c3639e638ffb608e28583a251ffdfd3e96c2f11c78cfa2d4f8149136edc91edf

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
invoice54859.html
Size 202B
Sample260903-w44a4szthy
SHA256 c3639e638ffb608e28583a251ffdfd3e96c2f11c78cfa2d4f8149136edc91edf
MD5 1790a669e10454bd53fc2dfc8a968f13
SHA1 56b54b701a1a6f3d8bdd2c6c5c2ec9b46525f583
SHA512 aa7eb3e31b9aa782b3545820b05ce46dca2c3ef8bc80297a7bd41dec5e235e6023a137151b25f62e4c8c527a88370415ba58d5d648fe2d4873c56d08d45b8c4f
TLSH
T1B6D022FB3A008C4E02727F70B8C231147103DB4AE9416C50F290204775E2B158FC7202
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2556	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329337901208017"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{4061D0C7-DADE-49F9-9CE7-EB871EED0715}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
216	msedge.exe
216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 4900	4740	msedge.exe	86
PID 4740 wrote to memory of 2556	4740	msedge.exe	87
PID 4740 wrote to memory of 1060	4740	msedge.exe	88
PID 4740 wrote to memory of 1060	4740	msedge.exe	88
PID 4740 wrote to memory of 1060	4740	msedge.exe	88
PID 4740 wrote to memory of 1216	4740	msedge.exe	90
PID 4740 wrote to memory of 1216	4740	msedge.exe	90
PID 4740 wrote to memory of 3692	4740	msedge.exe	91
PID 4740 wrote to memory of 3692	4740	msedge.exe	91
PID 4740 wrote to memory of 3692	4740	msedge.exe	91
PID 4740 wrote to memory of 5192	4740	msedge.exe	92
PID 4740 wrote to memory of 5192	4740	msedge.exe	92
PID 4740 wrote to memory of 5192	4740	msedge.exe	92
PID 4740 wrote to memory of 6080	4740	msedge.exe	93
PID 4740 wrote to memory of 6080	4740	msedge.exe	93
PID 4740 wrote to memory of 6080	4740	msedge.exe	93
PID 4740 wrote to memory of 1888	4740	msedge.exe	95
PID 4740 wrote to memory of 1540	4740	msedge.exe	96
PID 4740 wrote to memory of 1888	4740	msedge.exe	95
PID 4740 wrote to memory of 1540	4740	msedge.exe	96
PID 4740 wrote to memory of 3088	4740	msedge.exe	97
PID 4740 wrote to memory of 3088	4740	msedge.exe	97
PID 4740 wrote to memory of 3764	4740	msedge.exe	98
PID 4740 wrote to memory of 3764	4740	msedge.exe	98
PID 4740 wrote to memory of 3764	4740	msedge.exe	98
PID 4740 wrote to memory of 5412	4740	msedge.exe	99
PID 4740 wrote to memory of 1660	4740	msedge.exe	101
PID 4740 wrote to memory of 4708	4740	msedge.exe	115
PID 4740 wrote to memory of 3104	4740	msedge.exe	116
PID 4740 wrote to memory of 4944	4740	msedge.exe	117
PID 4740 wrote to memory of 3020	4740	msedge.exe	119
PID 4740 wrote to memory of 3020	4740	msedge.exe	119
PID 4740 wrote to memory of 216	4740	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\invoice54859.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffe0437c188,0x7ffe0437c194,0x7ffe0437c1a0
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,12744509395738297941,2633759859220121131,524288 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,7502758741476808562,7124719492286714174,262144 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,10494150720417206027,12462340783145340890,524288 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,12305569492001270820,927629502065371198,2097152 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,10497957840067269994,15993533783379151107,2097152 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4992,i,11999238166839545529,7584602433022207816,2097152 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,15212452712042611425,8053356486078634539,524288 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,3086535244903440972,4034843753642033691,524288 