hxxps://142[.]250[.]72[.]196

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://142.250.72.196
Sample260907-qc774axejf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6136	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332600959425946"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{0E503CF5-77B6-495A-B77F-8655EE680D18}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5156 wrote to memory of 2568	5156	msedge.exe	87
PID 5156 wrote to memory of 1216	5156	msedge.exe	89
PID 5156 wrote to memory of 6136	5156	msedge.exe	90
PID 5156 wrote to memory of 1216	5156	msedge.exe	89
PID 5156 wrote to memory of 1216	5156	msedge.exe	89
PID 5156 wrote to memory of 444	5156	msedge.exe	91
PID 5156 wrote to memory of 444	5156	msedge.exe	91
PID 5156 wrote to memory of 1164	5156	msedge.exe	92
PID 5156 wrote to memory of 1932	5156	msedge.exe	93
PID 5156 wrote to memory of 1164	5156	msedge.exe	92
PID 5156 wrote to memory of 1164	5156	msedge.exe	92
PID 5156 wrote to memory of 1932	5156	msedge.exe	93
PID 5156 wrote to memory of 1932	5156	msedge.exe	93
PID 5156 wrote to memory of 1412	5156	msedge.exe	96
PID 5156 wrote to memory of 2532	5156	msedge.exe	97
PID 5156 wrote to memory of 1412	5156	msedge.exe	96
PID 5156 wrote to memory of 2532	5156	msedge.exe	97
PID 5156 wrote to memory of 5236	5156	msedge.exe	101
PID 5156 wrote to memory of 5616	5156	msedge.exe	112
PID 5156 wrote to memory of 5616	5156	msedge.exe	112
PID 5156 wrote to memory of 5936	5156	msedge.exe	113
PID 5156 wrote to memory of 5936	5156	msedge.exe	113
PID 5156 wrote to memory of 5936	5156	msedge.exe	113
PID 5156 wrote to memory of 5684	5156	msedge.exe	114
PID 5156 wrote to memory of 5684	5156	msedge.exe	114
PID 5156 wrote to memory of 5684	5156	msedge.exe	114
PID 5156 wrote to memory of 5524	5156	msedge.exe	115
PID 5156 wrote to memory of 5524	5156	msedge.exe	115
PID 5156 wrote to memory of 5524	5156	msedge.exe	115
PID 5156 wrote to memory of 2324	5156	msedge.exe	118
PID 5156 wrote to memory of 4616	5156	msedge.exe	119
PID 5156 wrote to memory of 5744	5156	msedge.exe	120
PID 5156 wrote to memory of 4176	5156	msedge.exe	121
PID 5156 wrote to memory of 4176	5156	msedge.exe	121
PID 5156 wrote to memory of 5212	5156	msedge.exe	123
PID 5156 wrote to memory of 5212	5156	msedge.exe	123
PID 5156 wrote to memory of 3800	5156	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://142.250.72.196
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x23c,0x240,0x210,0x25c,0x7ff8cdfac188,0x7ff8cdfac194,0x7ff8cdfac1a0
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,715332171009950994,3994941695066728542,262144 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,1313559150610883178,3711673863643336903,524288 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,16381231619217099606,17069822768177812731,524288 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,4037433157159789587,2576363715297960772,2097152 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,10755192360796789609,11498750830654635753,2097152 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,16968128935507502343,11851469969492000131,524288 