df3de7eac757e0f2943a24c18b3e39d94f75ff1836be9a1aef801b2ecdd980fd

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 50KB
Sample260809-ws75xstanc
SHA256 df3de7eac757e0f2943a24c18b3e39d94f75ff1836be9a1aef801b2ecdd980fd
MD5 6e2cb3010ca9af4e0baca087c8282422
SHA1 328a29597e217390b2f18f0791033aee984882c7
SHA512 7334dd75b44fa6eeb845ef28bc16237ad83b2dec9b49174ba04aee2ecc2dc355fac3a2bdd77d4a89e3532182419f30eaaa6457760647b09e73eee45cd7c1c8a8
SSDEEP 768:eW8Zdyp6PounuwaMjrvZcMdv+TYR7d82n2uo0sCi:enyptyuwaMjzuMdv+o722n2J
TLSH
T1DC33A436C4F42D67667E82A45276733EAC43B10BD6015A5872FCB2444B87D9B187FACC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6052	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307727589539665"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{939790C4-335E-463B-9287-D4A287DAB80F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5200	msedge.exe
5200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 836	4764	msedge.exe	85
PID 4764 wrote to memory of 6052	4764	msedge.exe	86
PID 4764 wrote to memory of 1100	4764	msedge.exe	87
PID 4764 wrote to memory of 1100	4764	msedge.exe	87
PID 4764 wrote to memory of 1100	4764	msedge.exe	87
PID 4764 wrote to memory of 1944	4764	msedge.exe	88
PID 4764 wrote to memory of 1944	4764	msedge.exe	88
PID 4764 wrote to memory of 5608	4764	msedge.exe	90
PID 4764 wrote to memory of 5608	4764	msedge.exe	90
PID 4764 wrote to memory of 5608	4764	msedge.exe	90
PID 4764 wrote to memory of 3584	4764	msedge.exe	91
PID 4764 wrote to memory of 3584	4764	msedge.exe	91
PID 4764 wrote to memory of 3584	4764	msedge.exe	91
PID 4764 wrote to memory of 5436	4764	msedge.exe	104
PID 4764 wrote to memory of 5696	4764	msedge.exe	105
PID 4764 wrote to memory of 5436	4764	msedge.exe	104
PID 4764 wrote to memory of 5696	4764	msedge.exe	105
PID 4764 wrote to memory of 5044	4764	msedge.exe	107
PID 4764 wrote to memory of 4612	4764	msedge.exe	112
PID 4764 wrote to memory of 1536	4764	msedge.exe	113
PID 4764 wrote to memory of 3108	4764	msedge.exe	114
PID 4764 wrote to memory of 2088	4764	msedge.exe	117
PID 4764 wrote to memory of 2088	4764	msedge.exe	117
PID 4764 wrote to memory of 2864	4764	msedge.exe	120
PID 4764 wrote to memory of 2864	4764	msedge.exe	120
PID 4764 wrote to memory of 5200	4764	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fffcecac188,0x7fffcecac194,0x7fffcecac1a0
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,9900086073924098739,657436389352557511,524288 --field-trial-handle=2236,i,6854774569341845957,7033326594452298426,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,5887320032032918857,9970947680371646935,262144 --field-trial-handle=2236,i,6854774569341845957,7033326594452298426,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,12650714356175904369,4413919772225791286,524288 --field-trial-handle=2236,i,6854774569341845957,7033326594452298426,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,9669696677584287278,799331287121609778,2097152 --field-trial-handle=2236,i,6854774569341845957,7033326594452298426,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,6127186139162467365,3225575845293941077,2097152 --field-trial-handle=2236,i,6854774569341845957,7033326594452298426,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,14139961718292002240,3983659410124571834,524288 --field-trial-handle=2236,i,6854774569341845957,7033326594452298426,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,9812206713494207564,8144781463596230399,524288 --field-trial-handle=2236,i,6854774569341845957,7033326594452298426,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,17441842446553780932,8085550894786219611,524288 --field-trial-handle=2236,i,6854774569341845957,7033326594452298426,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,17441842446553780932,8085550894786219611,524288 --field-trial-handle=2236,i,6854774569341845957,7033326594452298426,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,4202091800728088997,6031240623899421307,524288 --field-trial-handle=2236,i,6854774569341845957,7033326594452298426,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,3458133391724825952,12377502571307195001,524288 --field-trial-handle=2236,i,6854774569341845957,7033326594452298426,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,5499731158246720182,3367523036856777194,524288 --field-trial-handle=2236,i,6854774569341845957,7033326594452298426,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2924,i,3447364174399127505,8130826740123971444,524288 --field-trial-handle=2236,i,6854774569341845957,7033326594452298426,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,16641923895241204560,10953731730286773472,524288 --field-trial-handle=2236,i,6854774569341845957,7033326594452298426,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6264,i,3655859712675077370,18153566954856218963,262144 --field-trial-handle=2236,i,6854774569341845957,7033326594452298426,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

6a6ad8b4-221a-4ebb-905d-b469d800297f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6a6ad8b4-221a-4ebb-905d-b469d800297f.tmp
Size 414B
SHA256 7458bb14e898401968d769b0c49e44bbaf209e9b13a8f9f6c82d143376a60afc
MD5 3ba5011a3e7f40eb99645c938c46090e
SHA1 b74906d895913798aefd87f76a2f1a33eda9714d
SHA512 14f3b67e9917e70e38a047e9a57b5978b2072db4b77e9cf0b23a6b5765605d81b1f4a799ad85869d4d8ab7a2e0106d0885fc11037656b3ce233b9483fadce406
TLSH
T19EE022A6C822FC7B08FD0B18A00D879AE710131B3A80895F3A3C82088FB462B49D5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 252bbcaee0a9ee2b3c57b99a354fce3370cf56aaca410c11b76971f77deee5bc
MD5 311eeca896e9ba5b91a03b4fcb315055
SHA1 c09f40bb96d25cf8279b47ca578b796d9bf0dbad
SHA512 f755c5e57f030a75b4d6ef378db772f555d94ea0c9b28a50cb4fb64d01ab569c49c535b84ce5a5f011dc8204047fbec8e45f86d31caeea98e053d0a8621e2fa5
TLSH
T17351CEF7C3E4866EC91196F0AA14BE2BCE1D0515532C3D6A89E4EE1BA3E2470E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0f20babfc70a573dbf62f1820eba38376c762f3a4cfc2188fd9771bdc77d6871
MD5 80a4cbb8d5f7facc6000576f1584246f
SHA1 03474c77ba6e60cdca312b39287a81664c937b3b
SHA512 283383672cc0840fbf29affb8e6d505343f50a0a62ec9a669c3ff1cf28277a167fcea39be69c2389be04029844783378d1603ba2e3d929e82e7ba0b10133541f
SSDEEP 192:sxZTR3yMqZjK1Ml8UQckR/fZsPUOZdXzodpHOlHW6+WNGYvKeMUr+sNMCaIg5etJ:sxZT0qnR/fZsPUOz8KHbGVGv6Q3
TLSH
T1496208056A3499778CDBD209FA45BF53D6F91463E2904E44A9FCDA1C00E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 40d0c580359261e2f1c38c8eca71b416621c2dc322e8a3af786484ebb73ff0b8
MD5 cbdfefdd3c012d21796bbde0e4b793c2
SHA1 051c4117a3b3e5399f445cbd48db1ff7499899e4
SHA512 ef03c61f58df9824c84d0ecc1c5e63550d61569e6a361845837847788e3e1c3b8240f18ae5a8cf4ef35eb23af4b25a93c7678c870a4d73c71c72bfdb9a7ecb27
SSDEEP 192:sxZ9R3yMqZjK1Ml8MkR/fZssFuaZdozodpHOlHW6+WNGYvIC+Ur+sNMZIgjtJ:sxZ9EMR/fZssFuazbKHbGrGEj3
TLSH
T1FE62F8066A3899778CDBD219F6457F53D6F81563E2904E44AAFCCA1C00E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 70911e67cc6c05708b1c53a047a138a707ae193a5593ba6751e7d397fd7a9e71
MD5 b6f5bebb7ccd868f5bc3f113ba82d51b
SHA1 4c2359e510e78d7fd00ea64fd15f13af69ed60aa
SHA512 e1dd7313681a4fb75995e0e3c596cb702d8bd6be7c785e8d700c3dc749801a1acef22c82fc1ddba56bafd5762640fa60845b9eb8b059d233b0d7e6a563972b27
SSDEEP 192:sxZTR3yMqZjK1Ml8MkR/fZsPUOZdXzodpHOlHW6+WNGYvKewUr+sNMCaIg5etJ:sxZT0MR/fZsPUOz8KHbG9Gv6Q3
TLSH
T1BA6209056A34997B8CDBD209F645BF53D6F91063E2904E44AAFC9A1C00E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ac6521b462119496b52ef5b1c3c989986de85a80078b7bfa0f9ea112716636d3
MD5 65865e5643eb4892d2628756fbead066
SHA1 b87497bc3a4731797584ee38b238374daba670f7
