4930f5849f98081e806cc1d0217c9403950ac78b6463c4d3603a14ec76f84625

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 19:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nadekobot.html
Size 286KB
Sample260705-xslscsfs2t
SHA256 4930f5849f98081e806cc1d0217c9403950ac78b6463c4d3603a14ec76f84625
MD5 c39d09f88d259d2dec42ea06f539899f
SHA1 2a947b13e628bcaf145c96805f527771a40621b7
SHA512 4d013623e27d054fb1ff73899024f5996e8258dcd96dc085aaa2cd85b2a86231677fb2ac09f9eae798cb643e675f58c69c5198c9a05e7fe8c4f36acbead1a9b8
SSDEEP 6144:YNU14KhfpZwz/JZI7xqdn5pjUsvVm7MVqWX8ijE9WcdReJ5PTQYbeHxHA7op9hrb:OU14KhfpZwz/JZI7xqdn5pjUsvVm7MVa
TLSH
T17754C470B178617E011B1689F270A718A35BF31AEB4951E1BA3FE6F497D3CD0EA93058
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4996	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277520360228784"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{D5F95E1F-788D-4557-8EE0-CA74747E51A5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5524 wrote to memory of 4972	5524	msedge.exe	88
PID 5524 wrote to memory of 4996	5524	msedge.exe	89
PID 5524 wrote to memory of 4048	5524	msedge.exe	90
PID 5524 wrote to memory of 4048	5524	msedge.exe	90
PID 5524 wrote to memory of 4048	5524	msedge.exe	90
PID 5524 wrote to memory of 4744	5524	msedge.exe	91
PID 5524 wrote to memory of 4744	5524	msedge.exe	91
PID 5524 wrote to memory of 4324	5524	msedge.exe	93
PID 5524 wrote to memory of 2560	5524	msedge.exe	94
PID 5524 wrote to memory of 4324	5524	msedge.exe	93
PID 5524 wrote to memory of 4324	5524	msedge.exe	93
PID 5524 wrote to memory of 2560	5524	msedge.exe	94
PID 5524 wrote to memory of 2560	5524	msedge.exe	94
PID 5524 wrote to memory of 4644	5524	msedge.exe	95
PID 5524 wrote to memory of 3324	5524	msedge.exe	96
PID 5524 wrote to memory of 4644	5524	msedge.exe	95
PID 5524 wrote to memory of 4644	5524	msedge.exe	95
PID 5524 wrote to memory of 3324	5524	msedge.exe	96
PID 5524 wrote to memory of 3324	5524	msedge.exe	96
PID 5524 wrote to memory of 4952	5524	msedge.exe	98
PID 5524 wrote to memory of 1648	5524	msedge.exe	99
PID 5524 wrote to memory of 4952	5524	msedge.exe	98
PID 5524 wrote to memory of 1648	5524	msedge.exe	99
PID 5524 wrote to memory of 1084	5524	msedge.exe	101
PID 5524 wrote to memory of 2348	5524	msedge.exe	105
PID 5524 wrote to memory of 3156	5524	msedge.exe	106
PID 5524 wrote to memory of 5772	5524	msedge.exe	107
PID 5524 wrote to memory of 5308	5524	msedge.exe	108
PID 5524 wrote to memory of 5308	5524	msedge.exe	108
PID 5524 wrote to memory of 2428	5524	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\nadekobot.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d0,0x7ffa2b6ec188,0x7ffa2b6ec194,0x7ffa2b6ec1a0
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,5123947262512724622,12915044213709080949,524288 --field-trial-handle=2276,i,7167684709952573137,16588980635991454753,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,13998134647290427415,6233145334241323137,262144 --field-trial-handle=2276,i,7167684709952573137,16588980635991454753,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,12565835839224795867,10322438335521623751,524288 --field-trial-handle=2276,i,7167684709952573137,16588980635991454753,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:13
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,2939367078561459713,18222936576239066892,2097152 --field-trial-handle=2276,i,7167684709952573137,16588980635991454753,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3656,i,16231320891888921137,64655797556803686,2097152 --field-trial-handle=2276,i,7167684709952573137,16588980635991454753,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,11661315686839572199,10113878395266454597,2097152 --field-trial-handle=2276,i,7167684709952573137,16588980635991454753,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:9
