eaeb2177c483106c32b4f495ccf5f00e623eac3dac96fbb9559055d4db642a8c

Resubmissions

20/07/2026, 13:29

260720-qq99lsdy618

20/07/2026, 12:58

260720-p7lf5saz3l6

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 13:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DeepWarden.html
Size 249KB
Sample260720-qq99lsdy61
SHA256 eaeb2177c483106c32b4f495ccf5f00e623eac3dac96fbb9559055d4db642a8c
MD5 2da35fc99f07efedef2ac7917488f947
SHA1 37b42d1494b280a6e756b9f5388544e798675704
SHA512 6e0bf6d4fe50fe3a5318efb5aea7585344df8a0f61aa6d3d114eb207c2f1976e7034fbc70c9ceb0f5251125ee84052c32624a639635676d921db301bee8ee30c
SSDEEP 6144:J7UPTWxfprwz/VZIdxqdnLhjUsnVm7MeqWQ8Wz09m3dMeJ5PTQYbeHxHA7op9hrY:FUPTWxfprwz/VZIdxqdnLhjUsnVm7MeG
TLSH
T1FD44B570A178657E012F268AF670A718D36BF31BEB4951E4B93F92F497D3C84EA43058
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
41	camo.githubusercontent.com
43	camo.githubusercontent.com
44	camo.githubusercontent.com
45	camo.githubusercontent.com
40	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1760	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290277641335637"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{BA19C667-C736-45AF-95F4-6045E3A0F724}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4652	4776	msedge.exe	89
PID 4776 wrote to memory of 1944	4776	msedge.exe	90
PID 4776 wrote to memory of 1760	4776	msedge.exe	91
PID 4776 wrote to memory of 1944	4776	msedge.exe	90
PID 4776 wrote to memory of 1944	4776	msedge.exe	90
PID 4776 wrote to memory of 3696	4776	msedge.exe	92
PID 4776 wrote to memory of 3696	4776	msedge.exe	92
PID 4776 wrote to memory of 3260	4776	msedge.exe	94
PID 4776 wrote to memory of 3260	4776	msedge.exe	94
PID 4776 wrote to memory of 3260	4776	msedge.exe	94
PID 4776 wrote to memory of 5792	4776	msedge.exe	95
PID 4776 wrote to memory of 5792	4776	msedge.exe	95
PID 4776 wrote to memory of 5792	4776	msedge.exe	95
PID 4776 wrote to memory of 3064	4776	msedge.exe	96
PID 4776 wrote to memory of 3064	4776	msedge.exe	96
PID 4776 wrote to memory of 3064	4776	msedge.exe	96
PID 4776 wrote to memory of 2956	4776	msedge.exe	97
PID 4776 wrote to memory of 2956	4776	msedge.exe	97
PID 4776 wrote to memory of 2956	4776	msedge.exe	97
PID 4776 wrote to memory of 2140	4776	msedge.exe	99
PID 4776 wrote to memory of 3412	4776	msedge.exe	100
PID 4776 wrote to memory of 2140	4776	msedge.exe	99
PID 4776 wrote to memory of 3412	4776	msedge.exe	100
PID 4776 wrote to memory of 908	4776	msedge.exe	102
PID 4776 wrote to memory of 4536	4776	msedge.exe	106
PID 4776 wrote to memory of 4484	4776	msedge.exe	107
PID 4776 wrote to memory of 3460	4776	msedge.exe	108
PID 4776 wrote to memory of 2888	4776	msedge.exe	109
PID 4776 wrote to memory of 2888	4776	msedge.exe	109
PID 4776 wrote to memory of 3792	4776	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\DeepWarden.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff9fc45c188,0x7ff9fc45c194,0x7ff9fc45c1a0
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,1952034549717637739,6055021483633459679,262144 --field-trial-handle=2232,i,13611033722384196535,10940800683562160986,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,11833027327570352257,17779567834425216472,524288 --field-trial-handle=2232,i,13611033722384196535,10940800683562160986,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,17955482415219418877,15466762506535296595,524288 --field-trial-handle=2232,i,13611033722384196535,10940800683562160986,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3700,i,16370805966300325500,16896262930282072011,2097152 --field-trial-handle=2232,i,13611033722384196535,10940800683562160986,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3708,i,12893920525738979762,9440709497146004302,2097152 --field-trial-handle=2232,i,13611033722384196535,10940800683562160986,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,13644326899424947651,10498085645218291045,2097152 --field-trial-handle=2232,i,13611033722384196535,10940800683562160986,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,6380130167610384522,17578596580408836833,2097152 --field-trial-handle=2232,i,13611033722384196535,10940800683562160986,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:9
