aa44a8e57c16da00c8e23664130dfad3cf85c87fba5234780c6489eba01c066a

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pdfko.html
Size 72KB
Sample260705-algthaa14j
SHA256 aa44a8e57c16da00c8e23664130dfad3cf85c87fba5234780c6489eba01c066a
MD5 7ac702319eb884ddef629e19a761262a
SHA1 f5c73379583fc89aea2ae566fa5def4763dbd0c3
SHA512 b3903e37f654b21ab03053f6c0fbca11338200d62032c34c39ec74c7cb1af97fedca1fd54a5604fda7f341ef729613013f9287ed35e3c42065eab06d91f7e89e
SSDEEP 768:yipnLra/jP91L+yeWsf2uO22r92J7TTRLiP:y4rkL91L+ydwbf2r9svTe
TLSH
T14D73F54DBE343DC59A5E6DBC9D6B22441190D92B7AFB4C6383C60A74191A4F8BCCC2F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4944	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276842804801132"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{A15CF90A-2AA9-40BA-8193-18E1CB3C434F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5380 wrote to memory of 4072	5380	msedge.exe	88
PID 5380 wrote to memory of 2452	5380	msedge.exe	89
PID 5380 wrote to memory of 4944	5380	msedge.exe	90
PID 5380 wrote to memory of 2452	5380	msedge.exe	89
PID 5380 wrote to memory of 2452	5380	msedge.exe	89
PID 5380 wrote to memory of 4648	5380	msedge.exe	91
PID 5380 wrote to memory of 4648	5380	msedge.exe	91
PID 5380 wrote to memory of 3468	5380	msedge.exe	92
PID 5380 wrote to memory of 3468	5380	msedge.exe	92
PID 5380 wrote to memory of 3468	5380	msedge.exe	92
PID 5380 wrote to memory of 900	5380	msedge.exe	93
PID 5380 wrote to memory of 900	5380	msedge.exe	93
PID 5380 wrote to memory of 900	5380	msedge.exe	93
PID 5380 wrote to memory of 5912	5380	msedge.exe	95
PID 5380 wrote to memory of 1832	5380	msedge.exe	96
PID 5380 wrote to memory of 5912	5380	msedge.exe	95
PID 5380 wrote to memory of 5912	5380	msedge.exe	95
PID 5380 wrote to memory of 1832	5380	msedge.exe	96
PID 5380 wrote to memory of 1832	5380	msedge.exe	96
PID 5380 wrote to memory of 3092	5380	msedge.exe	98
PID 5380 wrote to memory of 5772	5380	msedge.exe	99
PID 5380 wrote to memory of 3092	5380	msedge.exe	98
PID 5380 wrote to memory of 5772	5380	msedge.exe	99
PID 5380 wrote to memory of 1692	5380	msedge.exe	101
PID 5380 wrote to memory of 4388	5380	msedge.exe	105
PID 5380 wrote to memory of 5072	5380	msedge.exe	106
PID 5380 wrote to memory of 468	5380	msedge.exe	107
PID 5380 wrote to memory of 1916	5380	msedge.exe	108
PID 5380 wrote to memory of 1916	5380	msedge.exe	108
PID 5380 wrote to memory of 3168	5380	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\pdfko.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffabd46c188,0x7ffabd46c194,0x7ffabd46c1a0
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,2691188240604892102,3495350604885134836,262144 --field-trial-handle=2144,i,4012721695088791026,4161408904687576194,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,8982217751692664883,6925583446629156830,524288 --field-trial-handle=2144,i,4012721695088791026,4161408904687576194,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,4632049784661370982,6990492570669598195,524288 --field-trial-handle=2144,i,4012721695088791026,4161408904687576194,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:13