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,9163638457978057205,1010115066926139984,2097152 --field-trial-handle=2276,i,7167684709952573137,16588980635991454753,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,4329134596299709987,10439125866507143874,524288 --field-trial-handle=2276,i,7167684709952573137,16588980635991454753,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,7828601753896894286,2897230905389666260,524288 --field-trial-handle=2276,i,7167684709952573137,16588980635991454753,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,10349826533866355102,7537749881185056245,524288 --field-trial-handle=2276,i,7167684709952573137,16588980635991454753,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,10349826533866355102,7537749881185056245,524288 --field-trial-handle=2276,i,7167684709952573137,16588980635991454753,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,10365690704699009030,1192772725973590888,524288 --field-trial-handle=2276,i,7167684709952573137,16588980635991454753,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,8527584491455407473,1727452679217627942,524288 --field-trial-handle=2276,i,7167684709952573137,16588980635991454753,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,2222671305203756809,14057742884933886511,524288 --field-trial-handle=2276,i,7167684709952573137,16588980635991454753,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,6319988348254380276,12914333680529787503,524288 --field-trial-handle=2276,i,7167684709952573137,16588980635991454753,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,12662706101157005344,14778491672427079593,262144 --field-trial-handle=2276,i,7167684709952573137,16588980635991454753,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8a20505d41bdd237cd6adca65cde17bd8d521124259b18c7b306bf9b1f2da5c9
MD5 178ecc497236e1987a17fd0dcf07ed62
SHA1 ac77456887a7673ee0a2a1814e858b0e285627ff
SHA512 731ee33d274eaff89804f849b01ee540593b493cb6116dd81763a4988b45e9386d7fd747d6bacc87d24b96a18d07cf1e730b717ce4d04660a3967dc6a6b1ebf7
TLSH
T13B612A5C1F5539A6C32A65FE31E357AD37B0C096878B7E07C087A07D48D570EA08A832
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59097c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59097c.TMP
Size 3KB
SHA256 12bb99ab333c999f09d260bccd49d5c0f306244b320a94e5bc60f2af51dce330
MD5 904811039c0c0d539d079dd0c4a6e1c5
SHA1 98c17a6db4d507f955f63b126dc038c60c174b6b
SHA512 f3e4845e82d678f18290f3df8384c2c42abe5ae8817b86eb50409ab2e3ba42a9d130945e774e63fcea93f8d7aa3b6afb458b93f0d36b43f6bf4d8e32e2920468
TLSH
T1CD612B5C1F5539A6C32A65FE71E357AD37B0C096878B7E07C487A07D48D670EA089832
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6b10e0d9f4cccd097dc31f2d9417d11ddbfd16960346b4ad73b29215edd52916
MD5 12573cc351c9e76f0ec6d0f4e8947a77
SHA1 c99ae11b927ff09d49ab7f5319d51873355f8518
SHA512 9a83fbc2d8549f113e06c92c297813cf06424d60f1e879933e1c8376554268026e479e732817c857fa498c1baae93dfe944a1e67bac368e48b95888c9881a492
TLSH
T10051ABF7C3E4867D8A0156F0EB146E2ACE2D0516832C7C5A89E4AF1BA3E2471E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 16ceb2c4fdcd5225190447a5074339f759c717f66535cb59803de525242dc120
MD5 efd387cc90918ea7041a455b17ce9ac9
SHA1 61d289ee0ad53ccff192f4fb194246e2fdfcc84c
SHA512 08fbf268009b93b561aad59502d84298c67669275c68ac4a24e33629fc2b0b527a44047e876417c0d7d30ba6ca7664aecf8932a4afa55dc2bff822699b7d95b3
SSDEEP 192:sxRFRqyM/jK1Ml8wFG/fgs5q4dfCr/zoA8p4n/g6+WNIYyNJzGqIgIJ:sxRFMbG/fgs5p4Wy/5IZXs
TLSH
T1FC52D9156638997B8CCBD209FA517F53D6F91573A2901E44AAFCCA1C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 62c7242e8ff6c84454f54afb3bfe977eb08358b4470473e0c160356a07391a95
MD5 5e8811213f77910f273b3a2252390f5b
SHA1 0f90107546ea586318d234600f4e2f893f77240e
SHA512 ebab6c5eeb4aaf66a8f67d23c5aa44b8aa57e42c1f12d3e38ec971d18040f4bd8f4d3e0b0034f0169eae42bd9e45450683867d563596b981d4a15e41e4925c24
