bf17832d1c570b9808adf01a88141d995c26f8600ee0706dd8ede1b991c92e79

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
room.html
Size 16KB
Sample260925-w6vfzstema
SHA256 bf17832d1c570b9808adf01a88141d995c26f8600ee0706dd8ede1b991c92e79
MD5 857712539866d8be4371d49b2a1e8b80
SHA1 98bc324e7495d3dd303615336abc7f024de80a2f
SHA512 370285c4a3b2b21e281899d240897d76c28a9a4c96c4f5b170276107b8b38eb6123c0f470a3d588ae0fd2dbf5ee68466794baa871df29adb67a32446f7c7e0e4
SSDEEP 192:OBeaMdWHP5h69m937Tm5Lr/uLDgw0RKCfJG0/flLbQk42Nh9wxfmaJkJQ16Tw6r7:OBeniO0gnDkkPKcw/yvPzyd934
TLSH
T14572A923F8A8053A303BC5C97484EB4F74B0D107D1574758F9AF32A58FCADE79A9650A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5980	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{8E88FEB6-C0C4-4C7A-BFF6-0E9B215106AC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 4752	5532	msedge.exe	84
PID 5532 wrote to memory of 4304	5532	msedge.exe	85
PID 5532 wrote to memory of 5980	5532	msedge.exe	86
PID 5532 wrote to memory of 4304	5532	msedge.exe	85
PID 5532 wrote to memory of 4304	5532	msedge.exe	85
PID 5532 wrote to memory of 4664	5532	msedge.exe	87
PID 5532 wrote to memory of 4664	5532	msedge.exe	87
PID 5532 wrote to memory of 5804	5532	msedge.exe	89
PID 5532 wrote to memory of 5804	5532	msedge.exe	89
PID 5532 wrote to memory of 5804	5532	msedge.exe	89
PID 5532 wrote to memory of 4316	5532	msedge.exe	90
PID 5532 wrote to memory of 4316	5532	msedge.exe	90
PID 5532 wrote to memory of 4316	5532	msedge.exe	90
PID 5532 wrote to memory of 1468	5532	msedge.exe	95
PID 5532 wrote to memory of 1468	5532	msedge.exe	95
PID 5532 wrote to memory of 2932	5532	msedge.exe	96
PID 5532 wrote to memory of 2932	5532	msedge.exe	96
PID 5532 wrote to memory of 4164	5532	msedge.exe	100
PID 5532 wrote to memory of 208	5532	msedge.exe	116
PID 5532 wrote to memory of 224	5532	msedge.exe	117
PID 5532 wrote to memory of 3564	5532	msedge.exe	118
PID 5532 wrote to memory of 4692	5532	msedge.exe	122
PID 5532 wrote to memory of 4692	5532	msedge.exe	122
PID 5532 wrote to memory of 4444	5532	msedge.exe	123
PID 5532 wrote to memory of 4444	5532	msedge.exe	123
PID 5532 wrote to memory of 4620	5532	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\room.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffdd87ec188,0x7ffdd87ec194,0x7ffdd87ec1a0
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,15317719528011187886,5426638243253095944,262144 --field-trial-handle=2292,i,16521908149930286740,15687741996056513509,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,15797415346394923841,4079235944728579532,524288 --field-trial-handle=2292,i,16521908149930286740,15687741996056513509,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,3101811820065683061,14086839710641003869,524288 --field-trial-handle=2292,i,16521908149930286740,15687741996056513509,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,8231745399847054649,2169147239120454360,2097152 --field-trial-handle=2292,i,16521908149930286740,15687741996056513509,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,4516426978841811599,15494800969723635090,2097152 --field-trial-handle=2292,i,16521908149930286740,15687741996056513509,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,12886920238566318998,14434401952265357847,524288 --field-trial-handle=2292,i,16521908149930286740,15687741996056513509,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,775961217549640786,2802417946023741845,524288 --field-trial-handle=2292,i,16521908149930286740,15687741996056513509,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,11571305644480940370,14049871847155601860,524288 --field-trial-handle=2292,i,16521908149930286740,15687741996056513509,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,11571305644480940370,14049871847155601860,524288 --field-trial-handle=2292,i,16521908149930286740,15687741996056513509,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,3764545619925346545,12543501158148344532,524288 --field-trial-handle=2292,i,16521908149930286740,15687741996056513509,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,18157226619939173198,3650119123497408094,524288 --field-trial-handle=2292,i,16521908149930286740,15687741996056513509,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,5731073312285537663,11669698783721696660,524288 --field-trial-handle=2292,i,16521908149930286740,15687741996056513509,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,5641600217807671417,14649286722131623155,524288 --field-trial-handle=2292,i,16521908149930286740,15687741996056513509,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,17162494990683878941,12901450493822472286,524288 --field-trial-handle=2292,i,16521908149930286740,15687741996056513509,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6052,i,5006310527008431358,16235475397608799133,262144 --field-trial-handle=2292,i,16521908149930286740,15687741996056513509,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

1c0a1bc2-80f0-40ec-b66d-815bf546ca46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c0a1bc2-80f0-40ec-b66d-815bf546ca46.tmp
Size 11KB
SHA256 118771b29bb0861ff8ff82257e7d3dbb49d88e997e17e31353374dc935583aab
MD5 d0eb77987339f3dbcd7f42af62c60333
SHA1 2953632c56f482359410d5b462fa508ede544958
SHA512 4b60aeb83042d07adbe973fdea24cd468a0dc78e07ce040c9d8a92285542c7fa7b3ec6acfebcf0d36a6df11f3a00631e140203e65b23fbbdaa15cb5514c4f712
SSDEEP 192:sxZtRMkO/f+sCaQZLk8UzodpHpHW6+WNGYoWaS5zIg5wZtV1J:sxZtFO/f+sLOvnJHbG3SdOtR
TLSH
T13742B7196D28693B8CCBD619FA55BF53E2FD503390911F88AAFC8A1C15EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 019d4b02b9de2e5941252d32333a162f2a037eecf7dc1e14a2993477a3372c0f
MD5 42a33087520bb41b4f646e7c948b4004
SHA1 2293a47696a73d6434c7f5de4ebc060761988f6b
SHA512 b5fa505591972c8ce35fb620f3390a4c9c21126544974d030d1ab5421fe3c0c7d3b114c473aa25a535a211310a95f78633962be083a249e328da9350674cf080
TLSH
T1E2F0F969C921BC3B18FD1B3924941746F750232B26419D4B3B3D510C8FB053B464581C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 18KB
SHA256 18a1e3a37e5cb38d38d452d2f0ea83b78b915a507ffa9860cac9c33575a3c105
MD5 82b03f239b58044f1dc310a32f0f0cff
SHA1 58184e5e351719ec9b10bee1693260f4f34e37ee