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,10552717503288872864,13677847082386192873,524288 --field-trial-handle=2232,i,13611033722384196535,10940800683562160986,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,9469780842511112453,11790759259576155866,524288 --field-trial-handle=2232,i,13611033722384196535,10940800683562160986,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,14259081808358042862,9941197797219062192,524288 --field-trial-handle=2232,i,13611033722384196535,10940800683562160986,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,14259081808358042862,9941197797219062192,524288 --field-trial-handle=2232,i,13611033722384196535,10940800683562160986,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,3999192885266962770,13576001677792699395,524288 --field-trial-handle=2232,i,13611033722384196535,10940800683562160986,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3024,i,10999768317970356795,6615666124171721835,524288 --field-trial-handle=2232,i,13611033722384196535,10940800683562160986,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,7341774820822699481,6676304330901243167,524288 --field-trial-handle=2232,i,13611033722384196535,10940800683562160986,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,6693375275858739178,16842497513716705998,524288 --field-trial-handle=2232,i,13611033722384196535,10940800683562160986,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6552,i,7613559015549475302,10914383225311835009,262144 --field-trial-handle=2232,i,13611033722384196535,10940800683562160986,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 d2c3360d080eb3a855fb6bc274eec3d969fa2ef5bf488d461fc9bcdb3caccf4c
MD5 a33e17406dc1d932884420ccea69a9a8
SHA1 7ca530bda07c61f80148269245fb4f065a81c20f
SHA512 ca8df6714a9af1938b7d18a18e01543436750ab440bbb2adf8114705057b36e7555b0d8012f16819a7fadbd87e14363cddcfaab7677bfd018825502d2ec5dd96
TLSH
T13D312394372409EBC7696EF591F48BE7333D8BB94A079E11C58473BD4D72BE5B012028
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a4467ac-35db-44bc-9a9e-e8f26660ccaf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1a4467ac-35db-44bc-9a9e-e8f26660ccaf.tmp
Size 2KB
SHA256 f25dc57b5afbea8a84159fe9b3af8dc2590a415af27e24ad200f2b1ed377f70c
MD5 5c2b9953623c49cdb57b4d3f91addc93
SHA1 28328022a86268289e37cb0e25258490b1c0f8a2
SHA512 e254bc4ae50421a443936d33a2cabc3260518293532f43435e8c335a758ab0852f77fb736b32d050d1a0b8f784828b75f4cb1d8c6849fb6c41932f5945b5753e
TLSH
T13B517CF783E4867E8A0156F0AB147E2BCE2D0516832C7C5A89F4AF1BA7F2871D14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0e38722665bd550d066c97aa8384947fc5d36850dd2f00fe2d5244ff2a5606b7
MD5 cfc0ae95f5c63dc7ea771940bc7633dc
SHA1 8a96d8f6a3a352c6ebfa69f83680080cbec406ef
SHA512 d5411fccf19c53310aa2f6907504a84223fc3ced525b96cb2ca96a62ed2af097301a206fda5485492e191647984d825e1ba18043807b68a79078203aa01f61ea
SSDEEP 192:sxRKR7bq/f8sVrYQ/HDzoA8p40/g6+WNIYZ7PKsgGXIgIJ:sxRK9q/f8sVrB/yB/5I6Ds
TLSH
T16F32A7166928993B9CCBD21DFB567F53E6F95032A1D41E48AAFC8A1C04EB6DE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 48d1a6f31b7a6586019338e00b6f3b4c5a19f65f885585ae0dd068b689f58397
MD5 0633730ca0d04a248758c6a1d5005da8
SHA1 6cc53fc0a3287f717fa4bb1187d4d429e40659d1
SHA512 766277c0e657a779f6b4f328224cfd50c7b5235ba97afb8c1d8527789f855ea755cd9d4e1899f173b5c04601ffa0c3cca1555732308dfd4b602834f4ac903591
SSDEEP 192:sxR1R7bq/f8sMrYQ/HDzoA8p40/g6+WNIYZ7PKsgGXIgDYJ:sxR19q/f8sMrB/yB/5I6D4
TLSH
T13A32B7166928993B9CCBD21DFB567F53E6F95032A1D41E48AAFC8B1C04EB6DE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 80230495ea506e825314a3f422bdceb9b606a22a657e301a12cdb4cb16eb4bfa
MD5 db7c3eccbd4425b82aaa4a6ec8e0620a
SHA1 dba34c9bbb7b50b5036872280cbe8220a9b80052
SHA512 0137dfa190e3ac8700d060b157667bb2aa281ef845314a4b989410fd0b41aa5310a69664539f5a2efdfd1a78bbf2194ba5aa7e799b7346f939705cb73e163aea
SSDEEP 192:sxR1R7bq/f8sMrGQ/HDzoA8p40/g6+WNIYZ7PgsgGXIgDqJ:sxR19q/f8sMrn/yB/5IODy
TLSH
T11442A8166928993B9CCBD21DFB567F53E6F95032A1D41E48AAFC8B1C04EB6CE120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 0655462debee2bade682a2a423bbc40812786f6348188e839752bb14396a868d
MD5 bedcf4a8455d7a44cbd9e48447177292
SHA1 448d77ec6c3865860175cd59cc5a956d138064c1
SHA512 85f4f2c23ef7262cbb61063f2931cc0862864078f90f68a4a055e3dca408680b3d4da4cfd3e445bc3b1e2358416ac2540a0a9ef92d242ab0df59e66aec64539d
SSDEEP 384:kyr2SGXfCtgdDFf/bKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA89VXR6wCroOE:ky2SGvWgd5f/b8F1+UoAYDCx9Tuqh0V+
TLSH
T1B5B2DA2B604DCB7F9F801A9DAC196FD67D9802C797988D4047FE990C03C77FA912A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 33f86be2198f09c76ca8ecb842f2801662159f6d6a4f51e1c7a88923585113bc
MD5 47185b26d009ce2ba76c9a315b9acc30
SHA1 a3dc29277f49791dd9036944d8921a6a1384fc59
SHA512 349c7e018811c37db3cb618316b1201211efcbbb1549d4afcde9b4185d1acd68b4021941ff57a6661a1265ab348247d837ff6d66be1575b4cf6da8988e51c084
SSDEEP 48:K2V6RF7PjkzPgPIgtkKpBxDkdl0KA7l5yF1I1K2IAmaI/KLScTy9:K0yAKb6CG16K2I5a4KLSKm
TLSH
T1859122D6727B42013CBD655C82B5CA5ADAC570B2705DA82B3BE811B61F6AF010FFC9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