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,10347815990881954045,15703265006119189275,2097152 --field-trial-handle=2144,i,4012721695088791026,4161408904687576194,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,3061677896274510831,17477773383456107300,2097152 --field-trial-handle=2144,i,4012721695088791026,4161408904687576194,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4388,i,14457329858756924395,17301271878465978327,2097152 --field-trial-handle=2144,i,4012721695088791026,4161408904687576194,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4404,i,7638952726004532214,4981683374879469842,2097152 --field-trial-handle=2144,i,4012721695088791026,4161408904687576194,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:9
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,2272679683582908174,15677968409467627031,524288 --field-trial-handle=2144,i,4012721695088791026,4161408904687576194,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,2440297190357519359,572153860403195290,524288 --field-trial-handle=2144,i,4012721695088791026,4161408904687576194,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,17175287345646189060,1075922937621326218,524288 --field-trial-handle=2144,i,4012721695088791026,4161408904687576194,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,17175287345646189060,1075922937621326218,524288 --field-trial-handle=2144,i,4012721695088791026,4161408904687576194,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,590198280259920956,8712416570120422487,524288 --field-trial-handle=2144,i,4012721695088791026,4161408904687576194,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,9186418081446130902,147773537112675814,524288 --field-trial-handle=2144,i,4012721695088791026,4161408904687576194,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,12215578871064072047,178409465432586338,524288 --field-trial-handle=2144,i,4012721695088791026,4161408904687576194,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,4732216731882555782,6324795905962317523,524288 --field-trial-handle=2144,i,4012721695088791026,4161408904687576194,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5632,i,18179879530307039620,849272769065366842,262144 --field-trial-handle=2144,i,4012721695088791026,4161408904687576194,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
MD5 df62623cabc43e309a7767f4081f29d9
SHA1 420f1a4b11b86944a73d3cbcd4aec4883dfdfd62
SHA512 02067a08d194a87842f985ff7d0bee13c7b7228146565bf19114ffaebc120cb3d2ba8b19c941bb0d2773043366f064246a55efd57127d4a0de5768f453b2730c
TLSH
T1FDD08035774DFD08C18054717890D3517A204460345AC3186329A01DDDBC68513DF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
MD5 b2c496fb89251ff9b8ff1c46a5315932
SHA1 19626950ca3b280d084016871229a48eb3fa5ffc
SHA512 bbd974e4a08ca8f629f0b9a8892ba78ac7d4191c1640d1037e4fd018dadb4d8edd0a663e4a673a29497151c4defd9be09b6a4a4788adf24b182cbc36b18ccda7
TLSH
T1C5D08031774DFD08C18054757890D3517A104460245AC3186329E01DDDBC68513DF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f2351792c671037f17ee47ebf321e1014d288e7af6711ec387615a6b9e7f062e
