b079749021abca387bc8963045b748a7b4769fd65907aac5a9d9b00dad91e752

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
index.html
Size 45KB
Sample260925-pmcnhaea64
SHA256 b079749021abca387bc8963045b748a7b4769fd65907aac5a9d9b00dad91e752
MD5 8c17034b18b69c965e28a8d52d308d01
SHA1 9b0ed7bdfff2729b10d0f7d373553f947242b2da
SHA512 557beab25e9530eb1237d5ee396bedfa43b425998e63a62738c63fc2c52164425fbee360bb844a07c5b66c2fd7891892805fb9165a5d99c56cc72c7db52c5b8f
SSDEEP 768:0PWO5/xXiK8FZFUkT2rv5PkTqEA1pfub0RWQ0FlukrBrUZRBxbJXLIQmOK4ROK:yRzGIh0LTK
TLSH
T1B423D673658C20392237835354E0B76DF965C602CB33495AF6BCBBAA8FE3D525933224
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4264	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348128909600466"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{700616B3-0CAC-4234-B58A-7BAC20615131}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 4792	2580	msedge.exe	84
PID 2580 wrote to memory of 4264	2580	msedge.exe	85
PID 2580 wrote to memory of 1148	2580	msedge.exe	86
PID 2580 wrote to memory of 1148	2580	msedge.exe	86
PID 2580 wrote to memory of 1148	2580	msedge.exe	86
PID 2580 wrote to memory of 4484	2580	msedge.exe	87
PID 2580 wrote to memory of 4484	2580	msedge.exe	87
PID 2580 wrote to memory of 2320	2580	msedge.exe	88
PID 2580 wrote to memory of 2320	2580	msedge.exe	88
PID 2580 wrote to memory of 2320	2580	msedge.exe	88
PID 2580 wrote to memory of 2732	2580	msedge.exe	89
PID 2580 wrote to memory of 2732	2580	msedge.exe	89
PID 2580 wrote to memory of 2732	2580	msedge.exe	89
PID 2580 wrote to memory of 4860	2580	msedge.exe	96
PID 2580 wrote to memory of 5004	2580	msedge.exe	95
PID 2580 wrote to memory of 4860	2580	msedge.exe	96
PID 2580 wrote to memory of 5004	2580	msedge.exe	95
PID 2580 wrote to memory of 5236	2580	msedge.exe	100
PID 2580 wrote to memory of 3884	2580	msedge.exe	112
PID 2580 wrote to memory of 4188	2580	msedge.exe	113
PID 2580 wrote to memory of 1700	2580	msedge.exe	114
PID 2580 wrote to memory of 112	2580	msedge.exe	124
PID 2580 wrote to memory of 112	2580	msedge.exe	124
PID 2580 wrote to memory of 1048	2580	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa3a36c188,0x7ffa3a36c194,0x7ffa3a36c1a0
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,5997848856103138174,14387620732684020525,524288 --field-trial-handle=2296,i,14263714025517961996,11716165937378154514,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,949927523370231499,15702251975047058952,262144 --field-trial-handle=2296,i,14263714025517961996,11716165937378154514,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,9487595047994877982,7226180148591190005,524288 --field-trial-handle=2296,i,14263714025517961996,11716165937378154514,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,5018541258942133832,17797630860226205547,2097152 --field-trial-handle=2296,i,14263714025517961996,11716165937378154514,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,15653655731242221958,15615192016362873429,2097152 --field-trial-handle=2296,i,14263714025517961996,11716165937378154514,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,6744722827608371959,11905729355949793067,524288 --field-trial-handle=2296,i,14263714025517961996,11716165937378154514,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,5498402331789130421,5446137349733111879,524288 --field-trial-handle=2296,i,14263714025517961996,11716165937378154514,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,17874988700868380445,9195694576337137637,524288 --field-trial-handle=2296,i,14263714025517961996,11716165937378154514,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,17874988700868380445,9195694576337137637,524288 --field-trial-handle=2296,i,14263714025517961996,11716165937378154514,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,11648584136263569685,10402367322108341694,524288 --field-trial-handle=2296,i,14263714025517961996,11716165937378154514,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,3686849638902050175,3131163223148510165,524288 --field-trial-handle=2296,i,14263714025517961996,11716165937378154514,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,510926286752299884,15556091325645816993,524288 --field-trial-handle=2296,i,14263714025517961996,11716165937378154514,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,5943602516203639718,11024588282559868895,524288 --field-trial-handle=2296,i,14263714025517961996,11716165937378154514,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5984,i,16940288533583433333,2667356058305201839,262144 --field-trial-handle=2296,i,14263714025517961996,11716165937378154514,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

6c97ca83-8b8b-4038-82b5-3def4576f28a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c97ca83-8b8b-4038-82b5-3def4576f28a.tmp
Size 11KB
SHA256 5f4a9ceaeab2d1acec4af6cfa3d5b071877ffae81ed20f7653e8de393ded196f
MD5 91512c5aeae57040f85117d244391c0d
SHA1 f886d53c5c1a5470b3146f9147882a5225073c2f
SHA512 53a18865c0da0841c1aae6a87ab17864ec2d7f65c73ef1147281fb9bb57abbf742cd4b606c02c276ed34df54185bed7947fa02e8b5043b7bb8168f67527dbcf3
SSDEEP 192:sxZiRqkW/fKsKaQZL28UzodpH9HW6+WNGYoW2SHHIgjtJVJ:sxZiTW/fKszOJndHbGJSnjtJ/
TLSH
T19432B7196D28A93B8CCBE219FB55BF53D3F9103294910E48AAFC8B1C15E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 7173900d1203f8c39ef0b3e490091821b9ed6e8e39eea5d43d6975fabc576b2b
MD5 e22b1f81d6e4c15ff192a40a2eea9596
SHA1 86e307203fe7d97542b04f66f9bb756953498ecf
SHA512 2c185f287792912a3987152d60404e558b76bed151996107e92267e359abea006b741e1ab5d5b560339fab89790a5713d5e3cb219c342e63a22faba108833fe3
TLSH
T1CFF02DB9C921FC3B08FD1B3960940746F75013273681994B3B3E410C4FB1537859581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ad6cbacd314d06f02088b7b63635817e4fc9a4c80048e76b551a12a996bc0b84
MD5 057675a4287727b2b696a42a14170127
SHA1 eb6d21134a7fce84efc9d954fb05c1f25bcdccc1
SHA512 aa2268a3cc9ff4f5876e25cef269305d26eb87b7f09f53f7bb271d558b38b7e928381c41d48a7c4c6b41c12a6117060ba2b157ca8eb60c15b7523fe3add1da35
TLSH
T13E41BEF7C3E8866E890156F0A618BE2BDE1D0959832C3C5AC8E4AF1F93E2471D14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 52828a2ac3a474e3ff11867101d11b8b90a3b1d52ac8ef64a28511fcd0e3892f
MD5 940515b8f258c89d746de818fe6b063a
SHA1 350a93f6335693f695fe24df348b082ebc82b558
SHA512 53a6a6f76501377dff458139b43c0f31b4e1641eb89dda8559f13d17826e2c6353336341b75a4eb3713d98964cec426e8d537ffb23a11a9ee8f491e817f42e95
SSDEEP 192:sxZiRqkW/fKslQZL28UzodpH9HW6+WNGYoU2SHHIg5ftJVJ:sxZiTW/fKslOJndHbGXSnhtJ/
TLSH
T1AB32B6196D28A93B8CCBE219FB55BF53D3F9103290910E48AAFC8B2C15E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 214e855070053901d42abf4d6a575e7f4a3795a0a67d819a0dd92acae418269d
MD5 0be43a3ec222750c8d7afbc04f8448b4
