5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment20261001-527357-o2uta2.htm
Size 194B
Sample261001-mgff4ayvbv
SHA256 5dfa57bf10f02106e404ffb38bc5b2da62eb96b9b02b74d10f1b472a89e6ee5b
MD5 0fe53cf75ee2569670f22b4df68cfdff
SHA1 c8ce77fbd6e13476239c598378c612a8b57685c0
SHA512 ee321ac4703144eafd3d4db7deefe08d8aef572e3c67fc9d4203f5349646173caadf91608fd10220a16ea91099657c4a8460e3ca09a781af646cb3a5282db660
TLSH
T121C0C0B7E400620CDB3078D500F172CC00F8819C9C82CA003D8018E8B39696AC9031D1
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3428	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{462ED0EB-7C89-4950-8E1D-05E6404905C6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 2328	3204	msedge.exe	85
PID 3204 wrote to memory of 3428	3204	msedge.exe	86
PID 3204 wrote to memory of 4124	3204	msedge.exe	87
PID 3204 wrote to memory of 4124	3204	msedge.exe	87
PID 3204 wrote to memory of 4124	3204	msedge.exe	87
PID 3204 wrote to memory of 5324	3204	msedge.exe	89
PID 3204 wrote to memory of 5324	3204	msedge.exe	89
PID 3204 wrote to memory of 6020	3204	msedge.exe	90
PID 3204 wrote to memory of 6020	3204	msedge.exe	90
PID 3204 wrote to memory of 6020	3204	msedge.exe	90
PID 3204 wrote to memory of 5476	3204	msedge.exe	91
PID 3204 wrote to memory of 5476	3204	msedge.exe	91
PID 3204 wrote to memory of 5476	3204	msedge.exe	91
PID 3204 wrote to memory of 1364	3204	msedge.exe	100
PID 3204 wrote to memory of 5940	3204	msedge.exe	101
PID 3204 wrote to memory of 1364	3204	msedge.exe	100
PID 3204 wrote to memory of 5940	3204	msedge.exe	101
PID 3204 wrote to memory of 5636	3204	msedge.exe	103
PID 3204 wrote to memory of 3708	3204	msedge.exe	112
PID 3204 wrote to memory of 5576	3204	msedge.exe	113
PID 3204 wrote to memory of 3584	3204	msedge.exe	114
PID 3204 wrote to memory of 3432	3204	msedge.exe	124
PID 3204 wrote to memory of 3432	3204	msedge.exe	124
PID 3204 wrote to memory of 4372	3204	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\attachment20261001-527357-o2uta2.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc7692c188,0x7ffc7692c194,0x7ffc7692c1a0
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,13398670775920981411,418312499884210934,524288 --field-trial-handle=2324,i,1016812954060521623,2790985880877783060,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,11911172921685202077,16759571035920131649,262144 --field-trial-handle=2324,i,1016812954060521623,2790985880877783060,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,10992620541097578111,13237044473825193774,524288 --field-trial-handle=2324,i,1016812954060521623,2790985880877783060,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,10905771224494155042,4731810822866307454,2097152 --field-trial-handle=2324,i,1016812954060521623,2790985880877783060,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,16777073944899999014,11878128043340122625,2097152 --field-trial-handle=2324,i,1016812954060521623,2790985880877783060,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,5604521634231691769,10639946161774220059,524288 --field-trial-handle=2324,i,1016812954060521623,2790985880877783060,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,6522992265176103337,11515151600804045638,524288 --field-trial-handle=2324,i,1016812954060521623,2790985880877783060,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,7882527775209505106,6989229525900826329,524288 --field-trial-handle=2324,i,1016812954060521623,2790985880877783060,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,7882527775209505106,6989229525900826329,524288 --field-trial-handle=2324,i,1016812954060521623,2790985880877783060,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,665018294807232636,9803920965312146024,524288 --field-trial-handle=2324,i,1016812954060521623,2790985880877783060,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,763176142986801557,5929684974582026097,524288 --field-trial-handle=2324,i,1016812954060521623,2790985880877783060,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,13477245590326527016,7471754451137260864,524288 --field-trial-handle=2324,i,1016812954060521623,2790985880877783060,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,12173599340026243199,868436806291724255,524288 --field-trial-handle=2324,i,1016812954060521623,2790985880877783060,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1068,i,4551733071987557650,11946042065474502027,262144 --field-trial-handle=2324,i,1016812954060521623,2790985880877783060,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

7cfb3bec-f8ea-463a-a9f7-57ddfd1d8c0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7cfb3bec-f8ea-463a-a9f7-57ddfd1d8c0a.tmp
Size 11KB
SHA256 f400e5fb5aa2f23a3fc72a8db54e99a47eeb6cf5b91b90e8aef01aa7dd67181e
MD5 649f72fd744bbd134f76e51dbeece787
SHA1 de5f28d0242e20dd95829558660c659abf25267c
SHA512 6ea48efa7cd93b3d0511454567e51f3711fdca1b436588375225e162beed3b11677727d9f5d539a411082d8d95bbc1bb85eda0cd1f8b4bd74ceb5b7454c8e717
SSDEEP 192:sxZKRMkf/f+s+aQZLs8pzodpH/HW6+WNGYoWmSkoIgjtSJ:sxZKJf/f+sXOHCfHbGjSljtu
TLSH
T17942D7156E28A97B8CC7D61DFB557F53E3F9503290911E48AAFC8A2C15EBACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 16b14d375fcfd659e7420279b454f7b2fa5c7f716d6dc974de5d3b9cc6df0ddb
MD5 ae358c1601307a0080d3f99bb6a4f4bc
SHA1 360f5d69ba13f5b90dc11d0d90493ef7ffb7a983
SHA512 2bdf6ff6f6d2491c1330e391dc927cb8215f20d6f95ea64f92474a1b4d65a68da3f5bf55c7dbb4c481f5cbbcc90478ecfd49d7dd406cc1347696d039e1a0318a
TLSH
T18FF0F4A5CD21BC3B08FD1B6960950746E790236B2A91985F3B3D850C8FB453B4585C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

13b14875-d571-4aca-a56e-389af9814b36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\13b14875-d571-4aca-a56e-389af9814b36.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c491c4f1c5f52a675d16aa1145932bdf811ed02cb3d3926c5472426386405fd7
MD5 8a17c8f11f968b3925cf5c6b478ece7e
SHA1 1e1182eb39802b06d69241bf40e87cab1c8fa8a6
SHA512 86d70c5fa4930b23b2db7cca759ba4ad2b6a84990ced641c0e84734a4fe2bebc874b9d8b06bf4ef304e57213b93c0a79ae9bc83d2e96134b78efcbee0ff41d93
TLSH
T154317FF3C2E4866E890156F0A618BE1BCE2D0A54432C3D5AC9D4EF5FD7E2471E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c038b9112973e510f97a2149236baf09a8d50272c34abec9a01b6645652f8a18
MD5 ee8bd96a2b863eebddf26dddd34ece35
SHA1 74bfdf5c9953edce102da48557c138c17d0d6ac9
SHA512 98f2621845131b55b81c9082e72af79fa58b11a641bd023b20f93980fd7c1b457fea6678cf6e57309e93046b77691763aa32813007ed8a1ac2d644387fded7aa
SSDEEP 192:sxZKRMkf/f+soaQZLs8pzodpH/HW6+WNGYoWmSkoIg5dtSJ:sxZKJf/f+shOHCfHbGjSlbtu
TLSH
T19A42E7156E28A97B8CC7D61DFB557F53E3F9503290911E48AAFC8A2C15EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b72903dae43f7ea3ddc48b0fa547737491938faf5ff86ddf5b03274f008d51ae
MD5 edbeb39231458854700d5e464dabdca8
