ed6d50a1b03d536f96b3b111055f4c739ff0d5ef0fee210dc4904620ded60624

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/09/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MegaballNeo-windows.html
Size 5KB
Sample260926-tk28lafa42
SHA256 ed6d50a1b03d536f96b3b111055f4c739ff0d5ef0fee210dc4904620ded60624
MD5 0be8b1fbd5247d10740f2cecf96a9959
SHA1 69ae031314aa8e8ad24c5914e01c95433f50245c
SHA512 50308d69eb16675eb9220f5b666f3e656f23db1e1d2864635f9d16f9b07afe77262965c8334ede37b6b6612ae08d81ca67fd8d936b0901b85e74b489699a455b
SSDEEP 96:PNy8toXZzIEb0EaW87IiFXW6CXChetzveL7XM9sseHWEYzueh8ECymw:PN5tkCBVW6CXChetzvG7cCNWNyGCVw
TLSH
T1F3C11CE3A6724057D7BA7FA115F7B35C6711F63CB602A1C4D494D22CE1CCE8F8049898
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5088	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{4D69466C-53D6-445D-84C9-A993478D5287}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 6140 wrote to memory of 1608	6140	msedge.exe	86
PID 6140 wrote to memory of 5088	6140	msedge.exe	87
PID 6140 wrote to memory of 400	6140	msedge.exe	88
PID 6140 wrote to memory of 1756	6140	msedge.exe	89
PID 6140 wrote to memory of 400	6140	msedge.exe	88
PID 6140 wrote to memory of 1756	6140	msedge.exe	89
PID 6140 wrote to memory of 1756	6140	msedge.exe	89
PID 6140 wrote to memory of 5300	6140	msedge.exe	90
PID 6140 wrote to memory of 5300	6140	msedge.exe	90
PID 6140 wrote to memory of 5300	6140	msedge.exe	90
PID 6140 wrote to memory of 3816	6140	msedge.exe	91
PID 6140 wrote to memory of 3816	6140	msedge.exe	91
PID 6140 wrote to memory of 3816	6140	msedge.exe	91
PID 6140 wrote to memory of 596	6140	msedge.exe	97
PID 6140 wrote to memory of 1404	6140	msedge.exe	98
PID 6140 wrote to memory of 596	6140	msedge.exe	97
PID 6140 wrote to memory of 1404	6140	msedge.exe	98
PID 6140 wrote to memory of 5468	6140	msedge.exe	100
PID 6140 wrote to memory of 5388	6140	msedge.exe	114
PID 6140 wrote to memory of 4124	6140	msedge.exe	115
PID 6140 wrote to memory of 3844	6140	msedge.exe	116
PID 6140 wrote to memory of 3184	6140	msedge.exe	122
PID 6140 wrote to memory of 3184	6140	msedge.exe	122
PID 6140 wrote to memory of 2332	6140	msedge.exe	123
PID 6140 wrote to memory of 2332	6140	msedge.exe	123
PID 6140 wrote to memory of 1640	6140	msedge.exe	125
PID 6140 wrote to memory of 1640	6140	msedge.exe	125
PID 6140 wrote to memory of 5016	6140	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\MegaballNeo-windows.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7fff3d11c188,0x7fff3d11c194,0x7fff3d11c1a0
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,4681144856631266815,15326304325132474175,524288 --field-trial-handle=2372,i,18279595196376860430,5086483154140683848,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,8466669348455249969,4827107689757695099,524288 --field-trial-handle=2372,i,18279595196376860430,5086483154140683848,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,13799180443113473370,13377612323898991725,262144 --field-trial-handle=2372,i,18279595196376860430,5086483154140683848,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,1065653489698482651,12593124834102902613,2097152 --field-trial-handle=2372,i,18279595196376860430,5086483154140683848,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,12534478661032192103,12431264406190488890,2097152 --field-trial-handle=2372,i,18279595196376860430,5086483154140683848,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,17170155361691695388,17615222939291287006,524288 --field-trial-handle=2372,i,18279595196376860430,5086483154140683848,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,8462155935267890217,13852380494949213396,524288 --field-trial-handle=2372,i,18279595196376860430,5086483154140683848,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,7386572635761329464,7473759392304065308,524288 --field-trial-handle=2372,i,18279595196376860430,5086483154140683848,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,7386572635761329464,7473759392304065308,524288 --field-trial-handle=2372,i,18279595196376860430,5086483154140683848,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,3420193457112741265,2956579073402249279,524288 --field-trial-handle=2372,i,18279595196376860430,5086483154140683848,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,12558000726822759381,2236959803643154731,524288 --field-trial-handle=2372,i,18279595196376860430,5086483154140683848,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,14231651581205061264,13006571696507643622,524288 --field-trial-handle=2372,i,18279595196376860430,5086483154140683848,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3128,i,12787928038136788172,12852565385263628704,524288 --field-trial-handle=2372,i,18279595196376860430,5086483154140683848,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,9133287621180328767,7845345573380169107,524288 --field-trial-handle=2372,i,18279595196376860430,5086483154140683848,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,15468620241423872315,10288882849226974431,524288 --field-trial-handle=2372,i,18279595196376860430,5086483154140683848,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5300,i,4799956585121868425,14640550820105566574,262144 --field-trial-handle=2372,i,18279595196376860430,5086483154140683848,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6ced0e72a09fd9de9543e2866d4f9c0ea1bfa57becf74499c2d223ebc320ba5a
MD5 4f8636211233c09849e2f30843e7cc33
SHA1 db4cab71ba936124d01205685935e8b1edf08f87
SHA512 1d8d1829a3858c443c76ad634724156621f1ddb13ab12efff1f32d3e76742bcf0ebdb45232e6688cedceac3d1579fab6c220f6ef11db829a8ebd5aa37446b24c
TLSH
T155E07DB805CCC22EA609754BD2AC5B8CC280370EDACCBB1E3B008F847202C80B3C3791
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ade2f4a009937bbd7079946b97e5a16e7094b36f31fbf44dffff6a1db8483540
MD5 e962401aff95721f33d479e8ef1d20e1
SHA1 8c98935160a02fabaac72e1fc22deb27d6861106
SHA512 7f625721b139f443f04e9d44d6f1ee3f175fcd11905222b3c00e380dd574fb74798c132c73e0c7c41de060d85d440048742341009f9484522dbcec9e75277349
TLSH
T1C3F0CDB9C921EC7B18FD1B7D60950B46FB5023672A81989F3B3E410C8FB5537459591C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f5a05384c8fe1da5cb2a3bd6c3c5764fe24506d657efe637fa90816bfee626c2
MD5 5526b57aa5bb200b29d3a24fcdcb0242
SHA1 447471ad0eaf11921d5a1eeb140e50ff1924df09
SHA512 406ea1405051f88d3f02e1254ad7086a87e4b2a2d6791a95a5f7cc6a47c1c6721ffb37d1ab56a2fed8b3db499dbb3b61706f58887bda627ca18bde94449f67b1
TLSH
T1C33181F7C3E4866EC90196F0A618BE2BCE2D0954432C3D5AC9D4EF2B93E2471D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a6daa51c4ae78fadc3c3cb4e792c35f6271bd3f02b1f4f99b2aeb6a354ee85ab
MD5 c3bb06b860ea9581ab9178bb437b3526
SHA1 ffe20a43d0efee80a6492cbd331c2cb20b1bc1e5
SHA512 ff08b194345ba226aea30155b4e037286146bdc710aef2a85886bb949cd139d5bb1a636d76d914b6511ae5f2f0e3376b7fa5abbcd758031ec9d73561269be643
SSDEEP 192:sxZPRPk6b/fXslaQZLE88zodpH3HW6+WNGYoWUSKrIgjt9J:sxZPC6b/fXsYOvfXHbGRS4jtH
TLSH
T13342D7156E28A93B8CC7E219BB157F53E3F9503390911E48AAFD8B2C15E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a8853735a6e9bd6d48032a226f3ea0bd71125d07aa5e8261f3d1b7c8e4b0eaa7
MD5 36d4b44f7133bcba296d32e74d837f2a
SHA1 31a12dfd295406d0a9bea2dec8eee2c177920cfc
SHA512 f6dd702a1d9c20f18b41febe381a290b48dcbcfb9003545024319bbcdc7ed71182549cffd02db4176bdee1e17269ef09e4122900a4445d001d36c014f28e4156
