8e27f230c9bb8f56a81a1228368f7dcfe6501e53987c3ae1e12e8d3fc9612fd0

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 163KB
Sample260910-akmncssflc
SHA256 8e27f230c9bb8f56a81a1228368f7dcfe6501e53987c3ae1e12e8d3fc9612fd0
MD5 5606bd4e150728ea6ab3e271cb32a470
SHA1 d6328f9d1c5744ff30caa8078fa3a39ca73d1629
SHA512 9df30ae8d889574bf22f800f20b62f9fa8beb1d717c071274d1b434de590ed174d7bd4a849e6b6d08e208a1367c1dc133ac002cccf942093d38133b1f3498550
SSDEEP 1536:n8t3AjUC6E5uAKq++ImOgPM5wFEQGKYTM5MS+rOih5dzATIoTWRdYATNRdhAT6+z:n8t3AjUC6dffF35wjuuUK1Pl5
TLSH
T1B2F3117250CC7D2F1143A6FDB022E71574A62068CEC6D90267F827AF83E6D58DD3B94A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1340	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334730643544248"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{EE3E69DE-7C68-4F2D-B28C-D31B4BB42AB3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 728	3672	msedge.exe	86
PID 3672 wrote to memory of 5556	3672	msedge.exe	87
PID 3672 wrote to memory of 1340	3672	msedge.exe	88
PID 3672 wrote to memory of 5556	3672	msedge.exe	87
PID 3672 wrote to memory of 5556	3672	msedge.exe	87
PID 3672 wrote to memory of 1292	3672	msedge.exe	89
PID 3672 wrote to memory of 1292	3672	msedge.exe	89
PID 3672 wrote to memory of 2564	3672	msedge.exe	91
PID 3672 wrote to memory of 2564	3672	msedge.exe	91
PID 3672 wrote to memory of 2564	3672	msedge.exe	91
PID 3672 wrote to memory of 1856	3672	msedge.exe	90
PID 3672 wrote to memory of 1856	3672	msedge.exe	90
PID 3672 wrote to memory of 1856	3672	msedge.exe	90
PID 3672 wrote to memory of 1604	3672	msedge.exe	97
PID 3672 wrote to memory of 1240	3672	msedge.exe	98
PID 3672 wrote to memory of 1604	3672	msedge.exe	97
PID 3672 wrote to memory of 1240	3672	msedge.exe	98
PID 3672 wrote to memory of 6124	3672	msedge.exe	100
PID 3672 wrote to memory of 2488	3672	msedge.exe	120
PID 3672 wrote to memory of 4676	3672	msedge.exe	121
PID 3672 wrote to memory of 4504	3672	msedge.exe	122
PID 3672 wrote to memory of 3340	3672	msedge.exe	124
PID 3672 wrote to memory of 3340	3672	msedge.exe	124
PID 3672 wrote to memory of 2712	3672	msedge.exe	127
PID 3672 wrote to memory of 2712	3672	msedge.exe	127
PID 3672 wrote to memory of 4628	3672	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffcde21c188,0x7ffcde21c194,0x7ffcde21c1a0
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,10057810369772124875,17765526017663694536,262144 --field-trial-handle=2312,i,1500956487391667626,11420351119795641297,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,1887177800205391624,14916605494191373210,524288 --field-trial-handle=2312,i,1500956487391667626,11420351119795641297,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,513034444544587735,1092013588514499202,524288 --field-trial-handle=2312,i,1500956487391667626,11420351119795641297,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,2437710572333691303,7648357699132334926,2097152 --field-trial-handle=2312,i,1500956487391667626,11420351119795641297,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,5111636998245110367,6185165161199899638,2097152 --field-trial-handle=2312,i,1500956487391667626,11420351119795641297,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,16588070278501424095,15443362099005344180,524288 --field-trial-handle=2312,i,1500956487391667626,11420351119795641297,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,16133558791056710715,14386691211252288529,524288 --field-trial-handle=2312,i,1500956487391667626,11420351119795641297,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,10153534633612648516,12340499747718036939,524288 --field-trial-handle=2312,i,1500956487391667626,11420351119795641297,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,10153534633612648516,12340499747718036939,524288 --field-trial-handle=2312,i,1500956487391667626,11420351119795641297,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,7274144636290746533,2484020641243438931,524288 --field-trial-handle=2312,i,1500956487391667626,11420351119795641297,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,6520081494431740145,6807378027367756482,524288 --field-trial-handle=2312,i,1500956487391667626,11420351119795641297,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,15155417013368938225,16128552168146832345,524288 --field-trial-handle=2312,i,1500956487391667626,11420351119795641297,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,8667908878879162841,1259073334037442273,524288 --field-trial-handle=2312,i,1500956487391667626,11420351119795641297,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,6983119464043180553,11864177112144021189,524288 --field-trial-handle=2312,i,1500956487391667626,11420351119795641297,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6344,i,7449405690848894568,2869541471046565641,262144 --field-trial-handle=2312,i,1500956487391667626,11420351119795641297,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 13609db7c163e616857ec0c19a83b1c96323aea8af5901154e20d7f5005d2530
MD5 1f297a1fc3b3d7977989399e3e7a14c2
SHA1 2616527bb71696337089fee860cd5d74efb7ff1b
SHA512 faa48eb47ef2bc46712cf7399b9a79d1f8d4cd7c3bb37dad1b743d6b7682e086dd045a3edb642386f78239d005a8a1b06dd530fb99ae02bc36578ef92c668846
TLSH
T10BE022AADC22FC3708FE1728A40D9F56E71413172A40898F3B3DC2098FB062B4AC5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 00728793ecb719a29f137d3cd8b6ff97de9c36adb291f091d8a6705bb471d139
MD5 e54637fbd3ce766a9a65966059518d3f
SHA1 9ee4a48fe03105d03b11287ae87b367452072abc
SHA512 1801554623b7ad3c1013b42118c812398a63e15fa984c622d521f820fe3050bbbaea3df9d45996080a6771bd61be38ad2f3f3d5ea56cff7da14287108603420f
TLSH
T1D941C0F783F4866E9A0191F0EA187E2BDE1D0515432C3CA689E0AF1B93F3471E04165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f4143e743571b7cc4e802237e371a2b37dcbaa169ecfbeee1ac570733742b4dd
MD5 4e55aa9c5c71b2a733d73c5c4d3e4dc2
SHA1 2414258abc9c1ab58fdd36aafef8ea5b81f74927
SHA512 072e3fc9eab0c7a6afe63eca6c1296fdf0fa6ea867041d951241833b4c654427f65980363589244b456c8da98f5d92c8702f4b47a82f23b655a0c6fa1b5b3303
SSDEEP 192:sxZ/RWyMqZjK1Ml8UQ7kF/f9sboZd3zodpH6HW6+WNGYvRVknJIg5deJ:sxZ/XqQF/f9sbozcaHbGF1vq
TLSH
T1DD62F9156A3899778CDBD219FA45BF53D6F90173A1904E44A9FCCA1C04E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f2504b364c359c676b950b65461d0651398f59366bd8d06bf170e79d73f53ffe
MD5 db3928de831eb4fa6469dc2566cbe6ad
SHA1 14e6cf8d29973edfeda9bccfd4a7265e9b9ae204
SHA512 6cd8759c1d9637ffde038f739f23663eebdce1922c205e6d9e4883f469fc56a8e713c248ffd194c4d9828eee5f701f09675ed5f6b12b190c5eb03d9c30addd3b
SSDEEP 192:sxZ/RWyMqZjK1Ml8MkF/f9ssEbaZd3zodpH6HW6+WNGYvIuVtnJIgjeJ:sxZ/XMF/f9ssEbazcaHbGs1jq
TLSH
