2ff7d22209aeba5c9d3532d9d3c736fa6e5b673de00bc8778bd71e8c4a45eb31

Resubmissions

10/09/2026, 19:54

260910-ymyqeaee463

10/09/2026, 19:26

260910-x5mv7axvfv7

Analysis

max time kernel
148s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 31KB
Sample260910-ymyqeaee46
SHA256 2ff7d22209aeba5c9d3532d9d3c736fa6e5b673de00bc8778bd71e8c4a45eb31
MD5 5c4d87e9aa3b1fee4ff3db2ec2902f87
SHA1 c6cc400d3fe6c882490b46ed6edfe8adbb335fd1
SHA512 ba479c71e9f872ff57b7b6089827f02be768328a4d596dd5eb731a6fc5061ce80cbdf615c8c7cb48968b265fa7c47ec9eb567a818132bfc06b864c42e7dd383c
SSDEEP 768:/BBR33PMmTFl/sKLGCYDRmF96QR95hWRt7yRMJ9R6yYRpcKuC:5B5MmTFl/sKLGCaxQLWu0oR
TLSH
T1B4E2D762C2805A1F857305B8F3527FE9D6E5440D975606B0E4A2A23FE9CFCB11B633AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4468	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335437076926350"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{8AFBB9C8-B1D7-4B89-9655-32C593A1B040}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 4516	1276	msedge.exe	84
PID 1276 wrote to memory of 4468	1276	msedge.exe	85
PID 1276 wrote to memory of 2460	1276	msedge.exe	86
PID 1276 wrote to memory of 2460	1276	msedge.exe	86
PID 1276 wrote to memory of 2460	1276	msedge.exe	86
PID 1276 wrote to memory of 4980	1276	msedge.exe	88
PID 1276 wrote to memory of 4980	1276	msedge.exe	88
PID 1276 wrote to memory of 3828	1276	msedge.exe	89
PID 1276 wrote to memory of 3828	1276	msedge.exe	89
PID 1276 wrote to memory of 3828	1276	msedge.exe	89
PID 1276 wrote to memory of 5936	1276	msedge.exe	90
PID 1276 wrote to memory of 5936	1276	msedge.exe	90
PID 1276 wrote to memory of 5936	1276	msedge.exe	90
PID 1276 wrote to memory of 1132	1276	msedge.exe	93
PID 1276 wrote to memory of 3204	1276	msedge.exe	94
PID 1276 wrote to memory of 1132	1276	msedge.exe	93
PID 1276 wrote to memory of 3204	1276	msedge.exe	94
PID 1276 wrote to memory of 2120	1276	msedge.exe	96
PID 1276 wrote to memory of 3012	1276	msedge.exe	106
PID 1276 wrote to memory of 2764	1276	msedge.exe	107
PID 1276 wrote to memory of 1592	1276	msedge.exe	108
PID 1276 wrote to memory of 1716	1276	msedge.exe	113
PID 1276 wrote to memory of 1716	1276	msedge.exe	113
PID 1276 wrote to memory of 2020	1276	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffdcbf1c188,0x7ffdcbf1c194,0x7ffdcbf1c1a0
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,17111776303341520933,2533177477763568554,524288 --field-trial-handle=2204,i,14165499953019797127,13889310385621163015,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,4578675076280379558,16344762128976392050,262144 --field-trial-handle=2204,i,14165499953019797127,13889310385621163015,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,5242106727537737501,11110524029633483017,524288 --field-trial-handle=2204,i,14165499953019797127,13889310385621163015,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,14208538517765745268,8970266489735668192,2097152 --field-trial-handle=2204,i,14165499953019797127,13889310385621163015,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,3462455182794002703,8363825523770987034,2097152 --field-trial-handle=2204,i,14165499953019797127,13889310385621163015,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,2065875496357345003,13644097106090070434,524288 --field-trial-handle=2204,i,14165499953019797127,13889310385621163015,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,8933401686774529004,17154140878495571660,524288 --field-trial-handle=2204,i,14165499953019797127,13889310385621163015,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,3087567058552790020,1253300555282246849,524288 --field-trial-handle=2204,i,14165499953019797127,13889310385621163015,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,3087567058552790020,1253300555282246849,524288 --field-trial-handle=2204,i,14165499953019797127,13889310385621163015,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,16474615888478083562,16276075671797464770,524288 --field-trial-handle=2204,i,14165499953019797127,13889310385621163015,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,10387781064634718588,14134765394768873895,524288 --field-trial-handle=2204,i,14165499953019797127,13889310385621163015,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,9463230801259086528,12930558315795886029,524288 --field-trial-handle=2204,i,14165499953019797127,13889310385621163015,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,17477208867041902361,16075703990290366967,524288 --field-trial-handle=2204,i,14165499953019797127,13889310385621163015,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5900,i,13259516252911056888,2515540095335099494,262144 --field-trial-handle=2204,i,14165499953019797127,13889310385621163015,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f8e8033a2ff78783538e98b07648a510e8322babaab9367e5a56d2b3d88e750e
MD5 9cb2f01ca73603c5e97fb39b42fa57c7
SHA1 e7a329ddd5824148eb8c6b87a8e664d86db2b5a6
SHA512 197a64accb561181f216255cec2e9b61ccdf1fbbb3accaefb0d5aee536cacde35e48370b2f75e5e1c4265c040b0a13a8a73d8e9bc071a4a7d1d5a7e8dd1b8e3c
TLSH
T1ACE02BADD821FC2708FD0758A11D4746E70113272641594F3F3C824D8FF063A45C9D5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 07806475d33c58ee37f9007eb3163c99605d497981ed67578c92fccb15fdee80
MD5 4e23c39b7fa26aead9e592f03dbab7d9
SHA1 99d394ccd1a42a98efe1fa936d5001582acc5c5f
SHA512 25fccd2551e7aaed94cb2f9f304d67f6b508e9e2875be27f109e80b06285c200c0fdbc27fefdfa71f4f8aa84e9238a9c25b87a132b7df6768b0e3d3c282adb1b
TLSH
T13041A2F783F4867E8A1195F0AB146E2FCE2D0515532C3C9A85E4AE1BA3E3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1371c5aa94758f091c029528aa040ba40233cb7d25d002b43728b7c4c1d5cb83
MD5 463cd6fb8a5f5e9b85ba7c0ba135a2f9
SHA1 558f3bec196bde88c33e937a56ee08b7bc6c84a6
SHA512 851ab92d95ce218cadd73926ea9e05c7833c21bbedf5e3086fab9a2560efa2d34423d6942e894bbd6d48192165fcaf68f23a03bfeec38224b9c1d2ede3544215
SSDEEP 192:sxZyRcyMqZjK1Ml8MkX/fsss7OMh2aZdHzodpHXHW6+WNGYvIuwbvPdIgjIJ:sxZy1MX/fsss7OxazM3HbGlRjs
TLSH
T1C162E7156A3499778CDBD219FA457F93D3F91163A2945E48A9FC8A0C04E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0f0116bf5f09ecc6048aae1e13251b73ec12ea7d218abc9ec89cb6b6a85805cb
MD5 f51df22cf359195d44c53ce92487d8b7
SHA1 2a1d909efec5a006775017ab8f443e379b3e70b8
SHA512 75e8ca3725b18efc043fe723e2a78eeccf594c030862d223ea67db7ecc9bef33fefedbd98128ba678fb6e93f01b4d3b408845abb267fc70a517dd634cadb0a94
SSDEEP 192:sxZyRcyMqZjK1Ml8UQLkX/fssMOMh5ZdHzodpHXHW6+WNGYvhwTvPdIg5iIJ:sxZy1qgX/fssMOYzM3HbGhRos
TLSH
T18062E7156A34A9778CDBD219FA857B93D3F90573A1954E44A9FC8A0C04E7BEC2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d22de73210e0be617337a9439de3b0c42943e090488f648beac6fa0e07537819
MD5 a1d3015804c2325bca86d7461b0d26c8
SHA1 d2f3d1050d3d39a46dda9cc11c937a9f86c8d8c7
