hxxps://swanbitcoinguideline[.]live/ [[36mDocusign - Download to Review & Sign Document[0m]

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://swanbitcoinguideline.live/ [[36mDocusign - Download to Review & Sign Document[0m]
Sample260821-e9dh7sgn4v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4384	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317607347407769"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{7A955464-54A6-419E-8A45-77DCC20BBE4D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 4604	4424	msedge.exe	84
PID 4424 wrote to memory of 5380	4424	msedge.exe	86
PID 4424 wrote to memory of 4384	4424	msedge.exe	85
PID 4424 wrote to memory of 5380	4424	msedge.exe	86
PID 4424 wrote to memory of 5380	4424	msedge.exe	86
PID 4424 wrote to memory of 6088	4424	msedge.exe	88
PID 4424 wrote to memory of 6088	4424	msedge.exe	88
PID 4424 wrote to memory of 5100	4424	msedge.exe	89
PID 4424 wrote to memory of 2236	4424	msedge.exe	90
PID 4424 wrote to memory of 5100	4424	msedge.exe	89
PID 4424 wrote to memory of 5100	4424	msedge.exe	89
PID 4424 wrote to memory of 2236	4424	msedge.exe	90
PID 4424 wrote to memory of 2236	4424	msedge.exe	90
PID 4424 wrote to memory of 3740	4424	msedge.exe	107
PID 4424 wrote to memory of 3392	4424	msedge.exe	108
PID 4424 wrote to memory of 4684	4424	msedge.exe	109
PID 4424 wrote to memory of 2852	4424	msedge.exe	114
PID 4424 wrote to memory of 2852	4424	msedge.exe	114
PID 4424 wrote to memory of 5260	4424	msedge.exe	115
PID 4424 wrote to memory of 5260	4424	msedge.exe	115
PID 4424 wrote to memory of 3464	4424	msedge.exe	118
PID 4424 wrote to memory of 6068	4424	msedge.exe	121
PID 4424 wrote to memory of 6068	4424	msedge.exe	121
PID 4424 wrote to memory of 6020	4424	msedge.exe	126
PID 4424 wrote to memory of 6020	4424	msedge.exe	126
PID 4424 wrote to memory of 2064	4424	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://swanbitcoinguideline.live/ [[36mDocusign - Download to Review & Sign Document[0m]
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff846b2c188,0x7ff846b2c194,0x7ff846b2c1a0
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,17477128598025520467,16375411075936315943,524288 --field-trial-handle=2352,i,12043936385638721779,12788129921235058028,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,9973881323374524905,15125093638339228984,262144 --field-trial-handle=2352,i,12043936385638721779,12788129921235058028,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,12428294495920784627,13662169195381525936,524288 --field-trial-handle=2352,i,12043936385638721779,12788129921235058028,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,1849768921939052314,5581279213979812950,2097152 --field-trial-handle=2352,i,12043936385638721779,12788129921235058028,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,18027651922347516238,16369999009836344363,2097152 --field-trial-handle=2352,i,12043936385638721779,12788129921235058028,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,694960843920986048,4091882098984546355,524288 --field-trial-handle=2352,i,12043936385638721779,12788129921235058028,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,731076758142796980,14036313802533827409,524288 --field-trial-handle=2352,i,12043936385638721779,12788129921235058028,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,17085735779631470745,17302420931354297065,524288 --field-trial-handle=2352,i,12043936385638721779,12788129921235058028,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,7973049328988918335,1708677315719448781,524288 --field-trial-handle=2352,i,12043936385638721779,12788129921235058028,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2828,i,1015035755289050574,8771489524022438289,524288 --field-trial-handle=2352,i,12043936385638721779,12788129921235058028,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,10666427261584146675,849303790586102348,524288 --field-trial-handle=2352,i,12043936385638721779,12788129921235058028,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,10666427261584146675,849303790586102348,524288 --field-trial-handle=2352,i,12043936385638721779,12788129921235058028,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,13729195481497958038,1578073457083642055,524288 --field-trial-handle=2352,i,12043936385638721779,12788129921235058028,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,8718137905487770727,11522331327244830293,524288 --field-trial-handle=2352,i,12043936385638721779,12788129921235058028,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5312,i,1188865522545262647,10053738554664914611,262144 --field-trial-handle=2352,i,12043936385638721779,12788129921235058028,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7c4980cac720c4066fba930c74fb1df10ffde4f044e9794c057a9aff291d622f
MD5 50eadb386ad051eff3c36a878a823845
SHA1 61760809d10e0adcf56ab7a8a76fdaecc6e3f720
SHA512 01a196ace27b6704eef4015ae75a2a5876d4d09c12b51d4249715b3353bad2cde4c989a8aba586a0d8cd992c81cbd8091eee34fce4fe5f53c703faed5ce2aad9
TLSH
T1B5E02B65CC21EC6728FD1B18E04D4646E74023173A40898F3A3C81088FB567645C585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e3e97d340428407b93dde47f73307f8cf9a391c5cf25a679afd4eec0649c5c84
MD5 cacc4537e24a89ed3e8a2b6d1d14b891
SHA1 7983de0ad1071dd1ce98446547cf73e252391f28
SHA512 29b9826b4e2a5301c6b83e2a2c584689ea20ec06c660c5ea439b316978ef6b7f7eeec84fc8563202a94b816bdaf8e035b7053091d54be8dd54fe64495957ddce
TLSH
T1F4614C35F902C878E723033295E07E18B8B081E9FFEB5EF21AA444357CC6B14435D298
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 18db04098bda9580050bf0b67c02ebc61e05e38a31354d41f3338839d4813afc
MD5 0d2ec00a752b0eaad34c5b88fcd25246
SHA1 bc154d1fede2c3ca9a552c6644e09bc8eba71fc0
SHA512 172701dcc49495ce4cdae55361214011c55a5a6bd3bcb0d38d3497c1cc6b6585fe1ea75957bb13922fe040d86af6360e7136ba9f105747efd735f356c70a51e9
TLSH
T1A051E0FB43F9856EDA1291F4F6187D1BCE9E0124931C789A85E4AE1753E34B1E200B4B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 edf5752914a630af5ab1a14e95537b92ebb13f50bc684ec6aac2460c30e40655
MD5 942ffe818658305adf7e0c8c540eea1a
SHA1 4a6b0734b0b2504c792794584e418c7837a643e2
SHA512 1cc9fa785da33334b0bbb93e55e67d686ef080794b8ca8c844b3e8391fade692f3adde6761fc7887e1310bdf5196a03371b52eb89e2a0f2db1369c3e12dde9d1
SSDEEP 192:sxZZRyyMqZjK1Ml8UQ6k4W/fTsxdZdIzodpSTHW6+WNPZv/YvYJrsCuIg5KCJ:sxZZjqJ4W/fTsxdz7wHbV/jvGIe
TLSH
T12962F8166A349977DCDBE209F645BB53D7F9116392905E44AAFC8E0C00E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7573ecb38f46be180cd36d0e7cd3cb94c30ce800e7b906a0bbc055a20a53d03b
MD5 78cfe37a145957b1177f1bd2ca657c4d
SHA1 0c75b98dab8823b0cffb48055ea6fdc845b1348a
SHA512 4267ebdc4a6c283801dded5203eb63be8828e3f8b6940b01de73e58af70d0134e4818e76306658d3cdcd57d24fb8c17cce31748f2c4682860cc1f705ddc3a0ab
SSDEEP 192:sxZZRyyMqZjK1Ml8Mk4W/fTssL6aZdazodpSTHW6+WNPZv/Yv1C+sC8IgjCJ:sxZZRM4W/fTssL6azhwHbV/qvgje
TLSH
T17462F9166A385977CDDBE209F645BF53D7F81563A2905E449AFCCA0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 826526145642ffa814ea73d88b49cb86f0b35600fbf10a8ed9e32dedcbf59162
MD5 da27cbfab2cf4dd6030b9f6f87789ad5
SHA1 a0c5d3a3a2dcf3540f8d96ae76a99d03e1efa0a4
SHA512 61558b588bb51f704202cab35e2e5e6035c3fc7b7896167a3b050c79ac08f2d72df4d0e594f4de8d97e43dfbd64caf926deeafc00b4eb3889af665c0c845f378
SSDEEP 192:sxZZRyyMqZjK1Ml8Mk4W/fTsxdZdIzodpSTHW6+WNPZv/YvpJfsCuIg5KCJ:sxZZjM4W/fTsxdz7wHbV/MvGIe
TLSH
T1EC62F8166A34997BDCDBE209F645BB53D7F9117392905E449AFC8A0C04E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 0dc1dd01c20770321c21da384a41cce8430700921811d1138daade6a5c0496a3
MD5 12bf9beb50ad55d28e86d78b433579ad
SHA1 974a3e5fca4211bd0a7577db5eb8b752f5f2a497