SSDEEP 192:sxRKRqyM/jK1Ml8UQxFG/fgsakqWdfCr/zoA8pen/g6+WNIYyqJzGqIgD/BuJ:sxRKMq3G/fgsakr4WM/5IWX96
TLSH
T18462C85669389D7B8CCBD209FA517F53D6F95573A2901E04AAFCCA0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e84c05447affa7e870f39a945fe1b1edc95d791519141bf07a5a603b16e13159
MD5 5cc3d613b4fead19e4938c7c06f09b21
SHA1 f43d969d7bc4f336c8468a1199dc04f2608ae3d3
SHA512 e3fca23411c31c8f1f33e30e517b14ba492325ec8b58ab05889468d3f3f89261f6468097ca97941305d247b406aa6b30cbb4c435b43976dbb21053ca11523d4a
SSDEEP 192:sxRKRqyM/jK1Ml8wFG/fgsakq4dfCr/zoA8p4n/g6+WNIYyNJzGqIgD/BMJ:sxRKMbG/fgsakp4Wy/5IZX9w
TLSH
T19C62D9166638997B8CCBD209FA517F53D6F91573E2901E44AAFCCA1C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c1318ae67c3e4f02dc97475c14b26de0fc8feb2fba7a8a52edbd5c3be3e5d2d7
MD5 fb47b086a292117340f28035c8500f87
SHA1 484f002ca98ffc076c28a8c8d14baa6521d68351
SHA512 f224c1906e30cdd4717b327587ae32e71de5b7ac885b3d795b9eadafea5b8d12b8da2c648dfbfc4791731737ec24d7e71e9c161b975a6d1a3c770ba62ec0653e
SSDEEP 768:AIox30WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOcciOro5KlvZ:AIox30WguMfnAu1jazXiF5Kr
TLSH
T10BC2EB3B640CCB7E4F845E9CEC25AE966DD801CB97988D5447FA890C03C77EB921A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 11a7ec315d175506b06c8c1982aead229a6ccd4b3ae77244e1f4f9bde0a090cd
MD5 038d664596c5123e97e5bc804e3b2ff1
SHA1 a9eebdefffd62adc331bd57e9aaf07cbf66b486b
SHA512 d703366b94c553e5dfb489f95602a9071c315fc1d1ba6416b942e8a3e68e526fbdda706e21044ab0d4e36b9b7fdedc03d32841ddf947d38f1aa6517518c6dc53
SSDEEP 96:KYjaKowzSy4K7KNU1gkeCGEWCPvgsEK4hgmEcEkveEZHT8ZNbRRtz:UcX4U1gkeCG7CPYs4hgmrEkveEZHT8Z3
TLSH
T101915201357F1784397D250986B8D46F87827462309AE46B3BAE61A12F2BE105FFDECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d99896debd2fcd6410966fb3970a42c443f6d12e33c8af464624ede862f7126e
MD5 f20b98897ac2ca1b7361c1063883d17d
SHA1 a55fb2fa4dbe1666b148941c7ff64204a6796aca
SHA512 6da0262fb5b6573b4badf9cfba385bde59b401437a76c5bfd9bc23e811c75211f1aef9cbe7326fb759567a891cd12bd5348bfec99acfc4435791b85943e558df
SSDEEP 768:mj+9t3VLKZSQOJIFDs/hUAFjQIMyOV3N5E9EBlb9Mj:19t3dLhNFUIpONNmOb+j
TLSH
T19AF2BE32B8A5DEA34CE7C3C9771A3253AFE0026B85C51D84D9DEAB0D42872AD0347C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f975d98685c317d1f79eb7eee05f1a378a06e948e822eece124c756c8bc605ed
MD5 61a79187d9f836d8bec1ad5451752302
SHA1 11d77150e3e6ebb0aa3e7019a951c281ee125d9f
SHA512 80c12a47aa7492f34e5ec893004f0a03feec612ee021ca4973726876ea5f71d8451fa74ca95d3417c663f3915315d7412cbb02a9e0196f64ef25799b772a03ba
SSDEEP 768:Yj+9t3iLK5SQOJIFD5/hUAFjQIMyOV3N5E9EBlb9Mj:H9t3QShNFUIpONNmOb+j
TLSH
T172F2AE32B8A5DFA74CE7C3C577163257AFE0026B86C51D84D9DEAB0D068729D4347C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 611b8da226bf904d396b5bed5fffc7c44e94613dbb9739aab06ebf17e7a057bf
MD5 578fad233b8308e999aeaa993760dc9e
SHA1 d366436c1f453c760a86b9ecbee6374539113fd2
SHA512 842c3d5837b2bc9571eb97025fd8ed7704899ff6fe40ce236fc1cd3564a089f8cd63646c13220baa8e202ffbccc09ff846036a88a87e675d21e768480f2eae17
SSDEEP 768:/j+9Q3iLK5SQOJIFDi/hUAFjQIMyOV3N5E9EBlb9Mj:y9Q3Q5hNFUIpONNmOb+j
TLSH
T16CF2AD32B8A5DEA74CE7C3C5771A3257AFE4026B86C51D84DADEAB0D06C729D0347C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0fee6bceb5e03dc936c287f8720139d66f3e8da81a7c5ed9da1706c0b8c47317
MD5 5c5fc7df848056f0eb1cb72005a1edf3
SHA1 d51d55ebec949668bc0fd713fbb15f7660ae8a39
SHA512 fa481e25cc3bf09b0fd51fa59cdad18bafe949280f613fc803bf2f5516110cea6c466bbc1b7847d0a0e7906f991559507847b42cd68fb053c6aaae8367f07fb2
SSDEEP 768:9rv+4UNbdF3W1WQOJIFR/hUAFjQIMyOV3N5E9M9a+8r0mL:9bsbf3ehNFUIpONNm5Drv
TLSH
T19003BF31E8A8DAB79CE7D6C9760A72537FF401A395C10A84C9DE6B0D824B1DD231BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e089b52-517b-48ca-9ad9-cd950db61b5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1e089b52-517b-48ca-9ad9-cd950db61b5e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download