hxxps://ponies[.]cloud/c2/CobaltStrike%204[.]9%20Cracked%20uCare@Pwn3rzs[.]7z

Analysis

max time kernel
148s
max time network
136s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 11:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ponies.cloud/c2/CobaltStrike%204.9%20Cracked%[email protected]
Sample260809-nk2deaej5w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
572	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307486341236703"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{2589919B-D090-4705-B194-99782467BB70}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5444	msedge.exe
5444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 956	4496	msedge.exe	80
PID 4496 wrote to memory of 572	4496	msedge.exe	81
PID 4496 wrote to memory of 4072	4496	msedge.exe	82
PID 4496 wrote to memory of 4072	4496	msedge.exe	82
PID 4496 wrote to memory of 4072	4496	msedge.exe	82
PID 4496 wrote to memory of 4200	4496	msedge.exe	83
PID 4496 wrote to memory of 4200	4496	msedge.exe	83
PID 4496 wrote to memory of 5376	4496	msedge.exe	84
PID 4496 wrote to memory of 568	4496	msedge.exe	85
PID 4496 wrote to memory of 5376	4496	msedge.exe	84
PID 4496 wrote to memory of 5376	4496	msedge.exe	84
PID 4496 wrote to memory of 568	4496	msedge.exe	85
PID 4496 wrote to memory of 568	4496	msedge.exe	85
PID 4496 wrote to memory of 6048	4496	msedge.exe	88
PID 4496 wrote to memory of 6048	4496	msedge.exe	88
PID 4496 wrote to memory of 6048	4496	msedge.exe	88
PID 4496 wrote to memory of 5508	4496	msedge.exe	89
PID 4496 wrote to memory of 5508	4496	msedge.exe	89
PID 4496 wrote to memory of 5508	4496	msedge.exe	89
PID 4496 wrote to memory of 3004	4496	msedge.exe	90
PID 4496 wrote to memory of 1876	4496	msedge.exe	91
PID 4496 wrote to memory of 3004	4496	msedge.exe	90
PID 4496 wrote to memory of 1876	4496	msedge.exe	91
PID 4496 wrote to memory of 1540	4496	msedge.exe	93
PID 4496 wrote to memory of 1128	4496	msedge.exe	94
PID 1128 wrote to memory of 2368	1128	msedge.exe	95
PID 4496 wrote to memory of 2268	4496	msedge.exe	98
PID 4496 wrote to memory of 2268	4496	msedge.exe	98
PID 4496 wrote to memory of 2268	4496	msedge.exe	98
PID 4496 wrote to memory of 3264	4496	msedge.exe	99
PID 4496 wrote to memory of 5716	4496	msedge.exe	100
PID 4496 wrote to memory of 5592	4496	msedge.exe	101
PID 4496 wrote to memory of 2512	4496	msedge.exe	102
PID 4496 wrote to memory of 2512	4496	msedge.exe	102
PID 4496 wrote to memory of 2512	4496	msedge.exe	102
PID 4496 wrote to memory of 4804	4496	msedge.exe	103
PID 4496 wrote to memory of 4804	4496	msedge.exe	103
PID 4496 wrote to memory of 5356	4496	msedge.exe	105
PID 4496 wrote to memory of 5356	4496	msedge.exe	105
PID 4496 wrote to memory of 5356	4496	msedge.exe	105
PID 4496 wrote to memory of 5444	4496	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ponies.cloud/c2/CobaltStrike%204.9%20Cracked%[email protected]
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffcef27c188,0x7ffcef27c194,0x7ffcef27c1a0
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,216010192592305800,9015290112547896305,524288 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
  2⤵
  - System Time Discovery
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,16851737060216924075,5173277721294295198,262144 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,8303594642998945511,9369271877387793180,524288 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,2176502293761714792,10745666547182507774,2097152 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,14122113649242984613,16517498420041136929,2097152 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4916,i,9113298911342173410,7258433343611866702,2097152 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3636,i,8082436276413221300,17559983399757763008,2097152 