hxxps://textbin[.]net/01wu65yuv7

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://textbin.net/01wu65yuv7
Sample260822-e7skcaeq7t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3904	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318469276654272"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{AF83CE39-5D1F-449F-9BD9-E5196AA7128A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 2832	4408	msedge.exe	81
PID 4408 wrote to memory of 4160	4408	msedge.exe	82
PID 4408 wrote to memory of 3904	4408	msedge.exe	84
PID 4408 wrote to memory of 4160	4408	msedge.exe	82
PID 4408 wrote to memory of 4160	4408	msedge.exe	82
PID 4408 wrote to memory of 4272	4408	msedge.exe	85
PID 4408 wrote to memory of 4272	4408	msedge.exe	85
PID 4408 wrote to memory of 4560	4408	msedge.exe	86
PID 4408 wrote to memory of 4560	4408	msedge.exe	86
PID 4408 wrote to memory of 4560	4408	msedge.exe	86
PID 4408 wrote to memory of 1572	4408	msedge.exe	87
PID 4408 wrote to memory of 1572	4408	msedge.exe	87
PID 4408 wrote to memory of 1572	4408	msedge.exe	87
PID 4408 wrote to memory of 4500	4408	msedge.exe	90
PID 4408 wrote to memory of 4568	4408	msedge.exe	89
PID 4408 wrote to memory of 4500	4408	msedge.exe	90
PID 4408 wrote to memory of 4568	4408	msedge.exe	89
PID 4408 wrote to memory of 5176	4408	msedge.exe	91
PID 4408 wrote to memory of 5868	4408	msedge.exe	93
PID 5176 wrote to memory of 3108	5176	msedge.exe	94
PID 4408 wrote to memory of 3128	4408	msedge.exe	97
PID 4408 wrote to memory of 4784	4408	msedge.exe	98
PID 4408 wrote to memory of 1480	4408	msedge.exe	99
PID 4408 wrote to memory of 1456	4408	msedge.exe	100
PID 4408 wrote to memory of 1456	4408	msedge.exe	100
PID 4408 wrote to memory of 3424	4408	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://textbin.net/01wu65yuv7
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x210,0x244,0x224,0x260,0x7fff0e8dc188,0x7fff0e8dc194,0x7fff0e8dc1a0
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,16525209161462973830,4673009890734517025,262144 --field-trial-handle=2100,i,7313942180854994905,17654874694601103976,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,12547185229526332246,9443001199527477178,524288 --field-trial-handle=2100,i,7313942180854994905,17654874694601103976,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,1656538422027827220,8260440230627771079,524288 --field-trial-handle=2100,i,7313942180854994905,17654874694601103976,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:13
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,10189710495907398429,5267251845153950934,2097152 --field-trial-handle=2100,i,7313942180854994905,17654874694601103976,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,3696825399786850820,5864389748677346655,2097152 --field-trial-handle=2100,i,7313942180854994905,17654874694601103976,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,1181281475640068019,6560314412840190642,524288 --field-trial-handle=2100,i,7313942180854994905,17654874694601103976,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,856205079886821442,2529078467309598639,524288 --field-trial-handle=2100,i,7313942180854994905,17654874694601103976,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,6659708609856239051,8347672640270989436,524288 --field-trial-handle=2100,i,7313942180854994905,17654874694601103976,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1136
    3⤵
    PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,2107455472847685931,9866472074478551809,524288 --field-trial-handle=2100,i,7313942180854994905,17654874694601103976,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,2107455472847685931,9866472074478551809,524288 --field-trial-handle=2100,i,7313942180854994905,17654874694601103976,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,15210540675377559532,6648464734311775736,524288 --field-trial-handle=2100,i,7313942180854994905,17654874694601103976,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,658947951008555135,1763648450076027807,524288 --field-trial-handle=2100,i,7313942180854994905,17654874694601103976,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,16694774442319550098,9081932554891119176,524288 --field-trial-handle=2100,i,7313942180854994905,17654874694601103976,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,13454733938504957035,8465201480161188312,524288 --field-trial-handle=2100,i,7313942180854994905,17654874694601103976,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6208,i,16819925158932198613,15408599146340003919,262144 --field-trial-handle=2100,i,7313942180854994905,17654874694601103976,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 faa0fe55c5eac5d4f2357d5261f69716a7eda4147e4d82b85603f18310501bf5
MD5 278c36700ade4946c67e26af2416093a
SHA1 18e439876d847f1d13282960f4c8ea260e05f44f
SHA512 bddf1b1846ed7a05eaca70c88e8229909914513f5dc50511478910bbd575cd41664f95f775176f8a6d881c6528425c2d24f68250760ac4d499f5c6968bcbfdea
TLSH
T11BE02BAACC61B83B08FE2B1D90555746EB0813571B43890F7E3CC108CFB563A4559C5C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 09f43aaa679f48211940894692485f03c39e5888d7b1e229d7f50ba1d68009b0
MD5 75d7e00a9d43af4dd54a21ad3ba048aa
SHA1 adeebe697d18376b35e9ffa96be9dbd48f332bc1
SHA512 88492289513bc1af3550fcf407e430e5eb750f7f17ef02c500c76fd0d12e6ac4719062f8f634341ec27e5362a8b26d184b2169a51171c35a97ec31bbdde20496
TLSH
T1267170160E428491FF3222B2E2D73E7C7C397194FE5B2E6107C178395935BA0072E61C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587961.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587961.TMP
Size 3KB
SHA256 370516437feb77f9292ad6b866caf8a0643903069faf5d55c3b664d4b623d6db
MD5 dc31e611a2931614e36dafb521612fcd
SHA1 d2cd263feee6c2f5b30d8f2b6dabda2c1c50aff0
SHA512 f779d8c37098ae10172521e648f574daced9b33c56ce9b55515e432f475cbef279d5ef9610f2bb7d114df0fa9703e9abc75847971bb22b627a8fc37e4030a609
TLSH
T1416150160E828491FF7222B2E2C73E7C7C7A7194FE5B2E6117C178395935BA00B2E61C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 526406392673feeab36828a5eccdf265edf990e5df745548f646c044ae19c9d0
MD5 89ddd79d82648d8945ab652556955d7d
SHA1 16a301fd0d43a1c65c719853f3748e9e09329909
SHA512 1023d38e8ade83a476ae5d8450a0547d191c31980ba980f0378c082a5fd64d54492a60f5cfaec40ab806e9e7901bd08d4f7f96bb1bb7e35193e880621a82aadd
TLSH
T16141ADF743B4856E9A0196F0AA186E1FCF6C0520432C7DBA89E4AE1793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5463f4d1d400fa17707420b3ea4ed2838e48df1fd1d2fc4c7d867f95ec6bbfac
MD5 e84005b93684d0dc1b14084559faa520
SHA1 ece927650d6f3599833222f81f4d1c96a8f23682
SHA512 0c8098bfdeb89ff7f6ac0edc8dab8ea1245b736cfa68734d99accf92e801e17b72655d9111a4cd56d97638134abc8c08ff58185b62b5870aae76104a8c740b38
SSDEEP 192:sxZ7RByMqZjK1Ml8MF6/f1syvIKTG/w0zodphP7/W6+WN1dL/Y0hsU1LRIgj+cnJ:sxZ7yd6/f1sygUXx/b//5Ldj+cJ
TLSH
T10062F9056A345977CCDBD219FA45BF63D2F91563E1914E44AAFCCA0C04EAADC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 082009bd2c8a4a09e23d31ae2f5402bf52e8b6645a760022551d807b70f808a5
MD5 0a2eb9c11060574f90205628aa64886a
SHA1 6c8d44538bd8ea3758e486b3e3837b97dab6127e
SHA512 9329ef048d49351c565fc9c9bebeeb9a532cfdcee0b4a506f124e0d588efaf0818ebe52d98b4a914608a7eec02015ef2b1224ff50c7e0cf8fb59d932c07591ac
SSDEEP 192:sxZ7RByMqZjK1Ml8UQ4F6/f1sxv8KTG/w0zodphP7/W6+WN1dL/Y0h1jSPLRIg5S:sxZ7yqu6/f1sxUUXx/b//5Tcdq+cJ
TLSH
T13B72F8056A345937CCDBD619F645BF93D3F91563A1914E44AAFCCA1C04EABEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 bb38d2843fac1676545fd1dbf46602eafc3617f0c3745aa49a1031db89ab22d5
MD5 c258ab0ffae4e902108528daa451bbb7
SHA1 94e44101cf4854bc8266cb0bf62310392e8e9398
SHA512 3ec692d2f7ea16ccdd85ca60febe9a9af8d14ee54e97dc94bcb3cae8992bb419a44865ee591a8d960ffbbb2f42a725ba3cb82349855708e5bfdcf7a2377fc549