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,4073414726904585888,7780637685918003588,524288 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5672,i,12041472249144999590,14993400337045095062,2097152 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,3132433969140185918,8142829923594895165,524288 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,15845553296330282270,2933657336826518632,524288 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,15845553296330282270,2933657336826518632,524288 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,17353980497481123891,7828018981934337381,524288 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,13875182609036957695,568771194394134088,524288 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,9421187030621013331,6771664486478750960,524288 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,7805978287949758737,1767505853922562495,524288 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5776,i,3682653649350605847,15442551993246339202,262144 --field-trial-handle=2292,i,13392886190318539360,13323419030863311329,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2ac31f0d622a9534a8e61ce3da76a54b8a133d91948aa00214867435cd4411a6
MD5 e177cb49e956f2c1532689a9659b7035
SHA1 2b881037850ceef615010517ad04e8ee82611bd7
SHA512 6d17c60355f19444e186a5075a7816115fd9ed135dcb2934f9d44ab6be12942762d16e6b8d36de5bcf019f5628bda340e325201becefe3257efdcbe36e770f15
TLSH
T121E02B65DC21EC370CFE0B18A04A4696E74013673640895F3A3C91098FB062696C9C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e9b36a979cf3b4ba26acde03c4ccd8b8b23f9fae14c563490a8eef7607d6adb2
MD5 69d772c21b3f8369728fa27db077a241
SHA1 08c77a506e93d3277d7dca61b4f35a6af8642394
SHA512 a5bd87add203b0c00bf5e925005cf0a82caae53105f6e2dc811083c5c3d87f70f144637c38cf3ceb997d5a18a96ee670ef39bc615d602c4fcc04d09f7ebc56e2
TLSH
T1D641D0F743B4856EDA0196F0AA18BE2FCF2D0511531C7CAA85E4AE17D3E3471E041B5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fd33398028ab8fb28690fc8db5c669994598d76b2e993c7e4644e2a47ae1d76d
MD5 ff2d631932f679df7a8e8ef145cac531
SHA1 44d75fca2470f9428a069dfdad7dd8021260a139
SHA512 6b7f989b95b4425d60e21115bca4e6276d3a4cc51d7e00ce3049d7d899b967ed31421d2e4f7e4526961b6d6aabc43c1d1d1ed6baa84ce38a75dcb5c58424af7d
SSDEEP 192:sxZiRXyMqZjK1Ml8UQc93/fMspUJZddzodpHPHW6+WNGYvnCtPTMIg5iGXJ:sxZioq63/fMspUJz2vHbG3U/5
TLSH
T12A62F8066A749977CCDBD209F6457B93E6F85163A2904E44A9FCCE1C00E7AEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 805ef92c06ba90a6530f07e8c7fd36f5dbf8edeba611f654433419e23b883534
MD5 a41f0a792602c7db8d280b9d3c672303
SHA1 5cdc20b0eb9107da8ecfaf31c0d6c3691486d6e2
SHA512 e57b8884a895c15c9dcb1597875b3f9706fe3aadbc6d6b1781d2833b6ab38c7adbed2c82b7597b76fef5eaa9487ddf275041a221824954fe14cf85ad9db0966e
SSDEEP 192:sxZiRXyMqZjK1Ml8M93/fMssYUtaZddzodpHPHW6+WNGYvIuC/PTMIgjXJ:sxZio13/fMssYUtaz2vHbGHUj5
TLSH
T15562E8066A34997B8CDBD209F6457F93D6F81163A2904E44A9FCCE1C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e7ed0e7ce9ce857cda6dbb4d29742d3df8d73abde6d171391f9d1272fe29cb2e
MD5 135c1d4cbb0febf600be7e134fbb26ed
SHA1 374ba5b4cd4734bea13375bfc2635afeb48ab1f5
SHA512 cb45a53ceb03900ce4e2a52b27d648a072dffe7b54a9a6eb21341dfb853df6c726372bd142202da4bde33b98236fd2be51703f59918a04de393de1861582ae60
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGF:05ppxnY753RNBvRJJdt7p5J9x9dv
TLSH
T170B27A5A703E0211397E2988B39696364F4235A37058E4BF7FB814A54F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fef6e58d033c794bd40bb25d9aed9672b0f6aca34898264d1c009c21b6705a5d