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,14699962579492146572,12026487342102075822,524288 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,16217387630599536659,9583910173729207826,524288 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,16217387630599536659,9583910173729207826,524288 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,11283638644693969255,3305744855827170946,524288 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5948,i,6774132745751328914,9802130971419171551,2097152 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6284,i,7404221516914329994,8540950955275524246,2097152 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6456,i,16608998395531538749,3126042150562402052,2097152 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,9540115734755501686,14641309125177550948,524288 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,17174224222470185437,1193793143793054731,524288 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,6583443576336619497,7867958558079379833,524288 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1000,i,11406318442885030277,14722872791112819867,524288 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,7199484506037757922,14104887188499774025,524288 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,1355108373567971873,16446483748105232000,262144 --field-trial-handle=2440,i,3227497739403317930,6163669294417528632,262144 --variations-seed-version --mojo-platform-channel-handle=568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0207f252-7932-4934-810d-806e6802a58e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0207f252-7932-4934-810d-806e6802a58e.tmp
Size 32KB
SHA256 fa463dd3970077c9a7c3b73ef5f384e00b2c7d8808e7b8e62b45c78dda25dedd
MD5 b880d2f7f038934452f7efd41db48a30
SHA1 95f7cfce560fbaa9d5eb4473ad627e29590d8ea4
SHA512 8217864140efb04949e6ae426e418f302f8d48d98b0af508c42cf27c36c2a1346db3ff5ec71757bdb1f1f7289c796e5ea512607a2345ba5ef45e59bd73f28a36
SSDEEP 384:naiFiZcI8sNy8TUNTUlI4bQckCrH0U9pvBfxGoVY7kLzj9k+TIs0tsa+VY6lrtyF:RFQ83wgWknUzDGoukLzhTr0thgvW
TLSH
T1CDE2C3F198D78977E8AE4787A77E2E029AFCC153B5885A94B7C85D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d9a00d5-6bc9-4672-bf7f-51952d721df4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0d9a00d5-6bc9-4672-bf7f-51952d721df4.tmp
Size 26KB
SHA256 cf7e82c63cc727dc4e992545975c2f589234eafdf0fbac416b2fb8a25a5e3ed0
MD5 ea89845334b20dc1e06aced161beac56
SHA1 8455761681671d924834d27487dff552d10604a5
SHA512 fbd473659c18bd80451509be0fc86ab0db9d284ae258a44262631f60812a087bfaffcf1b840674a6f73ffb307597b45ea9fb6d779a6c80a678c11b3478e67476
SSDEEP 768:pnFccp333wgPk5UzDGoukLzJPr0tI8p0XE:h33Nq+9ukXJuI8p0U
TLSH
T11AC25B36E898CDBBECD34B89B64A3607DEE0512786CC9EE4DADD5E0D10971ED430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7d6e69f95b3c26d3a9a4bcc22e1fba62fbd03c425b59aca14a4712a4db56c8bb
MD5 53c686035603ceb4deea3f0fbf90b314
SHA1 aea197a7ca9ff396ebcccb7406f80ad93110a0a2
SHA512 314f2b5636956d9997ad7b33429a12e29a09dec8bdcf62d9fb15f13ea867372c8a71a81bbaea3b4c737ffb78b859cc34efe56ff196fb18cb0b7f532531703c0a
TLSH