SHA512 257156f0555f0b65be20d0643eeff947f8939ec1e2716fdb96dec865f3f428f460a9864e0941ad79236834a8d294372d706356817bb9a3045b345c7f6de864ac
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGw:05ppxnY753RNBvRJJdt7p5J95JnE
TLSH
T119B26A5A703A0211397E2988B39596364F4235A37058F4AF7FB814A14F6BE224CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3b5149e296af007866a48ea50362a86c4d860f2d3b836e3065e29de545621ece
MD5 e6d46c1cbe6a0253c13e9d2f23a81128
SHA1 6acb5dce232f8dce54bb501ed11b720a0018445d
SHA512 4f804409f1e1da18e23519ed66b7b503cd58399d7a1923bdb716845cedaf2d2bf604bf534e1d36a7975aae49c8561147f17775a16566542169d8eb35f4438108
SSDEEP 384:nSiFiZcIPc3sN08TUNTUlI4rQckCrPbmnphifGGJf4KqPL7WioLnTKwBODNZOC9K:ZFQ03pwgmkbpFGPqPnWioLnewBKZOmK
TLSH
T148D26B72EC68D9BBEDEB5F89AB0A3607DEE44263D5CC5AD8D6D95D0C009719C030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 941df482bd2ea47778b3c29815a292ec3a459e32a92ad4dc906a4b36542d1568
MD5 f622593200bedef897c811b6b6c8eefc
SHA1 6350aac82311aff3c9ce95700acd98525f9cde48
SHA512 d04f21f65ba6cfbbb927b6a4b0aa96ffc1415991103865080dd752425d469ffa10d4af4ee92471e23b7d0bd2d5ba1393ec29bde94fc0313711e8c8d101902c1a
SSDEEP 384:npAiF9CcmyWCs3sN08TUNTUlI4oQckCrHmnphifGGJf4KqPL7WyoL35ty/7Ig6:pbFccps3pwgNkzpFGPqPnWyoL3l
TLSH
T1AFB23C32EC98D9B7ECE74BD9A75A3603DEE45263C5CC9AD4DAD95D0C00DB1AC430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b29764fd5940fb5f0d616ac1544e694ea80b8b2ca0ebbdaefb90af40e9a0820f
MD5 733fe2d372fee5d977989dde137dd906
SHA1 a4160e7af7ce3ebedfa641810f1093646732c1d0
SHA512 39b45d23a1049ffa0d28a4c4d964dcd477c418a7f8e13cb2e8cdca2b0a3ce8542606fcc576ce5175e12cb2f01e4ed821a47d696625da0510ccd44adbe5c31a58
SSDEEP 384:nhiFiZcIi3sN08TUNTUlI4rQckCrPbmnphifGGJf4KqPL7WyoLnTKwBODNZOC9KT:IFQi3pwgmkbpFGPqPnWyoLnewBKZOmK
TLSH
T13ED26B72EC68D9BBEDEB5F89A70A3607DEE44263D5CC5AD8DAD95D0C009719C030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e0052127c6c69670d1abd560c5f7fd9dfc75eeb89a1130c5b21586b23da1478c
MD5 4a6860c0aa1c0c4de0ce61f7774a0c11
SHA1 6efb4c163cfc0c3df8172a710def1a0bf93c8498
SHA512 0760f7172e75967527e67bbebdf2ac1f9cebeb2172ddeab1883fd4d4a6634082c1c84e1bb24d9ddbd3bd8fdfe7600ef04ba8f68085aa2cb14916ac54caad9bab
SSDEEP 384:npAiFiZcIi3sN08TUNTUlI4rQckCrHmnphifGGJf4KqPL7WyoLnTKwBODNZOC9KT:pbFQi3pwgmkzpFGPqPnWyoLnewBKZOmK
TLSH
T1F7D25B72E868D9BBEDEA5F89A70A3607DEF44263D5CC5AD8D6D95D0C009719C030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c465825047130a5c2fbb39bdbc0beb381761ed4e2eef3294dcf517feb50d0ea5
MD5 e7137d7a539120d2d0037c0d01891fec
SHA1 519072d4734b09fe96d3a6f6d66f0691b42d7ec4
SHA512 93c2816802f160e9c4aa3365ef9ed0c63ce5584f859e433f5200d16ccb20ae857ff4ab980b06d78b3c4c594099fb38dc9fbae0a5463d1f9a634f6c7a9561dba8
SSDEEP 384:npkiF9CcmyWCs3sNX8TUNTUlIm2QckCr9lDKphifGGJf4Kqh7pwe4KV8p0vHdtyN:p/Fccps3WwgbkUZkFGPqhCI8p0vzC
TLSH
T1B8B25B32EC58CEFBECE74F99B74A3A07DEE01227859C9AD4DAD85D0D008719C530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 db4d3824ecac6f1d0e899bf36b7c897d37880b5c331f5ac95991989b75cee2b3
MD5 30b1ec519233bd4c3b92b87f969886a2
SHA1 464b36fe1ae2102f4298ebefca9965714cfbc00c
SHA512 c820824c9db6081a12ef168d434dc4ddd0dbacee8e286c6aad5b3f9c099c72dc93e7adb5824976c5d0d4c4e34963821542927c3885c3dfb8d9f264809f15706d
SSDEEP 768:poFccps35wgbkU6yFGPqPnWFoLI8p0vzC:2s3jVdPnWWI8p0G
TLSH
T13FC25C32EC58D9ABECE74F99B74A3507DEE45223C6CC9AE4DAD85D0D00DB1AC430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2cf5c163fa6f574923b67290ea4efa7eb2960d42d71332e07d78e465e6c37964
MD5 4d4c1726f84f07be4a1d1f9b0a35b019
SHA1 f05c5d2ecec045e8c0e416d4205dd5d430375480
SHA512 1a6c93822fcc1146a3b13aa3e99118f4c4421c5495c1ad2d1e437ead6fbc43861248863c80b589caa9d7e00b63551d0418e0783884e413a2eeaed1fa0c7da4cc
TLSH
T18841D698B6F91154B3B76F5A9BF2A86E087E7D772E07D45D00000E4F0A26B40C8B2777
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5044-242-0x000001DE00000000-0x000001DE01000000-memory.dmp

Download