133a155e897e112af92845f6927ab1ba5b49e3b3aab76a78a2f12bda8c6fd8b7

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app/views/found/access.html
Size 948B
Sample260815-wwrbkshb95
SHA256 133a155e897e112af92845f6927ab1ba5b49e3b3aab76a78a2f12bda8c6fd8b7
MD5 171d12840636bfde513049ac5612cf9c
SHA1 67889eadf9b64dbb1b0d16a2a50e93e7904e1dbd
SHA512 cc21630c670efe795da65aba102dd2a5fd58a948bd008500db28a63bf969967e29ddc17654f1dea0ee3ec8f7bdd6b52e9afa2b8c1424885dc194e420b76d4896
TLSH
T1B411D04F90CF0E2F1273867667019614F98BC8598B4B0F01B8BAA1373B9D800C49B599
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5908	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312918524200528"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{3E30AD05-47EB-4E9B-9DB3-E0E438C3D063}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 3688	1028	msedge.exe	86
PID 1028 wrote to memory of 1288	1028	msedge.exe	87
PID 1028 wrote to memory of 5908	1028	msedge.exe	88
PID 1028 wrote to memory of 1288	1028	msedge.exe	87
PID 1028 wrote to memory of 1288	1028	msedge.exe	87
PID 1028 wrote to memory of 5700	1028	msedge.exe	89
PID 1028 wrote to memory of 5700	1028	msedge.exe	89
PID 1028 wrote to memory of 2400	1028	msedge.exe	90
PID 1028 wrote to memory of 2400	1028	msedge.exe	90
PID 1028 wrote to memory of 2400	1028	msedge.exe	90
PID 1028 wrote to memory of 4908	1028	msedge.exe	91
PID 1028 wrote to memory of 4908	1028	msedge.exe	91
PID 1028 wrote to memory of 4908	1028	msedge.exe	91
PID 1028 wrote to memory of 3488	1028	msedge.exe	94
PID 1028 wrote to memory of 3948	1028	msedge.exe	95
PID 1028 wrote to memory of 3488	1028	msedge.exe	94
PID 1028 wrote to memory of 3948	1028	msedge.exe	95
PID 1028 wrote to memory of 6124	1028	msedge.exe	97
PID 1028 wrote to memory of 4364	1028	msedge.exe	107
PID 1028 wrote to memory of 5164	1028	msedge.exe	108
PID 1028 wrote to memory of 4340	1028	msedge.exe	109
PID 1028 wrote to memory of 3636	1028	msedge.exe	111
PID 1028 wrote to memory of 3636	1028	msedge.exe	111
PID 1028 wrote to memory of 4036	1028	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\app\views\found\access.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff8c95ec188,0x7ff8c95ec194,0x7ff8c95ec1a0
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,2449821514563130412,9442991805133411810,262144 --field-trial-handle=2244,i,12421128826261608733,35037768040871354,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,13998907714202572919,17083917128250258571,524288 --field-trial-handle=2244,i,12421128826261608733,35037768040871354,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,15541744464819824366,1268182636155361529,524288 --field-trial-handle=2244,i,12421128826261608733,35037768040871354,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,10399866688307349567,6949144541337440434,2097152 --field-trial-handle=2244,i,12421128826261608733,35037768040871354,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,6141813902040167816,10818465610883385822,2097152 --field-trial-handle=2244,i,12421128826261608733,35037768040871354,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,8720872391133893844,10243511977391027593,524288 --field-trial-handle=2244,i,12421128826261608733,35037768040871354,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,10650633704024911434,7232124805477796210,524288 --field-trial-handle=2244,i,12421128826261608733,35037768040871354,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,10106969851998476990,13023631246637920322,524288 --field-trial-handle=2244,i,12421128826261608733,35037768040871354,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,10106969851998476990,13023631246637920322,524288 --field-trial-handle=2244,i,12421128826261608733,35037768040871354,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,18366839860693844292,7220371523437895722,524288 --field-trial-handle=2244,i,12421128826261608733,35037768040871354,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,6214462343531373356,2595367932661725714,524288 --field-trial-handle=2244,i,12421128826261608733,35037768040871354,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,8891224193870155865,8678943874868628514,524288 --field-trial-handle=2244,i,12421128826261608733,35037768040871354,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,2812973448518238218,8569125335105325411,524288 --field-trial-handle=2244,i,12421128826261608733,35037768040871354,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3060,i,11127622890460962607,2559313350659223933,262144 --field-trial-handle=2244,i,12421128826261608733,35037768040871354,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9f1ae4be-f00a-41bd-aba4-6b5aac6f17fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9f1ae4be-f00a-41bd-aba4-6b5aac6f17fc.tmp
Size 28KB
SHA256 47cf340e579d87f949c283cc20fff55b44134e30027adec40b641ce85b3e5e57
MD5 b1fc5e9f93b63ea1c936599c54cdaf5c
SHA1 4e597c44cfe2d9a4b5ea7499052e953f65de69c1
SHA512 beceaeef0ee1964cee927bccaa42bfb00526e7cb0df102e0e26262301681768664a94e97d4832c9ca67c87da577545b8f50c354688fe3f9f994722ac2c30cb0a
SSDEEP 768:pLFQ230wgzkx0uDG045Zcd21maOi9P1tT:E234iycGOatT
TLSH
T128D24A72E8A8D9ABFDE79F89A75A3603DEF40263D6C85AC4D5D89D0C00D71AD030BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

63b559f4-fb47-4ebd-9531-632bf3aeec7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\63b559f4-fb47-4ebd-9531-632bf3aeec7d.tmp
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f4494fe851c7cbaeb2f59b4728f08f75d8b921ee96fddec59e1d64983ef0477f
MD5 fb5efae446a7e9d5e10d0cf8009d5438
SHA1 502192b50e960f60f679159e0755f7f84f0f765b
SHA512 331cd9d3f7ff0347b30868d8762fece8645b0ca2dddc4ee65bd42e35ea9778da8a26b93048e4ba97fe35efa74775c4de039a913dd6fbe7bb6d5d2984f4b39cfa
TLSH
T173E02B65CC22FC2708FD1728E00A9656E75513173640894F3F3C82088FB463A45D685C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 98f08209b0484235a34f6fbd623e3e8656f88e8e8393ca711b02eb96a02c0893
MD5 8e04fd11a92eb15bb21db5d693fe8b67
SHA1 0ad1fb4c9e94e9470efa7fb59f680bf486005cae
SHA512 f03bd02a9fc642f050302af6ab6ad825eff93844bf0ace82d73f92928eab6d5eb8dda2f6a5536bddf9840d0598401f8f7c25ded225ff0f4f460ff8a0872cc4ca
TLSH
T1FD31C2F783F4856E9A0196F0AA18BE2FCE1D0511432C7DA9C9E4AE2793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c2e6d1f5e2f24934a3c5bf2bba36e3c5ba1691b8c5afaf4398fb8538370f49e1
MD5 86263309cf8bc6db0b63aeecd3c68d54
SHA1 a995197f198b813ae0d31467ecb35bc7468f4d43
SHA512 77f63766926a898bb1d4bd0a58b0929fb9a8209d2138c6f30f300bdbcdd6b9c5c95add7253788fd693f52f97370abc379457f91f9f3075d8ada113d75d5199de
SSDEEP 192:sxZMRvyMqZjK1Ml8UQ/kq/f5sZ4FZd1zodpHtHW6+WNGYvshZA9FaIg5NKJ:sxZM8qsq/f5sZczeNHbGXh+QHG
TLSH
T1D862E715AA749977CCDBD21AF6457B53D7F90173A2904E44A9FCCA1C00EBAED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 00860e482338af80808cc054597b30d0d887dc5c052d92ae0dd8880caab93e83