SHA1 0a4b4b4346aec68559d243c2bfee46978cb8c5f0
SHA512 992acce3b71c75393963a1887af1b76c18a26be8fccc3353860ea947534c316c28b150ddea59f9e3d0316c6178926bca4fa20be07c69b9bdcc04265cc802b232
SSDEEP 192:sxZiRqkW/fKsPaQZL28UzodpH9HW6+WNGYoW2SHHIg5ftJVJ:sxZiTW/fKsiOJndHbGJSnhtJ/
TLSH
T15C32B6196D28A93B8CCBE219FB55BF53D3F9103294911E48AAFC8B2C15E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5be20f047a029a896a0b45b02cc42951d558892701b87ec62b45c732fbbfeb6d
MD5 5127a78bbd077e44f59f3134887cb625
SHA1 62896895c013f17e52ee6f17217e773432475add
SHA512 bc52213f4ffa5c8ff01ba5f4135819308b8956fc6206d384dfcf9dd8ddb4bc04fe69a48fceabae50954a6932189576f0719152ce9772f091d4db6366f9e254c1
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgA:ST/2dXOJhJlpfnpp3tNXVrN3+tfB
TLSH
T11DB2221571BB421039FE391891B69B2E064272733119E66B7FBD04B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f06ee395fa37c55c53ecb1b58e59ee47637ba5e0c1c422f18d1f30559ccc1f0b
MD5 af700b4e04c29b321e0fea0c685f5030
SHA1 df5fa727487e659883e7a322b18c0dd1afafe555
SHA512 c75245f4f2e591145ea1c3603477de6bee5b4f16f8b9dffabff5fd26008820d979c3014047844306d8985b9691bffdf293bc6a32a2e370dbda79e1044d6dca4d
SSDEEP 384:nBiFiZcIjl3sNq8TUNTUlI4PaKM+d4w2fiBCC2TmD9uW6m1tgOIwZOyMogL/7Iz+:oFQ537wgTsnBC5TmD996m1Xs8U
TLSH
T155C25A36E8A8DABBECEB4FD5B74A3603DEE44163898C9AC4D5D91D1C00A70ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 54545aa81c53c7d5fb0778ada8c66564b1802a50b861c6bb37ac6befd6f52026
MD5 4214b0a0fd33e9cd90fe2c91172f0be2
SHA1 1185f574c407efd03a805b0996f11ddc4f16626e
SHA512 b6691253b1676619e359b49300e3f87b95530857e96627a4ec1a21eb289bd51a7ffead0b2c9e90ae9eb405cd21e4da0e6229cba1a0029f43d308a3b02a025e99
SSDEEP 384:n+iFiZcID3sNq8TUNTUlI4PaKM+d4w2fiBCC2TmD9ufi1tgOIwZOyMogL/7IzFoT:VFQD37wgTsnBC5TmD9Ei1Xs8U
TLSH
T168C25A36D8A8DABBFDEB4FD5A74A3603DEE44163898C9AD4D5D91D1C00A74ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 50b4206176b56e08dacb6bdbd25a090c9c9ddea4d2254888d049aeab17914d0b
MD5 566b4fcedccdacfed50c34627542aa42
SHA1 58560d3ab798ee34426eaa5b468ec68313a4825a
SHA512 484b38c1293a72908b246c010b623c89df8cee5c1c0f223144f8b644f449f71152cc4ceae698f04f931b253bf3f5c77a0f7416a7ab909d1e122951a5208606de
SSDEEP 384:naiFiZcI63sN28TUNTUlIm2aKMiJ4w2fiBCC2TmDGFG7O6R2FeoivgL/7Iz4ou:RFQ63vwgcSnBC5TmDGFG7TRXIx
TLSH
T1C5C24A36EC98D9ABEDF78FDAA74A7A03DEE40163858C89C0D9D81D1D00975ED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 42e642b02a062db1a5ef3a52d40e7f816cf312b0273854c4fb87ac97e8bb229b
MD5 b5a84d01ac5d8e2cc743f823aabda6ae
SHA1 f09989e546f1728f37fea7248cb95ec70dc22b96
SHA512 65dc404e0f94934eb8208bae51749624d97d24fd799dfdf36cd81cb75b6f08592f802cded0c4a05695c6b0db4ffb0e081b8cb0b1cc9fee790996d2f9b6d98ab2
SSDEEP 384:npiFiZcID3sNq8TUNTUlI4PaKMgd4w2fiBCC2TmD9ufi1tgOIwZOyMogL/7IzFoT:AFQD37wgTmnBC5TmD9Ei1Xs8U
TLSH
T1FAC25A36D8A8DABBFDEB4FD5A74A3603DEE44163898C9AD4D5D91D1C00A74ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d56f6ea96ebc44677a801f23695573e29af2d3d1fcf5e4c6a5c6716d973ae7fc
MD5 dc1299973c208ead377ab5e04f07dc94
SHA1 490e5bc4b6f74425653dc3a68890636178f2b29d
SHA512 8a6efbf670a409ddd909d007a40d53483218815a9eb8afbf57aa2a1ab929d431ebe65119923bd41ee9ed3817b98c063f2aa9bc1caa8127c9304af8368527061d
TLSH
T118410B58A7EA1108B7777F599BF3A86D487EB9332F4BD05D00110E4F0A66B40D961737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5236-207-0x000001BEA3EE0000-0x000001BEA4EE0000-memory.dmp

Download