SSDEEP 768:wQAKq8y028bWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L4Ll/f10EMEroSO:wQAKq8y028bWRmj1QWTu1jaKL4LpfiEC
TLSH
T1FFE21B3B284CCB7E4FC44E9CED276E8769D802CBA7588D5447FA494C03CA3EE511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 fb45fca89c2c535693b56b62e1b3154c28a99b5e0ae15c5892eec170635e01c5
MD5 18e35a01fe3beab120ba50adade12bc9
SHA1 042c3bde221af931c0ffcbb8ac0a518e8d48c00a
SHA512 d6459ced1d3726bff2bef4f0076cde309f47e9fd08e9c79662aa86fa82b40d9ecf7398d0ff63884890a67db20cbe5332160b09b6da7d400699cb9f3eba8c0dbd
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5A:GZLVDJjEDPV0/ZdakW
TLSH
T14BA2680232BA42023C7D390C92969B674A42F1633469ED3F7BB940B64E67E125DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 511150a1c12ac7a805f66f18c46db485428036339a737846f025cd128e7f409d
MD5 ddc2327ba9749ba71e11f7dd930c0ba5
SHA1 1a4d9542842f06eab7be6d47c481387393d1bc0a
SHA512 4e69f8774e8366724d47fddbe68c0b3c3b1cb8b621697a5bb3e46aa58440c829008a7feba69b85af8d10d9b2728bc06a62f6cccbe4667f668ab9c8ee3eea0f08
SSDEEP 384:n/iF4ZcIn38NL8TUNTUlIRQPm3ek32nn9o4r4Jfb8GPxwAHAVsbdivz+amty/7Ij:KFGn3UwgCKekmbhGPxw6dirlcF
TLSH
T199C24A32DC64C9ABACEB4E85F74A7A17EEF44153958C9ED4D9C85D2C009B1DE030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c9dad88e13d3dd18c90ce87b414a76b00eba3ba683564c611be50263ea667843
MD5 3564f21810afb5cf1bb8b7d58d0aefeb
SHA1 873690ed5fffafdadf620acfcc34e8db72361f08
SHA512 a8c172912bbe6f782d37c19a291af20796f5a94b6e3bd3ecf075b181bf995c50e714e13f7bc6aaf4eaeaa6dd5cfaa6634265f956d5590ac2ad3187d5023d8289
SSDEEP 384:nliF4ZcIn38NL8TUNTUlIRQPm3ek32nn9o4r4Jfb8GPxwAHAVsbdivz+amty/7Ij:sFGn3UwgCKekmbhGPxw6dirlcF
TLSH
T19CC24A32DC64C9ABACEB4E85F74A7A17EEF44153958C9ED4D9C85D2C009B5DE030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 531704536cdfec67983d8a940ea2c5e80fb5e18932fc69e4cf219a0d6798f7e5
MD5 df8507e9e0c217e6f4bbe6701e7ea660
SHA1 e58cf2a4e58d7572e637d1e11629dd92203e0368
SHA512 46e4c02c2a2e714b3e030730747b396c9f350536cd727149575d58a377f3e4aeb95054b4651f1d745cba75c72481953d96cd781459fba53ff29f9100dbb5f6dd
SSDEEP 384:n/iFiZcIl38NL8TUNTUlIR8Pm3ek32nn9C4r4Jfb8GPxwAHAVsbdivz+amty/7Ij:KFQl3UwgCKekmNhGPxw6dirlcF
TLSH
T1BFC24A32DC64C9ABACEA4E85F74A7A17EEF44153958C9AD4D9C85D2C009B5DE030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 27ac376610d1251907c85d3fad653f076f38fcca7d9a4050a369f8da91ac6aad
MD5 d1a65c60f91f357a577e426bf70341f0
SHA1 7739eef6b36061a35cabc127d9107363dcc0a36b
SHA512 82f7bd930e2e57cab5664cb4a229326e7a6fa3cca4306ade55b1f875f1cd7a2e6c312380b8f5b0a3083ac5670fc1bb6478004dda24c919c8cba90815d5535baf
SSDEEP 384:nDiF4ZcIw38NL8TUNTUlIRQPm3ek32nn9osr4Jfb8GPxwAHAVsOdivz+amty/7Ij:uFGw3UwgCKekmvhGPxwFdirlcF
TLSH
T1C8E2C4F198D78977E8AE4B87A77D6D029AFCC11375884984B7C85D1CCC9A1BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f6496a08afed8d15d89815bb691c5c2b8577ef58d92a1829fb26123fb34982ca
MD5 5d0370a06fac66bb9730f75ff2dbb7a7
SHA1 67f7622ece8d7e76d0707cc76776880c5c07f87e
SHA512 6789239d86ea7e0cb5ab9817aa002b88ec4945e635847f17bbe7c610e4709f9f718256a3e0888e98cf872062d71ed90dbe7e4509f7a06527742995dd1fdd229a
SSDEEP 384:nAiF9CcmyWCs38NP8TUNTUlIxBPm3ek32nn9BqQHs4Jfb8GPxwAHA1le4KV8p0zo:bFccps3EwgPKekmS8wGPxwplI8p0s
TLSH
T171B25A35EC58CAABECEB0F99F74E7A46DEE01223859C59D8DAD85D0D009B19D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3e648f7442acfcee6d42bdb3fc5f3b15ceb4ef369ac10352399668242375c9e4
MD5 fee1d8dc825b311c4d3cc4207eb139ae
SHA1 47cb9d1712f3c493e9ad3eb7d94cb018bb0a329e
SHA512 deec5ea16366e2433930999fbfa194d201354a80b7e242e2e10ed6b7e2a03b76ccce699fb6b522126da8a8f94fe9e0a111187fe4b280aa3aedbca5dcf08006ee
SSDEEP 384:nriF9CcmyWCs38NH8TUNTUlIxBPm3ek32nn9w5I4Jfb8GPxwAHAVsAde4KV8p0zo:GFccps3kwgPKekm2kGPxwrdI8p0s
TLSH
T134C24A32E854C9ABECDB0F99E64A7943EEE05263868C9ED4DACC5D1C009B1DD530BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5868-190-0x0000022D01410000-0x0000022D02410000-memory.dmp

Download