SHA512 6645aaebf993a355f896d930dc31ec369cafd943e1d9f9d09cb5dcd4e7640b7f63481e5e872de32f031d5238a5e7b39505df2b0238431a33a5c5a326e64bd26d
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGR:05ppxnY753RNBvRJJdt7p5J9DTtz
TLSH
T119B26B5A703E0212397E2988B39596374F4235A37058E4AF7FB814A54F27E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a6acbda9365c3d220cd52fd4cec79de9bda816b82a46aeb4b17ae70984887330
MD5 17c5ee173e131bbf29826bd4387ab882
SHA1 72b31f89b8279fb79c964f2ae46c7149b6d40606
SHA512 9d72c379deff5a0875879abaf89c13afb2a4c81a714114036866f581c6834b4a5db22ea0566199601f7bcee0677de5ca439e8033322efa0ea1151fecf5fd93bb
SSDEEP 384:ndiFiZcIF3sN78TUNTUlI4BQckCrEfIphiftGUf7qEqvBLLDhzxuvzxV+Mhdpvf7:UFQF36wgskn+oGs7qpdDhz4184pvf3L
TLSH
T1ECC24A72E854EAB7ADEB4BC5A75A7603DFF0816385CC5AC4D6DC5E1C009B1AD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ffb3498039744c6a833648715378e1f5247399db807c8cf90956e45b51dcf364
MD5 7ee8a8183a7b482c8c154adee3a618ce
SHA1 29dad02cd82cb0a143514af0ef7277170fef7a94
SHA512 03cbf3c530522229731af08822a0bc17b4cef8e06194f64b2b1c6d5eba3e28ae3346d1218761ce2f25836a31a8b8c44574f8c16caae7bacb0aaf491907fe71ac
SSDEEP 384:npEiFiZcIF3sN78TUNTUlI4BQckCrKfIphiftGUf7qEqvBLLDhzxuvzxV+MhdpvT:pfFQF36wgskd+oGs7qpdDhz4184pvf3L
TLSH
T100C23A72E854DAB7ADEB4BC5AB5A7603DFF0816385CC5AD4D6DC5E1C009B1AE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 85c2447ab79065904da6f3ddc6a9a350b47ce918054d67017bf7e769784af2a6
MD5 8530d4a47968b79c466fcb190f120fca
SHA1 a834a18ab45b4f4d55d5ae5d385c508edb06fb06
SHA512 8d1e7552f6dc17ce472d4b36c303bbc2874536d9b7b3144878ca1af893b76c1a5c837d9a0fa352fcbbec5c105a8c1bc864961120b56e256685bb9a7de22c6305
SSDEEP 384:npHiF9CcmyWCs3sN78TUNTUlIm2QckCr9lYKphiftGUf7qEqvIMp2le4KV8p0r1u:pCFccps3ywgbkUmkoGs7qpwZI8p0rs
TLSH
T1C0B26C36EC58DABBEDE64FC8B74A7A07DFE0512785DC5AD8DAD81E0C008719D130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 eea46704452e3a983401d72b0f6d3601ae6fb5e68065d3d4277c711cf0e29dbc
MD5 ac47f7a0b1d46c63b11c02c0a4bbfa3d
SHA1 79cff5ec2ddbdbde1f3e738c6ed5d66374fc9983
SHA512 168c0fa66e450f515114173102e035c99150050bd12ceca39f00ef27102d6d1d19fbfcf700fcd6d64bfba33445ea9789cdf445d04942272375c58ad315fbc9c1
SSDEEP 384:npHiF9CcmyWCs3sNv8TUNTUlIm2QckCr9kxFphiftGUf7qEqvBLLnhze4KV8p0rs:pCFccps3KwgbkUgroGs7qpdnhzI8p0rs
TLSH
T13EC25C32EC54DABBEDD64BD8A74A3606DEE0826785CC5ED4DADC1E0C10DB1ED530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3a4a68746b0b013094f046d0c9a6757bc14e484792bdea3df414bccabec1e2a4
MD5 099a44741c7030daef04a9f38e6e801c
SHA1 d6c2bcd7121fa2a8933c7b86a5361c6942aa1847
SHA512 31dc6473dc158dc5a9fb737e8b3aecb16cc9077011fd57d684c8345189e579ce598d114e3e5b1d44b5325a8e320bf94c6c0ad93cffc31ce11c1929eb7f528aa1
SSDEEP 384:ntiFiZcID3sN78TUNTUlI4BQckCrEfIphiftGUf7qEqvBLLZhzxuvzxV+Mhdpvf7:kFQD36wgskn+oGs7qpdZhz4184pvf3L
TLSH
T1E7C24A72EC54E9B7ADEB4BC5AB5A7603DFF08163858C5AC4D6DC5E1C009B1AD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5a248466e779c2179c4daaf2edc78564798ce97f40a1fd26bb3b29a1251599e7
MD5 3982881071c7a2cb563b6bd19451949c
SHA1 394869724b5c00b6f055370622b5228c18b7c228
SHA512 93e86aff1c12091123801f63176fdc7edaa9d13f364539b65eb5e428ed2549bc9e79640996f884bbb36b1274c2f38f819ac0bcb8cf6b3df5da8e69934085d372
TLSH
T1E64115A8B6E91148B3B37E5AABF7A87E447FBD332E46949D10110D0F0662A01C8A1733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2120-204-0x00000219E0CE0000-0x00000219E1CE0000-memory.dmp

Download