dbe56391d38fd5931a6d149249f1113024b8aea2af25fa8674fc5c3e99cf4c84

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample261001-rm1rfadh77
SHA256 dbe56391d38fd5931a6d149249f1113024b8aea2af25fa8674fc5c3e99cf4c84
MD5 cb1fc49764c26340f3f059f7fba932dc
SHA1 dee6828bc5016de3a1f5fcffc7509ca040daace5
SHA512 a06e656cf0e0a49dee6ec593eb303b1660d7c64cdaf6dc8db2f3f4c1ab7d94f1f35921524a2d8e6733b7161e1a20a2ddf5e4d8d1c580461f3c01eb02628b52ab
TLSH
T1BB517272E192643BA127C5DE7070939EB0E6C402C7976A176DFD9378CACAE939B1134C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2068	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{42C00700-8E94-42F3-8562-9EA56A3E223E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 5992	4636	msedge.exe	84
PID 4636 wrote to memory of 2068	4636	msedge.exe	85
PID 4636 wrote to memory of 3368	4636	msedge.exe	88
PID 4636 wrote to memory of 3368	4636	msedge.exe	88
PID 4636 wrote to memory of 1444	4636	msedge.exe	86
PID 4636 wrote to memory of 1444	4636	msedge.exe	86
PID 4636 wrote to memory of 1444	4636	msedge.exe	86
PID 4636 wrote to memory of 5664	4636	msedge.exe	89
PID 4636 wrote to memory of 5664	4636	msedge.exe	89
PID 4636 wrote to memory of 5664	4636	msedge.exe	89
PID 4636 wrote to memory of 1036	4636	msedge.exe	90
PID 4636 wrote to memory of 1036	4636	msedge.exe	90
PID 4636 wrote to memory of 1036	4636	msedge.exe	90
PID 4636 wrote to memory of 3852	4636	msedge.exe	96
PID 4636 wrote to memory of 3852	4636	msedge.exe	96
PID 4636 wrote to memory of 3888	4636	msedge.exe	97
PID 4636 wrote to memory of 3888	4636	msedge.exe	97
PID 4636 wrote to memory of 540	4636	msedge.exe	101
PID 4636 wrote to memory of 3212	4636	msedge.exe	116
PID 4636 wrote to memory of 1148	4636	msedge.exe	117
PID 4636 wrote to memory of 3244	4636	msedge.exe	118
PID 4636 wrote to memory of 888	4636	msedge.exe	121
PID 4636 wrote to memory of 888	4636	msedge.exe	121
PID 4636 wrote to memory of 5976	4636	msedge.exe	123
PID 4636 wrote to memory of 5976	4636	msedge.exe	123
PID 4636 wrote to memory of 3564	4636	msedge.exe	126
PID 4636 wrote to memory of 3564	4636	msedge.exe	126
PID 4636 wrote to memory of 1704	4636	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcb301c188,0x7ffcb301c194,0x7ffcb301c1a0
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,5942232829282259921,6003661967539930656,524288 --field-trial-handle=2160,i,10746750305907424074,1998027664464003687,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1784,i,9615346373158175818,4295831943492002852,262144 --field-trial-handle=2160,i,10746750305907424074,1998027664464003687,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,17809216266148784985,913758732557239766,524288 --field-trial-handle=2160,i,10746750305907424074,1998027664464003687,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,17371370064483850416,17872637012861925515,2097152 --field-trial-handle=2160,i,10746750305907424074,1998027664464003687,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,11713491510699053703,7420054871611128855,2097152 --field-trial-handle=2160,i,10746750305907424074,1998027664464003687,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,10934713534495304365,2678218242338599797,524288 --field-trial-handle=2160,i,10746750305907424074,1998027664464003687,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,2661765094275178568,13002970578693656204,524288 --field-trial-handle=2160,i,10746750305907424074,1998027664464003687,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,5215330868232006353,5436536604393242085,524288 --field-trial-handle=2160,i,10746750305907424074,1998027664464003687,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,5215330868232006353,5436536604393242085,524288 --field-trial-handle=2160,i,10746750305907424074,1998027664464003687,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,10418901659165647691,16896198065690401535,524288 --field-trial-handle=2160,i,10746750305907424074,1998027664464003687,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,16299183246419062878,5118235553509241598,524288 --field-trial-handle=2160,i,10746750305907424074,1998027664464003687,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,1748988451444305695,7209514939086902735,524288 --field-trial-handle=2160,i,10746750305907424074,1998027664464003687,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,8268544765930957230,2663495934136020088,524288 --field-trial-handle=2160,i,10746750305907424074,1998027664464003687,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,13500038021262927213,2335523554699435226,524288 --field-trial-handle=2160,i,10746750305907424074,1998027664464003687,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,14256936777788989009,13636614270615354899,524288 --field-trial-handle=2160,i,10746750305907424074,1998027664464003687,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5968,i,8651099793065984396,14386503528339435447,262144 --field-trial-handle=2160,i,10746750305907424074,1998027664464003687,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 94f918cbc2bcf19af36f3e4b3bd6e323e00d34bb4455782d79cf24365fa7ec50
MD5 c2d72fad52f18f2b06daf7cd8f13ea26
SHA1 c4b7a85d2a9bc8e2aa2f10d77b2cc95307873ce3
SHA512 dac326b8948b96db96e48a4c6d210b69e27e8c708b29d2f9cc109865572f1315abc6af5c15a0c2c6242e70bccecd896909e5aa89a9a01e0237a4ee1cc0bf988d
TLSH
T120E020D508C5CE1D714674C70199570C83903B6B97CC691D5710CED97447044B3D2B60
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 cb7915412bdef4ea69933c7ea69eca9532db67f9a9ef69abc0c021d5a96b2ddc
MD5 7dde0520eccd6a6161e6a51faf79be78
SHA1 886ea6ab931c4376c06c3277a6d138f8c989ca84
SHA512 ded4205d891284a1d522ece45cebc586f64c2232eeadfa10a4bc49921797f5d17ea43a19e4d57dd412a3ad402ae8da6821e91c70bbb7ae2b97464fee4eefcea1
TLSH
T1C5F0F4F5C825BC7B08FC5B2960A50A46EB51135B2A80889B3B3D810D8FB1A3B858686C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4e6e7cfd16af9c2826d3fb435da28cfa72af95293c1869bb6b9775575a896c48
MD5 06c7da443728f65a4efdbabc835765b0
SHA1 5a3303c0cc80c2bd38335a341ba5abbf259dfff4
SHA512 7cc8e21890922116c785b0b0d4884fe094b377cc420a3f946532fccf53cf14a9603bb3e1e4afc20c89234e0ea54196378b7fd85e6017d562260d74042fb32233
TLSH
T1B24102F7C3E8866E890196F0AB18AE2BCE2D0905432C3D5AC5E4AF1B93E3471D14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 40a3c83d8b2252b35cb597c9c6fbb258c6950f1eb37175eb51d93bbf217a9b3e
MD5 a25ed76482dc1df2d5e4214de35f60a9
SHA1 f1a59de47100814af975f06f4dcbf4813be436f7
SHA512 9c6940a80f5abea10a86b037c5f783fec20a31ef531697ea67d4b19f1364faa91f10e59a46d78cf8b0f9bec2bdff6002da516a5e69f61d972e57588997416d53
SSDEEP 192:sxZcRPkl/fKsSQZZNSzodpH3HW6+WNGYbIObYDlIg5YhJ:sxZcul/fKsSOZNpXHbGFsYNOr
TLSH
T1B142D8156E28A97B8CC7D20DBB55BF93E7F9603360941E48A6FC8A1C15E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2de4c3843324d80775e3867ca9497d3fbe7c4b5eee712a3453ef4986df604634
MD5 ae3529983fd0922381e2b1561c9fdb9f
SHA1 dc37674bd516e562559ed033e89a492d89d3b341
SHA512 e8529700acdf931c0205f8ba35ea9c5ec5f0b86053d62f57c9b5d13b44ad383dcb54d5fd0878e2a4821b78aa3969cb8b7d4c256a5d090330499c28317c85ed8a
SSDEEP 192:sxZcRPkl/fKstQZZNSzodpH3HW6+WNGYbIabYDlIgjhJ:sxZcul/fKstOZNpXHbGF4YNjr
TLSH