MD5 0fe4c1e811ce99b593a0ea8b9bcc6e40
SHA1 b81fdc6c1a8506ee1eaf352d1b5dc194fd78224c
SHA512 fde09c92cf6de1ff3d902013c80590d3bc10586168da4c0e0b128bd0af6aab3c4f9dc4cd7cb1f6916029e7464f9dc4d047564454b8e25474d92c52bf0552e044
SSDEEP 384:nziFiZcIJsNn8TUNTUlI4wQckCr2GgphiftGm3p9JLYA2OxuvzxV+MhdpXB0ty/U:eFQJmwgrkkmoGm3p9KpO4184pXVy
TLSH
T197C25B72E854DDBBFDEB4B85AB4A7A03DEF441638ADC9AC4D5D85E1C009719E030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 50a6ac3715a36564cc881cca15d4cfed4cde9dafc925f9a5002285b6405046cd
MD5 422bfd9e26c146322d3871f5eedd825f
SHA1 e7b69fd21ca0e2c8c26423408f000dd99fa7fece
SHA512 88605cd95684a11d8f9f7093ce228a84a7011e22ab2ad51518cfefc69b33ffd0dc8075abbe965bba3c42ef4ec89d53c6d331c3fee2cc10c97c330177af3118ee
SSDEEP 384:npZiF9CcmyWCHsNn8TUNTUlI4YQckCrrGgphiftGm3p9JLYA2OPpty/7IgH:pwFccpHmwgtkvmoGm3p9KpOPI
TLSH
T138B24B72E868CAABEDE74BC9A71A3943DEE0416386CC99D4D6DD5E1C009B1DD030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 929742a24ee054f704d47b70c07f197bcd4f6482afffc83f89697dd735202011
MD5 794802e98659d665a28c8343e58d69ef
SHA1 8d276ad6e8e8d2632c8ad676150c0c93e73795da
SHA512 f1255a2a61bbdc3a0fb8e3ba4bb84f60a6f93495a95fb1eb519e3db14ae9789c69d154d646aa9fd073cd0abc4036a0bfb17dad1844d267ae37078dea7eb7088e
SSDEEP 384:npZiFiZcIJsNn8TUNTUlI4wQckCr2GgphiftGm3p9JLYA2OxuvzxV+MhdpXB0tyM:pwFQJmwgrkkmoGm3p9KpO4184pXVy
TLSH
T1E1C25B72E854DDBBFDEB4B85AB4A7A03DEF4416389DC9AC4D5D85E1C009719E030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5fe498f7f9a1c9cf27e4dbdcdbfab0470c23c7a9cf469bca9b33cf6bf1f2873c
MD5 c80005b936f0a90b8ac12b774a087334
SHA1 77804986909539213f184e5405ff5a2e35936020
SHA512 e51cdbe52fb0a3759ce4a5c26e8b15ba9f9863c95354d49b6fd162a525c76af3f1bb901987cbaa494186260f2641a5ce1707adbf7a53cd663406c33b9f8960d4
SSDEEP 384:npliF9CcmyWCs3sNu8TUNTUlIm2QckCr9lzKphiftGm3pf/pCe4KV8p03LBty/7M:psFccps3bwgbkU9koGm3pfYI8p03Lj
TLSH
T177B25C36E858CABBFDE74F89A75E7A03DEE4116786E899D4DAD81D0C00971DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 40e773c10f0110b5f47b25440c9b595ca3d36c8f06f1e45c5386774a032f43d3
MD5 736bd8564623589a92426d10d00c939d
SHA1 2d41a0a1beecc8058f437b2943bee96a69ef72e7
SHA512 593e31797007f865220822466ffb9150b5ad6689b8d272d29b57de2ab12341277f0594e56e32dbb20dda01f4cca6793161dc582a2567658f687cad53ef9d05ac
SSDEEP 384:npciF9CcmyWCs3sNL8TUNTUlIm2QckCr9xotphiftGm3p9JLJA2Oe4KV8p03LBtj:pHFccps32wgbkUujoGm3p9DpOI8p03Lj
TLSH
T1ADC25C36E858CABBFDE74B99A74A3903DEE4416386DC9AE4D6DC1D0C00971DD430BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f99062e31a4fd8d163ad650d269e3ff27bf6c84f0c3974655d218d25f851280f
MD5 3d9bf8c14258c763d9378fdfa021c085
SHA1 01fbfa880556608c0ab8867c8ebd4e0412a4dd4e
SHA512 df2a8c14f403fd14f65212478c507ac61073960a0e50793f4d0df78fdc33d5426a7a4ec90ba57c79ee4267722e237bde589b5fb7b95924eff133a1f723ee3fd3
SSDEEP 384:n3iFiZcIIsNn8TUNTUlI4wQckCr2GgphiftGm3p9JLVA2OxuvzxV+MhdpXB0ty/U:yFQImwgrkkmoGm3p9/pO4184pXVy
TLSH
T14CC25B72E864DDBBFDEB4B85AB4A7A03DEF441638ADC9AC4D5D85E1C009719D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b8b550d480aa53329c1aef581727c04e4b1eff5a2bf4b56fc45d1450712a5452
MD5 8c25764c3c80e0dc66756f158264211c
SHA1 50aac6e591ba29f0c46cec4289b16d0a31267031
SHA512 d997e6d4100e790391e5f0e0c027a263843378899d8d56df96382f5471da99f0293f979edc279e872b7914816cc2057cb6b9e2e5d30b6522de1437c44cd61dc1
TLSH
T1CA41175DA6FA114CB3B36E56ABF6A86D487EB8772E06C49E00010D4F4A73B01C9B1733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1660-203-0x00000231C63D0000-0x00000231C73D0000-memory.dmp

Download