SHA512 884d2835624980f8a8c4eab8da57f93f3b2de8dc4978070d48ce0df355db8a82c291cc8bb7c42703aa55fa11c7180ece5d5bd1877e77ac875fa6155e64576cd9
SSDEEP 384:15/vsDV70PxSMvqbzcD1ziOVncp+U37WpZRwm7Ugd1ap7fijGpnGDaLX0:THsDV70PQYV3bq7WpfwoXIjnG2b0
TLSH
T19282F1AE4C442043D9B3246BC20A83F1EDACDF108E9F87B60C7E321EF619849D71B189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 29KB
SHA256 99d6c78e043710d4f83ed90716779798b7b04eb690f73e0ad0e8f32d1f0e98c2
MD5 9591efe1be62434d2d107e2b19702029
SHA1 6438e7de08adb0a989e1947ff06284771f884eb6
SHA512 3cc3323210ab19dc07513ef4df0bc9eb7b85b0143fa39c37d79b6fdb1b8309d34b96c452f264d3ab3a409b5a75c6872d48c22f54aead05e78454004106546067
SSDEEP 384:fNPmz/ALfS8CKEhoIqMViQziPMBdrB2PasMyqhdJf00dHmgJIW+uvTVsRZBhW7AC:8zoRCKEhTkQJdrQXqJf00GpubVsRZtI
TLSH
T10BD2F104C9605335C6EC64B69B114A7BFFED488265E2B9D520A8EEA61761FC8E09053F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 152KB
SHA256 ae17c16afbea216707b2203ea1cf9bdb45b9bfe47d0f4ae3258ddbc6294dd02f
MD5 1ec0ba058c021acf7feaa18081445d63
SHA1 73e7eabf7a8ae9be149a85d196c9f3f26622925b
SHA512 16a1b8a067ad4a33dcf4483c8370ca42e32f1385e3c4e717f8d0ce9995ca1f8397b15a63c0cee044c4b0fca96c4b648c850f483eeb1188a20f8b6cbf11d2b208
SSDEEP 3072:T0NNdf7uJ/Q8zfLtuI3m4uTtijwbr+mV+5ZUTRjV:AN7r8jMbgjwvOrU3
TLSH
T1B6E3139A9A1F63D89C3CD982F61EF3FB715AADAB1F521220193149F9D04F0AF5035A4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 69372eb5d0a6773b707d85c3835554fcf53bfb4833b4b00befbac56ae784a170
MD5 4f23e5d7efd78fe04b64d201116d7453
SHA1 f4ff2b8cb35524e5422464ca3bedda14c5329ab2
SHA512 40ac47f8b6e77de5eddf95a97bad4fae6e4208e33f05c71f8206e422390676beb8958c77de755f27ceb02aacb9a3f10a9414dc2f1e77d263c5a1967a845180f3
TLSH
T16451ACB7C3D8866EC91156F0AB24BE2BCE1D0959422C3C5AC8E4EF5F93E2471D24169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 41fb01c4cbc1d949c746d7c7c476462275943ee74623e883a75cea61329d32a5
MD5 5a0f6dfe93adbfe152266495bdbb1c6e
SHA1 0bfe9aa8616cb16cb2b3c690c1246406618eb6a1
SHA512 0d72417ffb135252ab761da384c6c411144aa1058910e298cdba91659d1d525b2e724b42b2ac27c6e42f1f032b36713370ae3bf2a71c090c0aecc671dbdcd3b0
TLSH
T138D02367130C707595BC5FC5545FACDFE7A640300451FDD450E05C9D053146D5547241
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b896d1f487ac4ce16a028b90b6708ed52ca0800335eb5e5ffa8de079443a4d13
MD5 0c72aa5d702472cb9f72a03d253cab4b
SHA1 a0d89f5f51e3f83311c18a57fbc51a5c04bc6fb0
SHA512 f31f8534eb8af0e86487d673f12485c484c02feeac6a1128f0a9c35abf29aef75c4b550a2d80ccc9ca964db6119913ca32854caccef5fcc5a11d9870fe676222
SSDEEP 192:sxZtRMkO/f+seaQZLk8UzodpHpHW6+WNGYoWaS5zIglZtV1J:sxZtFO/f+s3OvnJHbG3SdPtR
TLSH
T1C042B7196D28A93B8CC7D619FA55BF53E2FD503390911F48AAFC8A1C15EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 432d29b43aa537a1df054fc82730f837b97e5fad272079cd935d61b6a3f11767
MD5 a95eef69c49af57ede1c8770610fed99
SHA1 c22d4e8e5a8d88d592924e9b5b7398bab8c335eb
SHA512 e4675e805a6c76a396c0af50d3c26a27c25f3f4fb2ffa7cc1830074577ae6b2fef8f6e88a8e94e2f595ada4adc5e71999e87db3da385d77eacedaf4a8e0deb7d
SSDEEP 192:sxZVRMkO/f+s1QZLl8UzodpHEHW6+WNGYowaS5zIg5wFltV1J:sxZVFO/f+s1OenkHbGhSdkltR
TLSH
