 1320	4572	msedge.exe	89
PID 4572 wrote to memory of 1320	4572	msedge.exe	89
PID 4572 wrote to memory of 3980	4572	msedge.exe	91
PID 4572 wrote to memory of 3980	4572	msedge.exe	91
PID 4572 wrote to memory of 3980	4572	msedge.exe	91
PID 4572 wrote to memory of 6120	4572	msedge.exe	92
PID 4572 wrote to memory of 6120	4572	msedge.exe	92
PID 4572 wrote to memory of 6120	4572	msedge.exe	92
PID 4572 wrote to memory of 2872	4572	msedge.exe	108
PID 4572 wrote to memory of 6092	4572	msedge.exe	109
PID 4572 wrote to memory of 1176	4572	msedge.exe	110
PID 4572 wrote to memory of 4580	4572	msedge.exe	112
PID 4572 wrote to memory of 3736	4572	msedge.exe	111
PID 4572 wrote to memory of 4580	4572	msedge.exe	112
PID 4572 wrote to memory of 3736	4572	msedge.exe	111
PID 4572 wrote to memory of 4576	4572	msedge.exe	113
PID 4572 wrote to memory of 4576	4572	msedge.exe	113
PID 4572 wrote to memory of 6064	4572	msedge.exe	115
PID 4572 wrote to memory of 4308	4572	msedge.exe	119
PID 4572 wrote to memory of 3236	4572	msedge.exe	120
PID 4572 wrote to memory of 3236	4572	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Murrsuits.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc1b77c188,0x7ffc1b77c194,0x7ffc1b77c1a0
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,11881894992042663131,3244492649969674466,524288 --field-trial-handle=2932,i,12200258867049829356,5894235084247815500,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,8839218772988373536,9429502817337672672,262144 --field-trial-handle=2932,i,12200258867049829356,5894235084247815500,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:2
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,9147985514656726994,4898094184369282565,524288 --field-trial-handle=2932,i,12200258867049829356,5894235084247815500,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,1719267492029957813,5396122512082674039,2097152 --field-trial-handle=2932,i,12200258867049829356,5894235084247815500,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10976979118534433156,5918307713421955219,2097152 --field-trial-handle=2932,i,12200258867049829356,5894235084247815500,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,7862628029818325537,6450118470444897269,524288 --field-trial-handle=2932,i,12200258867049829356,5894235084247815500,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,7729602014687938678,12135078000205238163,524288 --field-trial-handle=2932,i,12200258867049829356,5894235084247815500,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,5600021119969141971,4537860245435900376,524288 --field-trial-handle=2932,i,12200258867049829356,5894235084247815500,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,167211147250740967,4779873093178138460,524288 --field-trial-handle=2932,i,12200258867049829356,5894235084247815500,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,2309777107035294291,2483495771369272072,524288 --field-trial-handle=2932,i,12200258867049829356,5894235084247815500,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,1944113272413884283,16140317482220901854,524288 --field-trial-handle=2932,i,12200258867049829356,5894235084247815500,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,15694290941788721028,9325408813732441517,524288 --field-trial-handle=2932,i,12200258867049829356,5894235084247815500,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,15694290941788721028,9325408813732441517,524288 --field-trial-handle=2932,i,12200258867049829356,5894235084247815500,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5092,i,5968685296860627060,13304089295327498196,262144 --field-trial-handle=2932,i,12200258867049829356,5894235084247815500,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,1494553536282207774,5867901472223758368,524288 --field-trial-handle=2932,i,12200258867049829356,5894235084247815500,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:3236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 dc6a529506e10449fd5516f7470f0e27a9a122573804b68907d826e4db5dfb39