T1BBE022BAC866ED2718FD4728A0598B56EB1013172B908A5F3B3C81098FB0A3A46C695C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 59ce147c98301bb3e28b6e339ffae417b4fd4cca7f37062f90a78e1add542040
MD5 cea7635d73eaad2307bf2956718f6e64
SHA1 42f21671f9827ffd3f6eda98addab4ee173b5adb
SHA512 abc58aeb2d24559191ba4c415489f4137f0238c97533a555b60fabd85b37b082160d2e1b7c19ce180256c4bfef0d1daa2eb5a2ff8cf65cba512b55b487ecf8df
TLSH
T14B714E3AAF3D58F0E72C04309AEA11617DB14DEBFE13CE878154F47C2A797118389500
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590064.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590064.TMP
Size 3KB
SHA256 f35ceb13a3353ffb3ffb99e97e40450e29dd36e9445599b4db5898594b8b417f
MD5 5b6e5988518f4ccfb1870db72067f8bf
SHA1 ddf452368ece529c3e24c431f6f08a4fd8b0b059
SHA512 b5ce1b78899e6538b8ab5d4a587a3ede86a70202cce7e8b50d199b2afff5b78d3a7fc9b48273bb79aaa12d73e54eada4cf728f272f2c54bb61098ee309bcb24c
TLSH
T186615D3A6F7D48F1E75D1031AAE622613CB24DEAFD13DEC78150F4BC6A797528399600
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 21f62157101d886121493560053bb87d794b3994a21061c43842cca52c8dbb50
MD5 bd55140129c3ca78c76d5ce4c5b20723
SHA1 957e382acec1360160248445ed700acb86dfa6db
SHA512 354436a0ee7a1cabf54d756b8ac0c7dd87620d325e7cf12aac84ab09607e96d6350c6d0e8e7aaaa433376a91fc5a6e49af713d06b30b15e9e00947bc2edb8e2e
TLSH
T17681ABF7C3E4856DCA0156F4AB15AF2FCE2D0624432C3D6AC8E4AE5793E2472E20575E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 47cb5100da904fc275ce90ff888d9f47b842219c0acccf57f8a2ae5499e94aee
MD5 377e3325f5e55efbd98aee7df59dc36e
SHA1 1fddf0e906bf3615c8fbf359784f7554e14798e8
SHA512 a99adc11c32d9e2b6bcd6b70037ad97bce0526c8d38cc89bfa8113d433b829f254359c6894c41ba444625dc2e2a0c7177912556d13647b2ac0817e7ea9667095
SSDEEP 192:sxZORkVyMqZjK1Ml8UQd9u/fgsaYZdFzodpodcPHW6+WNXIYvJa7tjYIg5xaJ:sxZO/qHu/fgsaYzOLHb4btAfW
TLSH
T182720906AA789977DCDBD219F644BF53D6F95133A1904E4499FC8A1C00E7BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9f651f1c65c34a8dcf3cf9685c4d4b3bf001b368d255c9c97d39f188e88c9f4a
MD5 b23ea299b6e85d5c2960a01b66fa0803
SHA1 920285d673fb3a9b1e0a92dbe50dd8c85908d596
SHA512 21528862fd2bee0b103bbfa3a6cb48d41ed60a152907972e6a1538130198f6d0936189893259dae9182f2b2bbdf1dc776b26f61d4948a6e68fcd488857cf3f5f
SSDEEP 192:sxZORkVyMqZjK1Ml8Mku/fgssK/aZdIzodpLHW6+WNGYv0ujgtjYIgjaJ:sxZO9Mu/fgssK/az7LHbG5tAjW
TLSH
T122620A066A78997BCCDBD219F645BF53D6F91533A2904E4499FCCA1C00E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f4d61372c1cce79dc0fb2e43a0c03d4454c6c66fe1f75c0b5e57a0f1f1c1ef79
MD5 f6b59f713377796f6b6abf9746dcc254
SHA1 73c9fa744194a3d827fa186b1986cd2749fb3559
SHA512 59dbb0d79158f2593f3b4027375a7fa22792cd8b55f58e4dc649ecc2d279632152c72d5a41115f336e97b4bfb954cd37b84db16579b06eac95b12a8ff03633a8
SSDEEP 192:sxZORkVyMqZjK1Ml8M9u/fgsa/aZdBzodpIGHW6+WNGYvIuagtjYIg5xaJ:sxZO/1u/fgsa/azq3HbGgtAfW
TLSH
T1D962F9066A78997BCCDBD209F645BF53D6F91573A2904E4499FC8A1C04E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 411dbd06690a7faced6da0163e3a33fe5d56e5a5e06c7cd85b37af28951e8792
MD5 007f5a908d8b455245ab6d0eeff48b84
SHA1 f60900e0ce5fdce32588bea118c4e5ec253366e2
SHA512 82519421f99824223cb5bff0830931f0fb6dc1644fd534867fbd0cc8eb4f15edd972203f849b3b493c47a1cff0557c2a7de1bd444f360e2f2ebbfa90a923c1d6