SSDEEP 192:sxZPRPk6b/fXshQZLE88zodpH3HW6+WNGYoOUSKrIg5jt9J:sxZPC6b/fXshOvfXHbGNS4RtH
TLSH
T12F42D8196E28A93B8CC7E219BB557F53E3F9503390911E44AAFD8B2C14E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7ff6ed097a77186e147a7de16190b889dff07ede6781e98292d12e3fb7433165
MD5 6008d39fc648729c42b908df1312d63d
SHA1 b5fefb82aa9ae11d9405059e04f272148de2aadf
SHA512 fdde8c63f1ad51a8d379fff8bb9e0d74f3420b1cdd3d11e3fafcbc3cb28c37215f08b2a611361f81dfd1a3d1f02514e46f16be50da659a77032d58c157bd6cf7
SSDEEP 192:sxZPRPk6b/fXsaaQZLE88zodpH3HW6+WNGYoWUSKrIg5jt9J:sxZPC6b/fXsDOvfXHbGRS4RtH
TLSH
T18342D8196E28A93B8CC7E219BB557F53E3F9503390911E44AAFD8B2C14E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 7bc96e9dbb63157c379c503a7f7d57362b828e292b5bcd538317855312a18f46
MD5 00cefeaa717e4c39ac8ef87b157b8fb4
SHA1 b8fef0b55fda605d8bf559a9cd3c1b44784f4d0c
SHA512 0ebd0329931365cd452be265277f049d2868e4c0e093512d873a74863465d6ef3973500371ef2bbab7c206ce5aa29af0853ce0dde816a1019a51a7e02bcae41d
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgK:ST/2dXOJhJlpfnpp3tNXVrN38I5pm
TLSH
T142B2221571BB425039FE291891B69B2E068231733119E63B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 22d53719d4f09dc4f754482836dd43d899191c189125d06ec6b769631bbb26f5
MD5 1fc30e8dc60089b2b8d33e38a9fcfb0d
SHA1 9fd5b2bc24a5febc5e55e074f6adc9641450012d
SHA512 6f811d0feb88d4b7183711570a6921a32d655937048af7d69e1a850ecec4e01b89c88ff405be5ef32bb5967c1c0013ef56c86ceec196251e90460a4c6a25118d
SSDEEP 384:nOiFiZcI03sNY8TUNTUlI4KaKMZiUw2f0BChCAQPwuwkLtgOIwZOyqtgL/7IzloG:lFQ031wg2utBChFQYfkLXsrZ
TLSH
T1E6C25B32D8A8C9ABFCEA5BC9A74A3603DEF04163D58C9AD4D9D91E5D00D719E030BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1997a57c5009d3577a90ce5dbec90a525fa80a04d551b96592c91df629b760e2
MD5 ff7f1a83ddcce8466db3d7210c718ebe
SHA1 3b18b9c684b2d93ab51ba1bd9230ea813e6c10dc
SHA512 1e76411db43f17a89af86cde97e4d4b7ac46dcdc6031685b85e42921f7d13ab64259e7ec0299016b74b52dc8b6a805b5b4c59a92de889b863cfccd6583a6c88f
SSDEEP 384:n/iFiZcI63sN38TUNTUlIm2aKMiK4w2f0BChCAQP4XH7O6R2FeoZgL/7IzEoj:KFQ63WwgcBZBChFQwXH7TRrg
TLSH
T141C26C32EC98CAABECFA4F9AA74E3A47EEF00163949C5AD4D9D81D1D008359D1707C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 908c1143644ce00e542d0937cd5c3cfdc502ab7b8ce6b314d7bc344e4953a01d
MD5 b3acb2df40da712c6af770fb27942fbd
SHA1 7ef841714425ca066e2bd6f6de0bf3710ba8f25e
SHA512 b6c4e13bcdb28368241be4dfe981887aab38e4d303a1901bfa78c9f3b8126cd0966181eb473b47cd06b4d0e6f54d079b4a78b0735ea088d64fb16cf9be1d9d00
SSDEEP 384:nSiFiZcIV+3sNY8TUNTUlI4KaKMZiUw2f0BChCAQPwuysLtgOIwZOyqtgL/7IzlZ:ZFQQ31wg2utBChFQYrsLXsrZ
TLSH
T176C25B32D8A8C9A7ECEA5B99A74A3603DEF04163C58CAAD4D9D91E5D00D719E030BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0d8ddd13682c988c768ff2b62768d6629452af7292105ae5ea709d6811d5c850
MD5 82a0afbf75afcac2ccdbcd85c1570684
SHA1 d24df482490cbcc0cec02aa8d3d3ff4302613901
SHA512 0e6a929ff1909d4f598031f9706da824d92ca415fe134c6aae0ce1b6964952cb04c35aba129a84f2caf970ae0210b719f695b8116c369f5476de6b3508de9d44
SSDEEP 384:nfiFiZcI03sNY8TUNTUlI4UaKMRiUw2f0BChCAQPwuwkLtgOIwZOyqtgL/7IzooG:qFQ031wgQ+tBChFQYfkLXsKZ
TLSH
T1FDC25B32D8A8C9BBFCEA5BC9A74A3603DEF04163D59C9AD4D9D91E5D009719E030BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 665a8fccc4cfec0d2f6d0d8947724c3e4c09ae0642d2a0a772cb9ff0584f2b64
MD5 97b0c965a91ed3f0869bd69cc393a184
SHA1 25fe4b897988cc89a429da19183e83e9f3081806
SHA512 8a757f673415c6e63ded54b45b2301888eba75c319e92e9e8c64ad196b3d3620374e8563eff5798459ea9ccb2220df78d621824ff0e386b51647d8fe6428f015
TLSH
T152412958B6F91158B3B36E4AABF7686E487BB8772F06D05E10110D8F0622B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5468-183-0x0000020888D50000-0x0000020889D50000-memory.dmp

Download