MD5 912ae6ebc97c038510a07db59d97e94c
SHA1 8a57bbd8170111c380632c5bcc0bce7843776ee6
SHA512 fafc709866f84b87ea7eedfd1a7c285501227919c1646a816923ef5c50fb1dee1c822574e1c213278a91c29a010628176fde0d499c42a36e79f5cbace616e88e
TLSH
T14EE02B65D822EC3708FD5B58A049865BE74113572642495F3A3C81098FF072A45D589C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000c5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c5
Size 33KB
SHA256 faa24ec881e6040655c187a681d6dc496eb8aa41e1bd0652a180b3a40b457187
MD5 f953f499c9824953791551bfef65fe61
SHA1 00fbf8d23d0e9549798383179c9b0eae5d653f9f
SHA512 07bf316d186ac8d6eb8cf860fd0dbce854ae74ae26276be3950bd32b06894c7b24268280d504bb490218c5ec0e85b4eeb7e858011dcf4de64bbb06e4eb296fca
SSDEEP 768:Pr8FwJ2kfmG7rCq0GJtSBVRF0UGuEuOZejwpiUCTVwiYz:PVJ3fd7rCqduSduOZnIVVwvz
TLSH
T1D0F2F185B0036A346E502FB459DBE6CE1FADF8041A5318EDCE9DC30BA394C7648792BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3b5d4c7c-a94e-4cdb-928e-43f2ba63df9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3b5d4c7c-a94e-4cdb-928e-43f2ba63df9f.tmp
Size 9KB
SHA256 670f5c7ea4bce633bf64c596b4729477da1c95dbd9e2fa2c6304970553dc302f
MD5 94d2ed6ccbb333077b0ea0c4d6af0827
SHA1 a37214894668e8ed9cf8422867bfcbeb202205a6
SHA512 af7d569031b9aa1d22a56fa06d561519454ed3a3a2e36ca398c2959a11302afe9400279b57c7ad25179505ce1ff829948c3731e3d712bdfc106f84cf4e81ad18
SSDEEP 192:D1/jeQBJOKqaaij6V3v7gVLJlrLZOv1fZr6ty7wjKHrvd/HLh/ZL4pKz/Rv/Gm3k:D1/jeQBJOKqaaiGV3v7gVVlrLZOv1fZw
TLSH
T10B126AB7C3E44B7E891252F09B256E2ACE5D151B427C3C96C9F4BE1B63E25B0E10129F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 41f175a05950b21e75fccb6d0c248fee491e80e23c76f97e511c7d3092c49511
MD5 752bfdb321efedfacbfa581f16f79d17
SHA1 450a6a514cb5f26a4ab3d6d21cf0fc7b8432d009
SHA512 bb10e1146e16ef9e6a85ad6d88e50358eb6bd3a7bf7a85d6a3ec83e8b2883549be4143c428e6ed9e5baaac22c8b464e42700204a2a8cd0b042967c0b4d1cef48
SSDEEP 192:D1/jeQBJOKyKaaij6V3v7gVLJlrLZOv1fZr6ty7wjKHrvd/HLh/ZL4pKz/Rv/Gmw:D1/jeQBJOKyKaaiGV3v7gVVlrLZOv1fO
TLSH
T177126AB7C3E44B7E891252F09B256E2ACD5D151B423C3CA6C9F5BE1B63E25B0E10129F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 60b80159f73ec579adb2dd30e4562147d050496fafc3bc6244b567a7e2deefb2
MD5 592594b3b5f4e1a1e97a08c779a9fbd2
SHA1 f573e744508244f60632c963c1605d8db464f860
SHA512 778691b1fef9dbfffc518bc970af1c9aac0ad330e1e7161327fa06c35accdcd5a2e2ca106eda9512838a7bfdb3452a40e9810bf356979d5c92b792b498d11914
SSDEEP 192:sxZsRdyMqZjK1Ml8UQukt/fVsXAZdUzodpH9HW6+WNGYvpiMxsKIg5cQaJ:sxZsyqFt/fVsXAzndHbGuL6QW
TLSH
T15B62F7166A349D778CDBD209F685BF53D2F80173A2945E44A9FCDA0C05E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 22172017c1b6e47122ff6ef4a1b7e5a28c5833713da3ff43807ce356a4cc84b3
MD5 169436892d34e203dfb6886d43dda870
SHA1 0cdc967199aa7610fb220bc4376b9989f08f296a
SHA512 a457a77d34232f1cd2e71d358c5962d62c2dacb21d94b3eb9e77be8b0b205da3683f56f30521b3f97d29f347d7b8338480f65ce9b03e542c46ab5024e057eeed
SSDEEP 192:sxZsRdyMqZjK1Ml8Mkt/fVssy0aZdUzodpH9HW6+WNGYvIC+s6IgjaJ:sxZs6Mt/fVssy0azndHbGrpjW
TLSH
T1AB62F9066A38997BCCDBD219F6457F53D6F81173A2905E44A9FCCA0C05E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8500a1077f93549510025c9935e8e350bff977657f0a599a8dae80b575dcea90
MD5 2fdfb450157358229d4f0450249cf1c7
SHA1 31ffd42dffadaf56c1b4d1e4637eca4952c77be6
SHA512 61c2e2c2e4fc639be829a62aab24c21b77398f5226f05bccfefb43cbbd4aa365b8f859b054680add006fb3cce3f7844d9a8ebd5f7d4ec2edaa9731d2fda62add