TLSH
T186A002ED41E20C02DC018A781397219133316D5A2A73868749ABE1859C52180924602C
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 075dcfcd4ba95a62afcaa8637d64c01e5f91a741e0138de37143040368402423
MD5 735a210c2c27eb1b20bb3eb46795ae24
SHA1 224e8869453e6df875dfa2615affbe86fadb5f3d
SHA512 97c15e6c9e5b27e3bb9f9e844f3e2c7185e917de7a2e78636d709af871c9e1db04ad26f796c4f9e32058a63bc26800991b0ddf6590938ef7d267cc4167b5e576
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGy:05ppxnY753RNBvRJJdt7p5J9E5Nl
TLSH
T16FB29A5A713A0211397E2988B39696364F4235A37058E4BF7FB810A14F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 39ecc9b5b00918920c917d71fac6dd1205c23bcabf60c23d652569ab21eafad2
MD5 1aad3e1a507f06aca0ec1190f3abf2ef
SHA1 98e1bd7b17851026e87035243bb4e930a382c053
SHA512 baaf9be2ab0bbe0f8e3c83009134d98dcbd93417cd0deff3def7d1e4f1de152d82142e778da149ceb5bccfd4798a839595d92771e36e6adea6652c32d98f8ad0
SSDEEP 384:np8iFiZcInsNy8TUNTUlI4bQckCrHFU9pvBfxGoVY7kLzj9/PIs0tsa+VY6lrtyF:pnFQn3wgWk2UzDGoukLzJPr0thgvW
TLSH
T182C23A76E898C9BBECE74BC5AB4A3603DEF4815395CC9AD8D9D95E0D00971ED030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 89046a969ab64a29b7b13d3f80f52fe6a530638d5977fe9111301e032bbc86a8
MD5 6ff265161e0a016509db7cf01081827c
SHA1 3c649fd5b105b99adb98e2f413ad7d2db81177e4
SHA512 498beca01e1f17da7dfd2ed89872dbac4abc2b5ee5443330003b17b2240fef224b994c649ba84dc1b0762e7ed1c0285214502ab4a4723db169edd7f43c6a7b1f
SSDEEP 768:piFccps3HwgbkUrQDGoukLzTr0tI8p0XF:Us3BK9ukXqI8p0V
TLSH
T1AEC24B36E898CDBBECD34B89A74A3607DEE0522785CC9AE4DADC5E0D10971ED530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 59ab2fc8e48472ababfd4500b59a966e6d6b91d868c75909dfc57dd89fadeb1c
MD5 aea2c9f27e811ea5440521c579622163
SHA1 81b73a9550b7ab4581267243f799dc69a1052485
SHA512 93f2f6744b29cb1d865aeb72c24c43a5aebe291bf7f4f10e225174c946bc65844ee22a0f835fae83c0363fc2318a740ed88d01e7cf6acb7bf48bd1cd4808fde1
SSDEEP 384:np3iF9CcmyWCs3sNq8TUNTUlIm2QckCr9lEKpvBfxGoVY7kLzBI4pme4KV8p03HF:pyFccps3nwgbkUSkDGoukLzBeI8p0XF
TLSH
T13DB24B36EC58CDBBECE74F89B74A6A07DEE0122785D89AE4DAD81D0D109719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0b06a1aa3a98ea705b878ffbf69aef04582048eaa59762ac40a44534533a3b2e
MD5 b114e8e90a0253b1cfa0ad0cc1382619
SHA1 26c6bedc202eb2d2b4ab766c18663e38d0b475c6
SHA512 044587e307d1681b2840c8d8b9c953df0d362abdf247b2c16d6f4d9d4304034dd0fcd9013f74a4ea04dedd83a29a1a0f186de660225beebfd44cec8288df955b
SSDEEP 384:nriFiZcInsNy8TUNTUlI4bQckCrHFU9pvBfxGoVY7kLzj9/PIs0tsa+VY6lrty/d:GFQn3wgWk2UzDGoukLzJPr0thgvW
TLSH
T140C23A76E898C9BBECE74BC5AB4A3607DEF4815395CC9AD8D9D85E0D00971ED030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f5972a4eda0e7bce1dd2f4f43aa6133ea1ed6f1e85e291a4dcca4f1ada1969b9
MD5 f52dd954bbcbcb95430839a9ef8426e6
SHA1 2a3bcb68869b0e163cbe794c3b0c99c637265350
SHA512 a26d1e9e23e8c1401fc572a2008097e7986ac76e30918fb8e7a56ce8d65344c03c485436058f0d19ce024912e57c8e17479d0a6474e7f077eab991998eb8f1f1
TLSH
T1E5412B5C76F91145B3B77F5AABF6A86D487EB9772E0BD05D10110E4E0663A40C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5236-190-0x00000214CCEE0000-0x00000214CDEE0000-memory.dmp

Download