dbe56391d38fd5931a6d149249f1113024b8aea2af25fa8674fc5c3e99cf4c84

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample260820-pkd4jsdc85
SHA256 dbe56391d38fd5931a6d149249f1113024b8aea2af25fa8674fc5c3e99cf4c84
MD5 cb1fc49764c26340f3f059f7fba932dc
SHA1 dee6828bc5016de3a1f5fcffc7509ca040daace5
SHA512 a06e656cf0e0a49dee6ec593eb303b1660d7c64cdaf6dc8db2f3f4c1ab7d94f1f35921524a2d8e6733b7161e1a20a2ddf5e4d8d1c580461f3c01eb02628b52ab
TLSH
T1BB517272E192643BA127C5DE7070939EB0E6C402C7976A176DFD9378CACAE939B1134C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5996	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317024958873610"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{F2655744-C5A1-4A68-AA55-40A89673BEF2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1900	msedge.exe
1900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 5960	3516	msedge.exe	86
PID 3516 wrote to memory of 5996	3516	msedge.exe	88
PID 3516 wrote to memory of 2748	3516	msedge.exe	89
PID 3516 wrote to memory of 2748	3516	msedge.exe	89
PID 3516 wrote to memory of 2748	3516	msedge.exe	89
PID 3516 wrote to memory of 5280	3516	msedge.exe	90
PID 3516 wrote to memory of 5280	3516	msedge.exe	90
PID 3516 wrote to memory of 5256	3516	msedge.exe	91
PID 3516 wrote to memory of 5700	3516	msedge.exe	92
PID 3516 wrote to memory of 5256	3516	msedge.exe	91
PID 3516 wrote to memory of 5256	3516	msedge.exe	91
PID 3516 wrote to memory of 5700	3516	msedge.exe	92
PID 3516 wrote to memory of 5700	3516	msedge.exe	92
PID 3516 wrote to memory of 5024	3516	msedge.exe	94
PID 3516 wrote to memory of 5872	3516	msedge.exe	95
PID 3516 wrote to memory of 5024	3516	msedge.exe	94
PID 3516 wrote to memory of 5872	3516	msedge.exe	95
PID 3516 wrote to memory of 2804	3516	msedge.exe	97
PID 3516 wrote to memory of 3652	3516	msedge.exe	107
PID 3516 wrote to memory of 4188	3516	msedge.exe	108
PID 3516 wrote to memory of 4192	3516	msedge.exe	109
PID 3516 wrote to memory of 1100	3516	msedge.exe	117
PID 3516 wrote to memory of 1100	3516	msedge.exe	117
PID 3516 wrote to memory of 1736	3516	msedge.exe	118
PID 3516 wrote to memory of 1736	3516	msedge.exe	118
PID 3516 wrote to memory of 1900	3516	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc25c3c188,0x7ffc25c3c194,0x7ffc25c3c1a0
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,13015658069376210288,8110289654111149488,524288 --field-trial-handle=2272,i,12103668341056741111,10576240552972237895,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,11799684394962259399,3484552002409668942,262144 --field-trial-handle=2272,i,12103668341056741111,10576240552972237895,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,9511659168835489386,2492215470441265004,524288 --field-trial-handle=2272,i,12103668341056741111,10576240552972237895,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,2365015855645082009,15778600570296392623,2097152 --field-trial-handle=2272,i,12103668341056741111,10576240552972237895,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,15079065260187713550,8147745864391843170,2097152 --field-trial-handle=2272,i,12103668341056741111,10576240552972237895,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,2403415385885747521,14116650189028390760,524288 --field-trial-handle=2272,i,12103668341056741111,10576240552972237895,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,17804907401593979156,3810809809078246473,524288 --field-trial-handle=2272,i,12103668341056741111,10576240552972237895,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,12496183392142006894,426362891313347018,524288 --field-trial-handle=2272,i,12103668341056741111,10576240552972237895,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,12496183392142006894,426362891313347018,524288 --field-trial-handle=2272,i,12103668341056741111,10576240552972237895,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,8566192250625003651,11911916721563466898,524288 --field-trial-handle=2272,i,12103668341056741111,10576240552972237895,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,16229429761515410761,6262748495137207565,524288 --field-trial-handle=2272,i,12103668341056741111,10576240552972237895,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,421117020137887402,11658180050651740933,524288 --field-trial-handle=2272,i,12103668341056741111,10576240552972237895,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,961790591267241112,4321905537407678626,524288 --field-trial-handle=2272,i,12103668341056741111,10576240552972237895,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,11471913524151947297,10907125195460113379,524288 --field-trial-handle=2272,i,12103668341056741111,10576240552972237895,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5116,i,9766957961456118597,2265277040661146888,262144 --field-trial-handle=2272,i,12103668341056741111,10576240552972237895,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d89f737a71afc422d9f8f3341101cc0da568b6b48037be3c6c835f2ea68baec9
MD5 0c97a57a1ff6ffd7686215d94025d894
SHA1 416cd8cd30f606f64acd4594b8148ce4d401e661
SHA512 96dd10145528c1fc77ae731d9b487bd126351af1dc6cd2c4b03ddecbe6857fd117c33a1e5c06fbf7fdf458b9787d303f5408e1206718e30dcc0dba1ac58e6a19
TLSH
T115E02B76C822FC2708FE0768A0198646EB40135B2A81C94F3B3C820C8FF472A95C585D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9c67e3bfc115975209c602c6ff795c94d01b388f4860a9951f21718158aee150
MD5 a5a41c1474457c28fc22477115f6eb2c
SHA1 8d0feeaad6be36d1cbd52f25cd71a4b97e7dcf4d
SHA512 52262803ab0ca90bcdfc46c29a66aae180c4cb48d4a90aa16bb6cbde80d49765c894450f25e8b80097ae581a0a7bbf2919a70f2fea83650aa747947da6514c50
TLSH
T10831E2F783F4866E9A1195F0AA18BE2FDF2D0511432C7C9989E0AE2793F3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c4b3dd3469b9d2d4e2850df89c2b0677090a2b2837036648f114e396967cadb2
MD5 0616b0e20cd9cbade954688759073e91
SHA1 53b8dffd1885a0721dc5877d89b7bca158e711f6
SHA512 2220afd76db479d8eabd8fde3c25448c03d429d0be3aa4f8d0303a453028617e7775f0807a1a9302a3f1dbad328dfd3e4a240f2e845157674aff9098f021865c
SSDEEP 192:sxZbRlyMqZjK1Ml8MkN/frssnFGaZd6zodpHMeHW6+WNGYvIuE/znIgjnJ:sxZbCMN/frssnFGazBseHbGx7jJ
TLSH
T12762E8066A3499778DDBD609FA45BF53D3F91173A1905E44AAFCCA0C04E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d011a0570b5a299bf712e475b0b6c2e8edddf034cbd7736edac735e161657065
MD5 f0cc3fbe67e17362d3bc9f0ce6b6ed7a
SHA1 dfe1af86647bda02240cf6937f828963494fc620
SHA512 2e352bebd49bd676e0081daa04efdd5e7caf532ea06ab1db068fb456b86383d2244106bfaa66d7d212e28c0436f0beb6df8607bf57cc62042073437e5436b5a6
SSDEEP 192:sxZbRlyMqZjK1Ml8UQpkN/frsaFDZd6zodpHMeHW6+WNGYvgEcznIg50nJ:sxZbCqqN/frsaFDzBseHbGB7CJ
TLSH
T1B762E8166A3499778CDBD219FA45BB53D7F91173A1905E44AAFC8E0C04E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1e98a1d231b6d885c82f5cd2e8666283f88d919427f07da9e3956dc71c380463
MD5 fc5d7cf3f77f0d11a7b7ba226e80c590