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,6957158039895199626,11858023841532308283,524288 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,12285537122744481552,15886599755168481046,524288 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,486241991335209432,11378270986276392724,524288 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,486241991335209432,11378270986276392724,524288 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,17907830242260984316,2905812541947285827,524288 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6320,i,10944770027091444082,10980914159537494759,2097152 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,10156651757933794688,696636586592641863,524288 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,7450727426276611807,4919334765896851005,524288 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,13989438813647141312,9172271593570549554,524288 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5116,i,3437511871114634861,15453337376928852471,2097152 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,797677662224387364,14119669496039978125,524288 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5132,i,632468761223882625,16387838018809283178,2097152 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5436,i,13753024443927127103,12579439689288091528,262144 --field-trial-handle=2200,i,3661692647018073135,10856958815772560115,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7ee78b53-2768-4426-95c9-36ee482add9d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7ee78b53-2768-4426-95c9-36ee482add9d.tmp
Size 25KB
SHA256 59ce54f7b2438e8e8ab70a0520e9399b33e6dc79f0b44d596aa2462ab6d738f8
MD5 32865d90bdbb1735f0c652a8489246c0
SHA1 af56ff77bbee12a279b5b76622a74ae84b144231
SHA512 a21f3f24d10b51337d0ba8c45e5a2f83d6efe187fc172222dbf59e3714aad0c0b8bc03ca3ec2942118fd865d1bd5c3e5d1f1be44bfa60f006106050e022dad64
SSDEEP 384:nOiF9CcmyWCs38Nu8TUNTUlIxBPm3ek32nn9B8Qts4Jf+8GbeQBuGPGe4KV8p0Z3:lFccps3dwgPKekm0mBGy2jPGI8p0J
TLSH
T115B26B35EC58CABBECEA4F99FB4E6603DEE01267858889E4DAD81D0D00971DD034BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e7e7235defa023c260227e73c4d67da827d0c783001a7cf41e4b54b31f2f4753
MD5 358537448c2426156d681d090f68a2af
SHA1 94dbc529180ba571dfb4e8029f73950fbe11f57b
SHA512 48033bc5d97d5150270c3f4433934b4de53e9c2e9b254f37aff91787dc395d32c0e884289c1f37857e79104f90aac8fbb5a5bd99db5859cfaa1ffaa3a0e6f9d8
TLSH
T1F0E02BA9CC21AC3B09FD271C90505746EB0523571B42490F3F3CD1088FF173A5655C5D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a19dafceb78abced4086f1afdf82bac78be5568dded1670d80cdf0e80dbb2a20
MD5 9c158b02658f425ccf4affd31eaf81e3
SHA1 627951703b031afbe62ab23ac9c0643f8c519a68
SHA512 33c9b40f399d99c17d9204d6100d2775d146132ea315b88e5e7698ca3fc9bb8bf00387d84b968a2444dbb8a8082f9adba670611218f9d1f6fe86042b888b04b5
TLSH
T1ED31C2F783F4856ECA0196F0AA18BE2FCE1D0511432C7DAAC5E4AF1793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 839695aacd4e6905b0d50ce65bea29fe640fbf753995d813511f24967e21a5f5
MD5 47cddbf417bd8c73f779d8aabf51bb75
SHA1 5be66501ecf34d224a94eec9836238d26ebdb57a
SHA512 d90a7e0ca28ff65f4ad5ae66c79295ba4513a9a098b41723e96902969d044dded1dd00bfd7d4e817dec2b274dedcc9894dcd3c7a519d684dc4eeae6e8eaf97b4
SSDEEP 192:sxZMRfyMqZjK1Ml8UQiFk/fnsJGKTGDwezodpP1/W6+WNGY0h4qFEKIg5q+UJ:sxZM4qok/fnsJGU99/bG5fQ+Y
TLSH
T1A462E7056A749D37CCDBD219F655BB93D2F91533A1804E44AAFCCA1C05E7AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5967ed0423b0019f22bddfb57171864334a4c0c51653e9b81be9472b40687ea9
MD5 10fc74c07c9be974160d86b716f4bad9
SHA1 85a8abe1e707ff7dbe119902cf57c534c8691e3b
SHA512 a06394c624ada383987cea4a212e72f2402162fbf20ec7bfd35b94a9c4902f4df6819656fc147fffd014aa50bebcadf5a21e476d1cae314cecae41d0a01c0411
SSDEEP 192:sxZMRfyMqZjK1Ml8MFk/fnsxsKTGDwezodpP1/W6+WNGY0hfchEKIgj+UJ:sxZM4dk/fnsxsU99/bG5sj+Y