MD5 3fd5ec9a7cf6699a050ba13f8e0494a1
SHA1 b7d19e380a174afcc8fba25e2a3fe1d008a49f2b
SHA512 ca41a2bc1dc9cb7eccc6fd19da972fd121961cb41715209a9528d308f4971e2a8e03d3072f2c30450a4f01d2701bdc50c5457828605585b69f12626b52828217
TLSH
T19451630D29794EBDC76555BE81E300B4FF78BCA25E076E1413CF90787B27700A8A3A21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a668.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a668.TMP
Size 3KB
SHA256 820c79e79cde87a950d42b0304f0be4f9ee6977f140567a9bf32259b0a9fa056
MD5 818f91d7653d45e5d7f5df080d98df21
SHA1 b96be3298b7bb714c1ad9963507c4dec394cfdde
SHA512 d892c8c2bc4a5f45ae9c67e34bbd63e6940d9b93fa3280a1677f8668dd332d0a20b2de6f111e3c06d2c2dd725297bfb986cb8d5969d93cd51ef94f80534f74e1
TLSH
T1D251520D29794EBDC76555BE81E300B4FF78BC625D075E1413CF90787B27700A8A3A21
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e27d30c05260982c668da091948f446c09b61ae8e6f9cec0cbdcaab963d19e45
MD5 14707d5c07535673625ca895a31e3767
SHA1 04fab4d098c8ef001b54149da628f4aef054d99e
SHA512 9191c6bc833f556fe352da51c3d34441a4f4c5edb6973769c021c3215a04207fb3ede7b173563964118b930d62dc50ef7dbb767d20c680ec8532b10a365876a1
TLSH
T11351ADF7C3E8856ECA0186F4BA147E1BCE1D0915832C3D5AC9E4AF1BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d6e064d0-917d-4ff9-b5d4-068e33cc855e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d6e064d0-917d-4ff9-b5d4-068e33cc855e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 401062c64fdd50e65bd2dd348c44670ae32744d13c714a6ef74cb6ed827f0c72
MD5 037e1f25a2807a3c800dd24f453eab3a
SHA1 a69305c52db077ca2235d8b08c447eac48a373d8
SHA512 7a02ca20d6e1e5404f80ea1d14444e7b1e3603adc0deea438c243afadf0bc6230e24202865cad25415718ef6684bab8c29156c6f1c387329d101e7afd9575fb2
SSDEEP 192:sxRlRqyM/jK1Ml8wFP/fnsRKyoozoA8p4F/g6+WNIY4SAe0KGmIgIJ:sxRl0bP/fnsRLCg/5IFe0As
TLSH
T1E252EA1565645937CCDBD20DF955BF53D6F85573A2901E08AAFCCA0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d057affbb14aba00bb819929a1ba26079a855e9731c5ef56bd6f6039c24ea9a9
MD5 09078ed5552c8fdcfc4fd96c5fdecd28
SHA1 aa48e5833893b2258f4fb554b9d9e3ddce20905c
SHA512 92fe253ec96cc3c59bdc6b6dae25e0e9a102a434582d94e677fc24f9066b6f001983462fc842d8bf069b771751a6b9e7a23b493a3af0153d27d28479698a0d2b
SSDEEP 192:sxRCRqyM/jK1Ml8UQHFP/fnsXKhoozoA8peF/g6+WNIY45Ae0KGmIgDwJ:sxRC0qlP/fnsXIC2/5Iue0Ao
TLSH
T13C62D916A96459378CDBD20DFA55BF53D6F85573A2901E08AAFCCB0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 97d97474c043dde626c29c643745cd441bdbb0c787641363ea6a8fa710b91eed
MD5 4f3fd4c038995889db6eda61e19c3643
SHA1 ecf1a1d715a335709ac3281e9c462a6febd03031
SHA512 efd5377d9725a2fa677dc38e3a01de4bc35226f41bf0654f3f3d831bed211c373bcf809e04fd307882b2c1e0d0183f07375c9d460ebd04aedb5b0b7f6a15a2a7
SSDEEP 192:sxRCRqyM/jK1Ml8wFP/fnsXKyoozoA8p4F/g6+WNIY4SAe0KGmIgDKJ:sxRC0bP/fnsXLCg/5IFe0Aq
TLSH
T17A52DA16A56459378CDBD20DF955BF53D6F85573A2901E08AAFC8B0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 50ff9c60da02e925cff032c50625ec76d711f5c2692f5014c47d3e387dbf3c06
MD5 1e5c89c73af58aa8a1d2dc621b34dd7c
SHA1 695616b0fecdea86dffdb7cdeb38de69b795342c