SHA1 6d4fbbc65b8df29f423b52940a374bae75e37a3c
SHA512 9fab40e375a26f04c6ea0e3793b3e7a01264375cc267fdf1461da2b7ab043af0c527ee842846260b2665b145d97837620711337a6a915919a7fb186b46f43a32
SSDEEP 384:0LppY93PBZJPtN53ATy3jJlZEdQ3bvV7RMrbAxzdT:0LppY93PBZJPtN53ATy3jJlZEdQ3bvVH
TLSH
T183B2595A713E0211397E2988B39696364F4235A37058E4EF7FB814A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f06a11ae8bd69af6773f2b0021e1d886a3f0c9908329a140b4fd2e7ba2034855
MD5 e20172c72a2eda60e01f7a6189e69650
SHA1 fe601edcca18da409dd67bb526d1ac78e45f7b94
SHA512 f7870b1df58badde15048a7c9a4d98506f0f80d0e79b008bec3b1dd1bcd273adbe696fe9d5b6981c9c70c213b1e9b707d2524e480b33c1967a00475b37ab1649
SSDEEP 384:npDiFiZcII3sNa8TUNTUlI4NQckCrHimphiftGfFmmEEXIQ/4dWnjn4CkivJ/ty+:puFQI3fwggkLYoGpENdwjn4CkihAQ
TLSH
T16AC23A32D8A4D97BADEB8BD5A74A3607EFF0416385CC9AD4D9D85D1D009B19D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8de7e471b5cd37164c7a29b445fc91b8a8178da6d622954094cb191b036ec45b
MD5 010cb7d32c8f7a80b9fc3103807d96bf
SHA1 e0f978ca122d0398dfa11416f46c3cbbc1aa1b5d
SHA512 5e41cf2f6daa8f4049613689c585f60579a5d59a5f6593bd2ec2fb51a468f14fc7258b84b8cbfc12b5e56fb0f35b3a856f6a11f5d10126a800352f84caa84137
SSDEEP 384:nPiFiZcII3sNa8TUNTUlI4cQckCrQimphiftGfFmmEEXIQ/4dWnjn4CkivJ/ty/W:aFQI3fwgDkCYoGpENdwjn4CkihAQ
TLSH
T1BEC23A32D8A4D97BADEB8FD5A74A3607EFF0416385CC99D8D9D85D1D009B19D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6c42c35509169e67fd5e371986717b9aa298ef3a69678f2e2a8347919bbf4f85
MD5 3d71021cf47085018ccc1804e187ddfd
SHA1 ddbb28c29a878007edf0eee4e10d3655dce0b611
SHA512 051c1de680c1b233b4bf48e58cbdd4683e4c8488660987c6f6d91129ac85e3734bbdbaf9024b9168b0357f6d8643401d08fb7c331132aa341f1194528bed2105
SSDEEP 384:niiFiZcI93sNa8TUNTUlI4cQckCrQimphiftGfFmmEEXIQ/4dWnjnVCkivJ/ty/W:pFQ93fwgDkCYoGpENdwjnVCkihAQ
TLSH
T118C23A32D8A4DD7BADEB8BD5A74A3507EFF0416385CCA9D8D9D85D1D009B19D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 92a478ada0d7f6b32d42d4944dbd9d72ffdf2e978971685776b63050e931b5e9
MD5 7db6ee544aacc7108cc6e1a9a6be950a
SHA1 72cab20a9c7a85d029184f97656f8ac5230aba47
SHA512 f4ae837ec7656963a21a6f01a6413b9333def1befb3cebaf68dfa0a8c5af9c12d584cd70fe1c7ec68a175a1d2fe4540ec803fc145e5595067b84ec87e3ffc438
SSDEEP 384:npBiF9CcmyWCs3sNK8TUNTUlIm2QckCr9lzKphiftGfFmmEEXIQ/4dWnj2Zpde4a:poFccps3bwgbkUlkoGpENdwj2hI8p0KS
TLSH
T163B25B36E858DEABEDE74F89B74A7A07DEE0122785DC59D8DAD85D0D00931DC430BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2d8de2321ee31297c90bfd0d4c3f7923c3e0efcccce8386a2491846ff1a650a0
MD5 7d9148b65be1e14d3d6471ad43e7dffa
SHA1 467ff767184a33e01139c2308b60ba7224612ac1
SHA512 fcd31780fa43d427007b2db166d5e6c3d4c8b45bc02b38fb650a48bab0f57fc722a8fb3956c0b7f5514eac4d9b29ef8612b511e2322e8bfa3a73fada56f58763
SSDEEP 768:pGFccps3vwgbkUBJoGpENdwjnVCkI8p0KS:gs3ZJHOgI8p05
TLSH
T1C6C25B32E898DEABECD74FD9B74A3907DEE04227858C99D8DADC1D4D00971AD430BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6f2120b012ac18fd8a83119250b1f37ec374e60118a0ce4c61ec60c82f33504f
MD5 5c981b2aa22f3f18066fd4999cbc8894
SHA1 c3db1865b1d1957722662be1b2abdfe596fdba0a
SHA512 157288150e6698f6f4a2f9f4b9d8fa5309abbcec63d532d56dffecf4f6174a4d6088c635a9ba682f4f7769790f6d208e0aae066e98d02672a25ab393580349ef
TLSH
T137411A58B6EA1108F3B37E566BF6646D487BB8672E0AD59D10110E4F0A73A40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2804-202-0x000001F3D13B0000-0x000001F3D23B0000-memory.dmp

Download