SHA512 00d43e693709d7cf93d8f5a2aff8b084dbc39123d223d5e7565d582e047de5ac1131491fa90d2ffdd9dc15859d2af737267364727c8a72242fc54849cece45fb
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGT:05ppxnY753RNBvRJJdt7p5J91dXAxg
TLSH
T192B28C5A703A0212397E3988B39696365F4135A37058E4BF7FB810A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 287a2b267749e22f80774eb04453d7a90f356ad6550aecbc42decfc395cfe4a9
MD5 dd98e855076f4746a044d023e8a7f6f7
SHA1 dea950a6443aa5fde5f53e24a5911f0ccffe3d5e
SHA512 1b4e253895039dedcc37dc338a33ece32e7e9fdaa126828e8df581c7e94bb6dedbb3725681dae50429744ffd6bcc51b30790f4b2e150139b1c9a74eae796c8f1
SSDEEP 384:nwiFiZcIX3sNK8TUNTUlI44QckCrjs09phiftGWE3jYMDZiv+uEty/7IgZoV:LFQX3vwg/kp0zoGWOhDZiGuZK
TLSH
T1BDC24B36DCA4D9B7ACEA9BC5A74A3607EEF041638ACC9AD4D9D85D5C009B1ED0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 315dce09c6411b4b325bed152021c6091566bdd4f17e7f2efdea62ebf2e70661
MD5 448012945c8286e948dda8ce5af5d450
SHA1 05d904e7cadc3496e0a3d1681c72f1a5dae95dad
SHA512 d1eb3c107fb057da3ecdcb6e724e504715da23d74372ce6e436e34953e92aea19d176f859af0d2e19bfde52f9c7238000d62f939f71ef6cbc33851ce6c7517d9
SSDEEP 384:npiFiZcI93sNK8TUNTUlI44QckCr3s09phiftGWE3jY9DZiv+uEty/7IgZoV:AFQ93vwg/kt0zoGWOyDZiGuZK
TLSH
T1CAC24B36DCA4D9B7ACEA9BC5A74A3607AEF0416389CC9AD4D9DC5D5C009B1ED0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 21261e1d9cddedaba676495dc7fffdf6587b93a82f3446a21f15858b11b23a44
MD5 c977b23e14d11a28bff90c81df539a39
SHA1 55b29fbdc80eda358e273ceb8382b4370c9cc734
SHA512 94a2f49465192fd64144225634d46f39c4c91d9deabb5463aa062f3c9f13c2a5179f039b7dcdcb99eec898a299fc909a25f50a42377ecaffbec149ce88e2ddd8
SSDEEP 384:np1iF9CcmyWCs3sNK8TUNTUlI4sQckCr3s09phiftGWE3jY9DZMty/7IgYt:p8Fccps3vwgBkt0zoGWOyDZAt
TLSH
T12CB24B36EC98DAB7ECE75BD8A74A3603DEE04163858C9AD4CADD5D4C00DB1AD030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ccf6f3f405bb6e1dcf7914fff70c3de7b56413753fa0f770d7810d52ae78d4df
MD5 865f793c3e7dbd39c2254edeba30684b
SHA1 de5c1fc059abe51150f99574340fc86b12242a3d
SHA512 abced2cb0667aca31e4fdffa089e34566f703e5c443a59c87107a7af0e088143650223414e1dd43ace35132ce026de419e688bfd570d69065cc7f274b2610b98
SSDEEP 384:npDiF9CcmyWCs3sN88TUNTUlIm2QckCr9lPJKphiftGWE3jy8phe4KV8p0xHDty0:puFccps35wgbkUZJkoGWOWoI8p0hvV
TLSH
T14DB26C36EC68DABBECE74F99B74A7A03DEE0527785D84AD4CAD85D4C009719C030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 fb6badc9b9c0f7a72c4466c2ea559f600faf6a92071fdd624e2f05482c825c76
MD5 f006cd104f075d561e90f7aa8c64cebb
SHA1 7f8a168922c71213aeb7a6e5fe643e67c19960d8
SHA512 c6f94fae2c33005a70d9d221b5fbc6a62244b2201fba928c262c9ca0a5a13af5813740fdd5fbddcc6514c3550425bf8fd941ba25952747dd7a2bcc7c19a77337
SSDEEP 384:npiF9CcmyWCs3sNK8TUNTUlI4sQckCr3s09phiftGWE3jY9DZMty/7IgYt:AFccps3vwgBkt0zoGWOyDZAt
TLSH
T155B24B36EC98DAB7ECE75BD8A74A3603DEE04163858C9AD4CADD5D5C00DB1AD030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 05609bef6942d604633bb4e3c3e93f09c7772628879eff1ad8fc18832a18ce94
MD5 58ccd3e5c3a4c007eb3876a631cdb9ca
SHA1 679bb4e27b2ae2c5dca3cb9e6f27369ac68084f2
SHA512 f12b152277843794ca6a92b7e2b6480b47170e9891f021d33a089a02c181b76d86556cbf460e6a7a5712fec214e821f051da08bcafe6c88fa7ad566aab5ed028
SSDEEP 384:npriF9CcmyWCs3sN28TUNTUlIm2QckCr9AZJuphiftGWE3jYFDZe4KV8p0xHDty0:pGFccps3/wgbkUEJQoGWOADZI8p0hvV
TLSH
T108C26C32E858DABBECE74BD9B74A3503DEE09167868C9AD4DADC5D5C00D71AC430BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 01f9606d29242bfc4cf8d9b145c6581f05330f1e0dbe508f07b3905411d4ebb7
MD5 756275b34c7b9bd431a0911e3af72aeb
SHA1 c60480e94173e384b1a67a2da9b576e3baa94e1e
SHA512 1e11a4901b5e3f9d6e58eab480571a4c526a8a80cfc7405c325dce1ef003cfdb502043944855bb7a6a302ec4747188d130e95b00d077c9ad4c03bc444bf6ed1f
TLSH
T138416B98BAED0148B3B76E26ABF3A96D987B78772E07C45D00110E4F0A22B40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3464-244-0x0000022C00000000-0x0000022C01000000-memory.dmp

Download