TLSH
T15262E8056A745D7BCCDBD209F655BF93D2F9153392904E449AFCCA1C05E6AEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 bb38d2843fac1676545fd1dbf46602eafc3617f0c3745aa49a1031db89ab22d5
MD5 c258ab0ffae4e902108528daa451bbb7
SHA1 94e44101cf4854bc8266cb0bf62310392e8e9398
SHA512 3ec692d2f7ea16ccdd85ca60febe9a9af8d14ee54e97dc94bcb3cae8992bb419a44865ee591a8d960ffbbb2f42a725ba3cb82349855708e5bfdcf7a2377fc549
SSDEEP 768:wQAKq8y028bWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L4Ll/f10EMEroSO:wQAKq8y028bWRmj1QWTu1jaKL4LpfiEC
TLSH
T1FFE21B3B284CCB7E4FC44E9CED276E8769D802CBA7588D5447FA494C03CA3EE511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 bd406980a01fb1a4783f0cbe06e733fb3ee1529b6f6d28d410d2850248692446
MD5 fc74bfc01cd98ebbc9aa0abb402faa1b
SHA1 961a6940890e68f71ae6cfa5f8c542d20c0da6f1
SHA512 d94049e0ab99fc0e8d37d464c9f1860be32c40ba1cca6bfebf39e7810b13267e474d36255823c98dfe82ca8ab66b2bc643e62c6e091e99932a6fe7fc41e4283b
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5L:GZLVDJjEDPV0/ZdkJe
TLSH
T18AA2590232FA02023C7E790C929697674A42F6633469AD7F7BB900B64E67E115DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b354f1b3277c05ca5bf497e3d33b9ce067a0480f08bcfd7bfb6b02aa529c9d58
MD5 bed36f4a5c0c758ce0450218d25783ef
SHA1 0017d92372572567b93c6110ce14821b949fbdbb
SHA512 39686b811b8ad96ec2442037043bc3b1a537892aacdc39663cbd5b2fd04b84310a983c72e9e6e067a325ed35bef20b0bf2ab4271fe616f76c327e608ad7648f4
SSDEEP 384:nAiF9CcmyWCs38NT8TUNTUlIxBPm3ek32nn9Ugx4Jf+8GbeQBu0OC5t9ze4KV8py:bFccps3cwgPKekmXUGy2VJzI8p0J
TLSH
T1ADC25A31E858CABBECE64F99F74A3503DDE042679A8C9AE4DACC1D4D009B1DD034BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 082fd0f0a8961612a6286847bfa061e38bc7d2ab02a45c2f9f7ca696393b784e
MD5 911190c5a17906eeeac1f20359c14623
SHA1 38620da1e1830049ba876db3a25bee9b1c10113e
SHA512 cdc03c313957fb097a05ade23deb91e68478b813a051ef2c9719c68b0ceb122ff3aaa61446afff3f87d04ea55179c2f5b43b6125d56223586938ff7e7ae8999f
SSDEEP 384:nqiFoZcIf38Nv8TUNTUlIRiPm3ek32nn9sAE4Jf+8GbeQBu0OC5tlznTKwBODNZg:hFWf3MwgAKekmjpGy2V5znewBKZO2WD
TLSH
T10BD24A31EC68D9ABADEA4FD9E74A7203DEE04163A98C5AD4DADC5E1C00971DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 22789c4850f5c21c51015564d6e54eddce14fbaf31b649710179e0fd4eb58df8
MD5 242b11ea56021e17d103d9ddc86314f8
SHA1 e252969f68dde53b2da31cf7d606e5ec8319bf6c
SHA512 07bf5abddfc016893d1cf99bd1d7240f4a0f4779a04439b7ac34efe40135b4f88fb8d54bef34d67ff47ec31fb5deaa5750106d12cacff70ca069161e7be3cbc7
SSDEEP 384:nqiF9CcmyWCq38Nv8TUNTUlIRFPm3ek32nn96AE4Jf+8GbeQBu0OC5tlz3Vgty/Y:hFccpq3Mwg/KekmBpGy2V5z3Q
TLSH
T11CB22931E864CABBADE64BD9F74A3643DEE04163998C59E4DAD81D1C01DB1DD030BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5ecc6783e6904262ff4d61a5e5b5db01d0592cfa82ced424c2b0f9fdd96fc117
MD5 b04f158d591bed2254920586acfe6076
SHA1 95b5e9e76be61daa8d2af12539892346245def2b
SHA512 19d3d7adefb04de785a1780b7b10faf451cad25191d29b8486b6d9a01d575faef7bbcd0ef7a58e708e0c3cf29849468f29bc74941abcf0b6eca8f3eebce2f47e
SSDEEP 384:njiFoZcIj38Nv8TUNTUlIRiPm3ek32nn9sAE4Jf+8GbeQBu0OC5t5znTKwBODNZg:OFWj3MwgAKekmjpGy2VdznewBKZO2WD
TLSH
T153D24A31E868D9BBADEA4FD9FB4A7207DEE04163998C5AD4DADC5D1C00971DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 803a06ecb8b188963acd623134d4e15c6770ecc23aad57c717328ce15ebfbc1f
MD5 ae516bf3e1ec653a1fe1b48cec2a8ac8
SHA1 6792beb98b4603f7ca00583bcd4cae2027d6323b
SHA512 4732664f19c3f2bab2e04d60f5f526fb35c7b89e11e3b19cf132c9d0ef065f0c03fa49d27cf81cae577e9e27e7560ff3ba8f808ee3f84b6711ec7f258319f407
SSDEEP 384:neiFoZcIf38Nv8TUNTUlIRiPm3ek32nn9sAE4Jf+8GbeQBu0OC5tlznTKwBODNZg:1FWf3MwgAKekmjpGy2V5znewBKZO2WD
TLSH
T1DED24A31EC68D9BBADEA4FD9E74A7207DEE04163A98C5AD4DADC5E1C00971DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1540-194-0x000001A0E0050000-0x000001A0E1050000-memory.dmp

Download