T1E342B619AD28A93B8CCBD619FA55BF53E2FD503390911F48AAFC8A1C15EB6DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 4f90db468b383048879f0af6186d98ac816d0925eb3dd53aff5141843281e2e7
MD5 3d091396e4bbd5e637ce1829d58cbfe1
SHA1 4b3b81806a273fba8e146367d73c2b097d033e67
SHA512 23d1aeae3f1127523f19cbecec7e76b303648fa3856e8ca074a73a134904faa97855d8e2f0b3213850cc4c2097f0d54258510bc51f80e2859c7ffb39136e3e7c
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgf:ST/2dXOJhJlpfnpp3tNXVrN3S9DS
TLSH
T1EEB2105571BB021039FE391891B5972E164231B33119E66B7FBD04B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ec8364252547a457f573ac237280f352aa06de0c484b546b20e30b68a90cde37
MD5 e2b5e4c4de3fefadd1b66899e8f0d4f7
SHA1 f8801f52ce76b65201e4ad6bb234c41fd4dc788b
SHA512 196b434583e26753971d53c92436cb8de1dc7d3e30266d0f926d84b07bb7ac90920e3d71df27d1e23091bdde9ed5ecaebef68004bd173ca504dc48f54f82bf02
SSDEEP 384:nEiFiZcIn3sNV8TUNTUlI44aKMvJ94wzWfLBCW/Cv5wJuO3im3tgOIwZOy+ZgL/y:fFQn3Awgef9HEBC2ChItim3Xsic
TLSH
T17CC24A36E898CDBBECEA5BD9A64A7643EEF44163C98C9AD4D5D81D1C00D71DE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5602a785a7bb598681f4ec62080f1c6d7b8a45fd251c748315b9f5952778d489
MD5 8f933aa8c1c84622f1a458a2c62ab893
SHA1 498b8620779073a69ec7a0c39ae0a4af85b801b7
SHA512 7e8b6d1c2346afd87924d0d7216b36075ce78c0dd8555ff77ea04d164f7e3e59d0ab2ec81b00aa5324deb8dfcf6e961343864ec50a1448b6c36a6be5b734efb8
SSDEEP 384:n6iFiZcIl3sNV8TUNTUlI44aKM+P94wzWfLBCW/Cv5wJuOSim3vGNgL/7Izlo0:xFQl3AwgeU9HEBC2ChIgim3vcr
TLSH
T141C24A36E894CDBBECEA4FD9A64A3643EEF44163898C9AD4D5C81D1D00D71DE030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 72a15a6cb3708040c305ebf7a313f0512f7bc924e1b889b3b9fad47640bfe029
MD5 aea51b852617dc6e1e20f6b83bfa6d45
SHA1 f4213003b7957f2958342476eee759a7ec88b4b3
SHA512 f8a6f5df5e972b1b67b10dd0fbc96a6c83d17c9d5273c31d8a1d399512adc8bc7f93f3de047e30f859df775e2b85cbea8853f07b05ec79c0fe916543a24e420f
SSDEEP 384:nuiFiZcI63sNu8TUNTUlIm2aKMiX4wzWfLBCW/Cv5wXFKy7O6R2Feo2bgL/7IzwJ:FFQ63rwgceHEBC2ChqFD7TRDsJ
TLSH
T1B7C24A36EC98CDBBE9FB4F9AA74A7A07DEE40163959C8AD4D5C81D1C008759E070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8e9066485fb0f5619e190167414198be7be7650d89829bb62fe4ea6608f8943d
MD5 07b1c2cb71d08ec266745110380ab152
SHA1 2676c05e9aa7600515aa895d5f81233adc28cd6c
SHA512 4ead5a79504e74d078a9c8f0e647542386a4338ae7d39ff347190503653a7e90dfbc6266111a134554083d9396e6865fad94a3591c824297d3eec2ad6403e15f
SSDEEP 384:niiFiZcIzh3sNV8TUNTUlI44aKMva94wzWfLBCW/Cv5wJuOJsm3tgOIwZOy+ZgLa:pFQF3Awgew9HEBC2ChIfsm3Xsic
TLSH
T139C23936E898CDBBECEA4B95A64A7643EEF44163C98C9AD4D9D81D5C00D71DE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e1a2d39a2ec72548a9cbd31e40fea089545c0ac6605f711f872fdff1de9e8107
MD5 0a5e062a7684f32cfbf8b045874cd8f0
SHA1 c583d30615cae399926e7f5a38eddcaae2d8f87b
SHA512 edd018409cc9fc5a4005f5c25d158efcf5a08716ffa166f155a7e31b57718c3338c582fe7d7d88d62fad6567970899152b84077c63cca74721ba9f15466b481e
TLSH
T1E9412B5CBAF91158F3B76E569BF6B46E487EB9772E06C45E10020E4F0A62740C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4164-192-0x000002E445110000-0x000002E446110000-memory.dmp

Download