SHA1 54c9e65468075f40b53bd035c9da447137fef28b
SHA512 ab6999f69873218d0646a97ae3c4476f5018a8074c0d5140de17d7545a4c4d6929e3644cbdd2b1a55fd57a37105d712ea1911c6cc31b9d2a9860768940258321
SSDEEP 192:sxZKRMkf/f+sHQZLs8pzodpH/HW6+WNGYoTmSkoIg5dtSJ:sxZKJf/f+sHOHCfHbGESlbtu
TLSH
T17842E6156E28A97B8CCBD61DFB557F53E3F9503290911E48AAFC8A2C15EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 cabe4a9b9f3358ef52889b1fa524a5576170ec188a35adeb82ee147a5ac23774
MD5 61763404e5c23156a74626e68e6b973b
SHA1 ddaa1a2e84c5fbe027eb341e79acb9e7c1d1d476
SHA512 794e1ee2101749b6c6c0e9332d475dfcd677595b1ca904d82e0f245dc9ebad6db5794c0b5c4dcabe42d503cc69999d2565f9772f518a14c70990d418c4f7316b
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgs:ST/2dXOJhJlpfnpp3tNXVrN3Glnb
TLSH
T1FEB2131571BB421039FE391892B6972E164231B33119E66B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 97e4aaab81e1af974cf5bbe8d6b0ce0e2e678ef3367f9ecced92a71304460169
MD5 fdb18f6065a907d97583ea1629df92de
SHA1 a9e4fa44a5e2e6ba524fa47a87ac5b8d68237d02
SHA512 136d190cfd2695abc2261292fa99756008cc15fa459b768e9f329ed71c66cd2ac3846788107116ef23a8c31baba355b8da12b16c211c129f134927353344e222
SSDEEP 384:nEyiFiZcI+3sNA8TUNTUlI49aKMOwDwzWf/BC2uZneCUOcuwMiuSVZh6DKhHX/Pq:iFQ+3pwgzvu4BCnnr/cbMiZfYGHVA
TLSH
T168C24B32ECA8DAABEDEA8FD5A70A3603DEE05153998C5AD4D5CC5D1D00D719D130BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e62aa37a334c5f6995ff90a1144e475a34c79ccf428d4ed2ffa6bc3dd428a70f
MD5 177109cf0819bc7487703d046ad5036f
SHA1 47b4aa55e7014616e6ac2f326df82a59b1d008d6
SHA512 5afa8477d6340b3e8189dbcdf636f7909303d13f8aa62dcef5ac744fbd47a26fd455d5b3a3db4d481115363ddf1c2564c1b88501704806244f064fd482f3515f
SSDEEP 384:nTyiFiZcI+3sNA8TUNTUlI49aKMawDwzWf/BC2uZneCUOcuwMiuSVZh6DKhHX/Pq:VFQ+3pwgzDu4BCnnr/cbMiZfYGHVA
TLSH
T172C25B32ECA8DABBEDEA8FD5A70A3A03DEE05153998C5AD4D5C85D1D00D719D130BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4209c53e1a97c9f74b637f41dde117807fa3732f1aa0bba72217012c39a80cd4
MD5 2aebe3e6bed326fad9d9f341d71f305c
SHA1 353ea11128e7edeef574da2562e8f4f345f11ec9
SHA512 60337ed56927c4e26c4d12d2fc853a21459cba301991d9cfc9797a9505afd66444bc996fa9a881f00f234ce53b8c8d83d9aa50236db33b4686836178d2033bfb
SSDEEP 384:nWiFiZcI63sNu8TUNTUlIm2aKMiD4wzWf/BC2uZneCUOCFul+7O6R2Feo3IgL/7T:9FQ633wgcGH4BCnnr/CFL7TRyx1
TLSH
T171C25C32EC98D9ABE9FB8FD9A70A7A03DEE01153959C8AC0D9D85D1D00975DD0707C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ad974ef842c36d9a563ac1174e8bb091138cad412102a723b70025aa481bd3ec
MD5 c77db178b7436581390e75d2cd5d4646
SHA1 6b532ed7f3451192aa58b682bbdd910fb3ffbc49
SHA512 1f1d52f3188dab29f474d2630044a2a2ab69466ea808c5300c8852a493283c145d9f2c92a28f894415c6d5a31014a8b7295d95bec76b575a8f660faec0488cec
SSDEEP 384:nTiiFiZcIng3sNA8TUNTUlI49aKMawDwzWf/BC2uZneCUOcuw5muSVZh6DKhHX/i:VFQg3pwgzDu4BCnnr/cb5mZfYGHVA
TLSH
T1BAC24B32ECA8D9A7EDEA8FD5A7093A03DEE05153998C9AD4D5C85D1D00D719D130BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 37d633066613cec6e1a863ba0fa7f2ee30eb2b346df3db52f33b847c4a94064a
MD5 b99b688ed1fc26072aa81ee35e9fc214
SHA1 3ae8a896062fc1dbe91df57a5c4e47084d1a7ae8
SHA512 abc854711e525f15b658f96e27f685a84d6d84c4eab9c99c182bfbb6e17ab2ef4bcd70f158a97ee4fd1a957f6e3d5ef78be8779bf5e7e8900b55a8844a4f7346
TLSH
T13A411898EAF9114CB3B76F56AFF7986D587BB8272E46D45E10010E4F0A32B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5636-195-0x00000183A29B0000-0x00000183A39B0000-memory.dmp

Download