T1C662FA166A34997B8CDBD219FA45BF53D6F91133A2904E4499FCCA0C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 cbc6244fa91bd834531d60302077387ab767b4ee74f4ac9aa1790fe38b13de51
MD5 0e6408732dd581694a55f67c8b1a8787
SHA1 a1afc38968d38d822fc7d2e70dca2389347f97e6
SHA512 c21486d0b1d4e378b93c98a81836910fa277d6b09ebcbecc5d7a9649f48c63c9aabca0a1813a77b6ab532ecae94175c0b6c042823a574471d7ea582aae49e70a
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGW:05ppxnY753RNBvRJJdt7p5J99lHS
TLSH
T173B27A5A703A0211397E3988B39696364F4235A33058E4BF7FB814A54F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b5ec80a65ee283ff97a1f415f87d1651329a9f67f831bfc8dc57577f1304733a
MD5 203421c24765eb23ca7445d780da9a35
SHA1 3d10a6e090d7ad10ad95019585df973630a0ed10
SHA512 9d9282dbd8891c662da82ecef05300c1a1d7b333435049123fe55154299723404603a2db2d30271fadffa789a7663e5e6ec2be1bd50b222ae54b96808f86c8bf
SSDEEP 768:p8CFQ33iwgokdRdoGGr7cjGfkSJY2hgOMc:CP3314fsMa7hgOMc
TLSH
T11AC23A32EC94DABBEDE74BC9AB4A7643DEF4426385CC99D8D5C95E4C009719D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 91bf26e6fec18d8899a2dc119dca703f8e5d8b5be4c2eb08686f1f3bbc2d2ef6
MD5 2312047b3ace2c6875374c3bcad9b3ce
SHA1 06533c56e1cbdaeed8198d1e148b7eef3614c79b
SHA512 39fcc96f3c8277e042fefa7825591af2a923d72dd756bded480b92fed5c1b3a4b2c3f6933c6df02820e224e3e686b930e9fc1b3b286420cbb6f811b319e02889
SSDEEP 768:pSCFccps3ywgbkUHGmoGGr7cjGfkSyY2I8p0IL9:AGs3UlfsMagI8p0IL9
TLSH
T110C24B32E898CAB7FCD74F99A75E3543DEE45267868C99E4DACC1E4C009B1AD430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 215df07afeb4fd1fdeb05b572c1b3d70b0c48585343fca0970a521b90cd50fce
MD5 a71cc06819a4e333d702dd2b4cedb0c8
SHA1 49bd4701c7abeeeb92f737009d8b1d432c3ddb5f
SHA512 d084484a0b125dab1c31a9bdf9f568912e13dbeb3ad055ac1f77cc15e2e01c6cffd5fa5950ca87302b71fb51f7cf0d3ffa214aaa5e58773cebd06bbd1db13aed
SSDEEP 768:xBFQ/3iwgokdXdoGGr7cjGfkSZY2hgOMc:xQ/314tsMaLhgOMc
TLSH
T1D8C23A32E894DABBADE74BC5AB4A7643DEF4426389CC99D8D5C95E4C00D719D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8a9a09b5b636db8fdb59640b2abd96d7008db13334bbb00c294f6a2547e975b4
MD5 8ff4f26e18660ed0fccd8d3fe75b3213
SHA1 535c070442f45658447fc65db0d226294e764485
SHA512 8212e4c6e4a3b12190e802b20b108cff5ca02bae3a6fbbc4cfc35b87ba13b9305da2521d1cfaf92a67781b2b46701790dae2b96b0699266cacceba492612d91b
SSDEEP 768:p5Fccps36wgbkUlkoGGr7cjGffmI8p0IL9:Ls3swsMaGI8p0IL9
TLSH
T1C7B26C36EC58CAB7EDE74F89A74E7603DEE4126785DC59E8DAD81E0C00971ED030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 343b9789a68aedfd9a8da6cf39153d3d3cb25bf5593de85253f625ec5d07f52b
MD5 6bcbe3a517d0cdea3137f0b4a1948350
SHA1 4f99a616e3f6a058cfe0d7e49b21366990efb8e9
SHA512 8bea2772c9f1e0dc2e5b7b6729bd229b749601ccaa3ed9cf914c36c69cdafca1863c79f41cd0038ffb5b15c1e4db1fcddf0f99f4112c39309fb70722e659334d
SSDEEP 768:xCFQ33iwgokdXdoGGr7cjGfkSJY2hgOMc:xP3314tsMa7hgOMc
TLSH
T19EC23A32EC94DABBEDE74BC9AB4A7643DEF4426385CC59D8D5C95E4C009719D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f6a332d76b75b7bbb92d2d27a07a008d73c009348b46511083c5231c3ec87a98
MD5 8cba18272729e281044560ed05703426
SHA1 6bbafe31279bf55f37d86e3a4eeead2e8ce3bcd9
SHA512 8152d2152572f1d17dedb70d9666c649178cec0b60ca4eaf031e2a29bb88e95f892f2e172652325d3a906aaf130017c8bfec3b682a99f06a0602d84bb63404ec
TLSH
T195412958B6FA1158B3B76F569BF6A86D487EBC771E06C49E10110E4F4A27B40CCA1B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6124-199-0x00000275C8530000-0x00000275C9530000-memory.dmp

Download