MD5 e09b7ee6bde9d1d6961d9c2762ee4b22
SHA1 55517043561442af56c7b5eff9590a2267867104
SHA512 6b65218da9569d2c61e1bebbdcdb0cee1a25aff572626fe81ac4c055244b6a6fbe2a578ef22f33f59efacf27b0b6a98979f14add32e93ee7eec843b1dc12d602
SSDEEP 192:sxZMRvyMqZjK1Ml8Mkq/f5ss54uaZd1zodpHtHW6+WNGYvIuAvFaIgjKJ:sxZM8Mq/f5ss5VazeNHbG1QjG
TLSH
T14262E7166A389977CCDBD209F6457F53D3F91173A2904E44A9FCCA0C04EAAED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 10d93984d49d1b3fef2e3f0f6b1a4b80258d01242db040454ae1ec4fa7fd54c7
MD5 8ce76b04dbb405025772c6aa6d7c8636
SHA1 c236ae9fb2da4912c141da99e909800175f36e36
SHA512 63975f8464b53038eff0dea38107a110860f5653c5e3df6354428d105d7624fc8c7742c741850a9b1af9a31cc9bb7a713325c9e2ad1288f152a9872e0fe6377b
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGY:05ppxnY753RNBvRJJdt7p5J9/nxy
TLSH
T155B28D5A703A0212397E298CB39696364F4235633058E4BF7FB814A14F67E225DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 467803f4cc78326be7244e890d75133694f18f89063cd33f14703f6c273d16f5
MD5 06f98162014adf2d0942d5d7962becad
SHA1 46c0f9c83a7bea3abfd53124d2d613f4a9181363
SHA512 b41b37a1a558be2849c6c29ddabb38facde79f173423e5f2a0fc7fbb346909d02cbd52414feb50a5a400004f7c6c782666c8a1b3e6c29379d5d6ded8b2847a94
SSDEEP 384:nSiFiZcIF3sNV8TUNTUlI4UQckCrl/A04pvBfxGJWJ45Zcd2eRPmaOOPrXLpe8CS:ZFQF30wgzkj0uDG045Zcd2imaOi9P1tT
TLSH
T17BD24A72E8A8D9ABFDE79B89B75A3603DEF44163D6C85AC4D9D89D0C00D71AD030BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b411e44735a2a12cd39f2d6edcfef44d1b4ddf3f10cd7b4778c92d0d117ff823
MD5 74a8caa08549647463d5f5515604993f
SHA1 368b9628693cc6a6218cc489c6c0644706cbdc6c
SHA512 95b01ae064c60c21866735e23e5ee6a3f00e62764d68d32f27d160949fb8162797712faa95759e263b2cddd0ef7cb005aa9ff2543ad44c224e20aa343b5f5b7b
SSDEEP 768:pcFccps3GwgbkUskDG045Zcd2ZgI8p0MLC:Gs3oNyc3I8p0MLC
TLSH
T182B25B36EC98D9A7EDE74F89B74B3A07DEE0126785D859D4CADC1D0D009719D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e122a399fb5acc211d802712989385f8a01d5319fc49000c07c1e9f28cafa8f6
MD5 1c5c9a22fb2a03462c8d312be4529d2f
SHA1 b7de2095ab0b6158ae7ab605b0f63b0b42933eb8
SHA512 f12238dc9c973c1234e16254017093468f405aef007512c788db6ef1164649dbe7ef5c52f8a138307de3e501fc902d9432ea5dc9c0b41b17ebacbf951ae9214e
SSDEEP 768:pOFccps3EwgbkUzgDG045Zcd2vmaI8p0MLC:Ys3W+ycSI8p0MLC
TLSH
T1E5C25C32E898D9ABFDE74B99B64B3603DEE04267C6C89AD4D9DC5D0D009B1ED430BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5067babf246154df785a3db394cd0f451fd48f1ad8f46f89942506b5494258f7
MD5 e016dc887c48c2cd6bffa42c70059113
SHA1 55f9c5792cc13609394db4a1446e3a490cfb1ae7
SHA512 0624b1eac0396bea4d55b832a4ed1b15c328367617c2907e4d8e754dd69f8322d68ac12544f6e3f0923a403df733c1920dcdf866d5695c7c52ff7046513e7a03
SSDEEP 384:nziFiZcI23sNV8TUNTUlI4UQckCrl/A04pvBfxGJWJ45Zcd2eRSmaOOPrXLpe8CS:eFQ230wgzkj0uDG045Zcd21maOi9P1tT
TLSH
T135D24A72E8A8D9ABBDE79B89B75A3603DEF44263D6C85AC4D5D89D0C00D71AD030BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 da27e635d3726e70cd58717709714462a6e514dd87b88363df064000f42c07a3
MD5 8f38fa29f6af772b2d677d73addfe237
SHA1 fa6aedd42e988405495c0e1e2b3abdb0468fee1e
SHA512 519dfb92d35505767447fd6613b024645a05a88b4d7afb8bbfcf83a1791854afc7a336000165fafe35dac3d261663c807aef7a7ba9c7017909c468a91198e511
TLSH
T1E8410A59B6FD1118B3B76E5A9BF6A87D487EB8772E06D49E00100E4F0A63B00C871737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6124-200-0x0000023256AE0000-0x0000023257AE0000-memory.dmp

Download