SHA512 987b1f6d86c22258094cb847d50726754de74a5b74ced5a890bd58052a5c6223d81827964243a5ddd95d29161f7f28367d581f6316f3ed9b8fc0a151edee21a2
SSDEEP 768:Tqi0E3WgNxfez8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtXNGRroKTyFf:Tqi0E3WgNxfezu1ja49Gq1
TLSH
T103C2FC2B644CC77E4F804E9DEC2AAF976DD801CB97988D544BEA890C03C77EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

85cbe0ff-df57-4e80-a2a4-b5d9ff73c311.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\85cbe0ff-df57-4e80-a2a4-b5d9ff73c311.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 0f1cc851ff60e3caed0580b0b1c7740f6dd29087add57ddb412123487e1a89c6
MD5 e2735a255d4d13f86bde313203dbf0f5
SHA1 beb68c51e9653726c84d510f0f30c0a61a62d634
SHA512 1f06fb03d6bb4b008cc22648208b224145d90c69132da7aa7eb98f493bb2e2da1d49101102dedf87821d1ba30de47e7f65551e1f4c3fcb84306b48deef6a2ce8
SSDEEP 768:2rv+4UNbdN3eKE8thhVUd+AW+152MvSCai5j+8rir1:2bsbP37Mdpx2pajDriR
TLSH
T1EF13BE32E8AAE973CDA6CAC4B64B3653AFB0514385C50B94CDDA2B4D028B5DD130FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 29f324821406c38f44b2b5c2dae278c6bccb7276be58955d30910475b64a0dcf
MD5 1f176f99e17c3ee218c215187931ef3e
SHA1 15fd5e5693863933fbbf80d86e92873fe6cbe1ae
SHA512 82e7064860f7c927441fd1a82d187add968d64bd045e0e8a41dace9f40739f5cd251cd0ac869a205597d9c1ec8fc27cd04e4623eb381e34c5a592420c68c3932
SSDEEP 768:Jj+9L3AU8thhVUJ+AW+152MvSCai5jb9M0d:U9L3A8Jpx2pajb+0d
TLSH
T180F2BE32AC9ADD77CCA2C6D4B74B3756AEF1425785851E84CDD9AF0E02C768C434AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b59d816c96e2ea2496e39097d348062ecec47d168dd09114bc631aeccb261785
MD5 9fb234cae060ff4cee34749cf2777ec4
SHA1 00fde25c37bb668afc6ddf110339573c4df088a5
SHA512 9dd9ffea68a236a4f66c65d7962422d11ebf1ae13bd9e50e55543fd409f31101309bd05ffc46b8689c26f87d32b813d78623c9fd517b877ef1bfef3511307fe9
SSDEEP 768:rj+9L3dU8thhVUJ+AW+152MvSCai5jb9M0d:+9L3d8Jpx2pajb+0d
TLSH
T178F2AE32AC9ADD778CA2C6D4B74B3756AEF1425785851E84CDD96F0E02C768C434AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 8e6892ccc123bd86096d71cdb0483e77290179bb4556e502de4a293df2b150e3
MD5 d993c38cc3cecac44acc93ac4fd3f7af
SHA1 3c941ab54b1d25ee5192b7658cffd0ec41821e24
SHA512 7400d70c6df5026c0bdb06e081abe127bcd07d01122fcee25b9f4aab9b577559c16ff2eb17fb63ef99f514ddcf87a66580997a959def00560174f8a0e2f83f17
SSDEEP 768:SF1j+9i35wgWU8thhVUe+AW+152MvSCai5jb9M0d:n9i3O8epx2pajb+0d
TLSH
T11C03AE339C89DD7BCDA68BD4B75A3756DEF10297C5851E94DEC9AE0D02C718C038AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1a6185c2ae5106f7ffa9ad40bbfb8539996987c1d362c566759034536aaa25c5
MD5 3ba1e49aa0435f0f228438aa6924309a
SHA1 26b7e72d3cbf300e7e30630302994207ddd918fb
SHA512 35805676f4ea8bcfa87bc41fdc6a86841888087150238da7fee3bdc6f83ea0602b2568eb8f8a208cad61e1cd5de2ad19fa6eec60648b57ab0fb674a6126eb64f
SSDEEP 768:Arv+4UNbd23gPthhZ+AW+152MvSCa2GP+8rir9:Absbs3Opx2pvPDriR
TLSH
T12403BF32E8A9A973CCB686C4764B3613BFB0519385C10B94CDD92B4D429B6CD230BD77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a469c1a2-f640-463b-aad4-659eda873aaf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a469c1a2-f640-463b-aad4-659eda873aaf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download