T16D42C7156E28A97B8CC7D20DFA55BF53E7F96033A0941E48A6FC8A1C14E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1b1402e340a99dd3864f5491a660bc3b757f9215a55ee07d5c0a033156e9577a
MD5 2a36939cf473d078e91e2f335427c8e3
SHA1 a57121bce13c78ecff9c69cef5245bc2cb48b34d
SHA512 8c9973056d416492a6378ccacc15c772afa4d7ba9f20d44e030b6cbd769a77dc050ab9f0e8464ab9e15e74b03500baf30ebf80dadded1b3f509f0b2ee9f18357
SSDEEP 192:sxZcRPkl/fKs8QZZNSzodpH3HW6+WNGYbIabYDlIg5YhJ:sxZcul/fKs8OZNpXHbGF4YNOr
TLSH
T1AD42D7156E28A97B8CC7D20DFA55BF53E7F96033A0941E48A6FC8A1C15E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 974806d3e65b5d2774ffa48fb30200a7c3da915afe7ea4a75ea85a68d853186a
MD5 b6e1f280d6890c5707902611366b20a5
SHA1 45a8eb4bb2869982bbb9f862f2429fdd451f5ccd
SHA512 b8fa5c0d5630079b74837c8d0aa855f55b83c6f16a5b6006783545f55fa92e3ad0d8ce4bf3bc48f685865045800a7bf84c2248c5c0a28238d29be7cf8ead8a41
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXIL/R:OtfFvpopPxrB4RhfIDR
TLSH
T1BCB2121571BA021138FE690C81B6872E064232B37158E63F7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 cf538316e1376f7a22bbde4b67def3c5a74e1f0d414eb7530cba498cf622893e
MD5 fb9c347ecc560e01e53f18cf4ce10a6b
SHA1 164d1ed56ae109399f759c7e9b8973359bcaf3ad
SHA512 9ff0ffa04af6c83bc58999b984f6248e8a9d9b17ff17d0f3ab01ed3e2cbfbfb88486b5eb77437c594ed060d03c287ecf73133bc46fb450646cf521a68d6ce16c
SSDEEP 384:n0qiFiZcI63sNb8TUNTUlIm25mg5FRnK2fMBxrN7JZ7O6R2FeoKgL/7IzmoJ:0hFQ63ywgSgQBxN7JZ7TROe
TLSH
T1E2C25B36EC99D9BBEDFB8F9AA74A3A47DEE00163859C49C0DAD84D1D009759D030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3ea78c40292c711e6b9d0d837cb4d54b5d194402c588a53567528c6e4c860e6e
MD5 9c947fdb38b78c13614596779f0e677c
SHA1 dccb1b32779b41255060b273a21b26f2545f2e7d
SHA512 613c05dd485e3403a0deb6649f47fa559040eb050a5f2d2a7a2d0950e9aa5a6f735e5ce5e32dcc6173cc30a49e2924f24f706a1163b3ffb18b1edcb33248bf12
SSDEEP 384:nLiFiZcIrI3sN68TUNTUlI4h5mg6SKooK2fMBxrN74untgOIwZOyE5gL/7IzGor:mFQM3XwgF/oBBxN7XnXsw4
TLSH
T1B6C26C32E894D9BBECEB4AD5B74A7A43DEE0016389DC9AD4DADD4D1D009B1DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fe9447e29bcfa20f009f0df76d7b775bd5e7cfca161f18f77c8e7263bfbce14c
MD5 6ee1dbb796ffa53799f4e21798b75bbf
SHA1 2bfafa012d09beb27312fa62bed43d818e8ad0da
SHA512 0a4c37e96e5d7671f0ba2bc85c17567fee39faf90b7cb8eb8785499cdc7464dbe2dca57da89fd48cf0bccf24de05cdf4b57ecb2068c5fdf40a8120099fdbfaf9
SSDEEP 384:n+qiFiZcIi3sN68TUNTUlI425mgsSKooK2fMBxrN74LntgOIwZOyE5gL/7Iztor:+hFQi3Xwg81oBBxN7cnXs74
TLSH
T130C25B32E898D9BBECEB4AD5B74A7643DEE0016389DC9AD4D9DD4D1D009B1DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7960aa7c9d026ff23118e33c308f70c35c5bd784e01e957589046e914ba4151a
MD5 dcaee1eccf1c5b7ea7bff85d44b18499
SHA1 8ff5104a6fb70a05a4023c5b813d7fec638b49cb
SHA512 14cbc55f47de2187a5d6292f08e65c0e07228e2858ee72606c687a2fe3cfe7f84a19615696e559fe5c0094921e62074c4d61f66eaf73b8181424ee1cd141a5c5
SSDEEP 384:nQqiFiZcIi3sN68TUNTUlI4h5mg6SKooK2fMBxrN74LntgOIwZOyE5gL/7IzGor:QhFQi3XwgF/oBBxN7cnXsw4
TLSH
T1B8C26C32E894D9BBECEB4AD5B34A7A43DEE0016389DC9AD4DADD4D1D009B1DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b4d3b65df2ae9bf2ea4325ea8cc4ae4c6cc369cc5dca254019b82a184b6bb748
MD5 86c2ae1e65441eeb11aec4761995fbcb
SHA1 e39055b555fac4cef95bae4c4b3fa4fff0190a5e
SHA512 64df3b10152222185d57e7379a5c3fd91f1356d864a4e99d5088b63ded7801bd81806f01afebed53a8dfe312d025a941e7670cb2aa4bc075582cfa6f99463471
TLSH
T1BB412A58AAE91108B3B76F9AABF6986E487FBC772E07D15D10110E4F0622B40CD71737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/540-197-0x00000134328E0000-0x00000134338E0000-memory.dmp

Download