SSDEEP 192:sxZsRdyMqZjK1Ml8Mkt/fVsXAZdUzodpH9HW6+WNGYvpiIsKIg5cQaJ:sxZsyMt/fVsXAzndHbGgL6QW
TLSH
T1FA62E7166A349D7B8CDBD209F645BF53D2F91173A2905E44A9FCDA0C05E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 2d598cb6d91dfbc24e39e5440908781220c6fb4db58f74f467ce585c4916e957
MD5 29ef26f0ef77a3b34180dbde0c4637d2
SHA1 08f90d48fd707b55823ec1fa51075f6bca809f76
SHA512 fcb06e2e1477bfbd27baddea5fcb43ae2482c269198f4984c1fa3d30b7f8051d1663b8fdaedf9533fe38906a209d8d515a97e5a76d47245313ba306dc2ffd901
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGD:05ppxnY753RNBvRJJdt7p5J9bPvWW
TLSH
T1B6B2465A703E0211397E3988B39696364F4235A33058E4AF7FB814A54F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 d9e4cf20e052a5223b8ffd9dc2dc87b0aad5b6ccc20a1295b47e69927e56b966
MD5 42788f67cde75a59b55d5da3da2a5093
SHA1 fceb77f2d408f2ecfad8033f599c7224f7bdd7e4
SHA512 26df00b303e69216becd8fdd08a5cd6b6b2abf55a95f6e77ae8fbaa27200ee14e474a152df5466108bbcd16f028ad6b25c325f7ba423dbaf70b04fcce041bf31
SSDEEP 384:nKiF9CcmyWCs3sNo8TUNTUlI44Q4QckCrM7TpvtfxGp1UanuMX+j7kH3Qty/7Ig2:BFccps3pwgNQQkTdXGp1UhMXM7kH3S
TLSH
T14AB22A36ECA8CE7BECE78B99A75A3943DEE44163C58C59E4DAD81D0C009B1DD130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a39e0f5538d97213cf288a676ada64bb602b4f1425e8a2ebe3e7733dabfaf00a
MD5 5d8e46434f032e543e469b7b58367d6c
SHA1 489c419960169ea3ebbe89db1cf5a40ca4156f79
SHA512 376949ce72682b2d5ff519f0cec647d0f37e14ba86e2100cc28fbce8e1d4710d414ab5cbb9f4d8aa9985fe8306d1eba093fe34b6bf917e2d510438ea8286bbf2
SSDEEP 768:pzFccps3pwgNbhWkTdXGp1UhMXM7kHI8p00LV:ds3FbhWa1iXPI8p00LV
TLSH
T1B4C24A36ECA8CE77ECE78B98A64B3943DEE4515385CC9AE4DAD85D0C009B1DC530BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 0d7d4664ed3efe654aea499ece2088f0a4941b9d6d1bb09446c081a4a10cc8aa
MD5 d0a826433ff24f68a50a2505c2cf7966
SHA1 6481dad7963ffe0553ad584240641b0639339500
SHA512 702cdbb5e2cedf51af23f8688eb07feb6e0953747d448457747b0eb68e58f9138877d4d4c0591cf377472b9b2aaabee7ece1b90457115576eaefd6ffdff787b5
SSDEEP 384:npriF9CcmyWCs3sNTQ8TUNTUlIm2QckCr9lYUKpvtfxGp1Uan1b2pye4KV8p00LQ:pGFccps3BwgbkUWUkXGp1Uwb9I8p00LQ
TLSH
T158B26B36EC68CABBECE74F99B74B7A03DEE0116785D85AE4DAD85D0C009719C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 46a7659cffc3961a251a1be92a7472fbc6f9c7a19e4be37d6c2a55f73edb366e
MD5 8addfa6516529d4dc6f50947e12c1aae
SHA1 448fbd0ee74d5841410211bf16269e43485a95bb
SHA512 1eacb0ab062a58e665d51d0a6db4fba33b621b8ed3ab71a678b88ed1a82e02ac95c9e5554df3cc458fcbb650fb96ced15c3ecbe722cf4eb5d4fb3bbba27c13ea
SSDEEP 768:7FQj3pwgmQQkTdXGp1UhMXM7kHnewBKZO+0+:Gj3uQQa1iXPnevZxR
TLSH
T1A4D24A36EC68DD7BEDE69B85AB4A7A03DEE44193D5CC5AE8DADC6D0C009719C030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4cc3db3f9890c6525e9bb7778a6f187650106d2e87ebe94b6f1588b5e6a93f4d
MD5 93e73c7d23bf6dfdf9be6d179d287fdc
SHA1 c5e53f12890a41656c75b160c4694aae4a9f0321
SHA512 8977a0a82a9003c0b883e3400782a4f0702f4a5872fcbc37fdb5b459a36cad50023dbccbba10abb636b737645e06949603ecc1db5b37a4c68199862648d5d65b
SSDEEP 768:p8Fccps35wgbkU/UmXGp1UhMXM4kHI8p00LQ:+s3jZt1iXuI8p00LQ
TLSH
T154C24B36EC68CA7BECD34B99A74B3943DEE44157868C9AE4DADC1D0C009B1AC530BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9f40d0cfb8d6fb3d981bf2ec18eef6b394680687ca545cd3a8381d1ed09f1f41
MD5 8dc689cfffa45583c3b977d943d9fcd4
SHA1 d1c851da35b29c5f2f6fd5fcc27c16d994d2b873
SHA512 35bbafdb3845ebbe97be667de454bec18b0f16a58a361f7e216ca7c1a6e4dc1585fb76658008cca0d91bc89d96b268e198c37680d8bdf70e6752b714ee43b00d
TLSH
T16741276CB6E91148B3B76E5AAFF6B86D487E7D731F06949E10010D4F0632A40C9B2737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6064-323-0x0000017CA37D0000-0x0000017CA47D0000-memory.dmp

Download