e18980f6-48eb-4c0c-986b-716c122f4af9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e18980f6-48eb-4c0c-986b-716c122f4af9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 cf50459ee322c456d081373aed606dad8bf3400cbe0ec422fdadc3162cea1e32
MD5 06b83d84fc905348d13834d9d8776339
SHA1 ad8bdfb0a056fa6641e10f2811740bd799fbed09
SHA512 78ade4859fa0ca2bac45efa72be37ee4ebc91065de363a0b5df1aaf02253cc32bf235a4fcfbe33a912eed8c36b3c63ca0e75e058ebecb4977ff07c221e41e6af
SSDEEP 768:2rv+4UNbdd3MiAq5LALFRAam6aQMGdjWca4Ghf9tPMUQ:2bsbL3MfTmaME6pta
TLSH
T15103AE32A8ACD9339CB79695F21B3643BEB0516389C80A84D9D96F0D43DB49E330BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 e673ac144c14cc56064d01342871208baff2653fa183b740b05ef96423000f78
MD5 899e5948619cf32766774197ae58d72e
SHA1 6ed4c89f74b7873fbad97dc4a840d303e29a13de
SHA512 19bb9689bb775d676b6aaf13a76f6e78a02b4cbe30b090cbab03513905f8dcd8d04a3ea7cf99bdd1b201b4812b59fc253b231042ccd5eb5dfdca5448cdcec8b2
SSDEEP 768:rrv+4UNbdd3HeAq5LALFXAam6aQMGdjWca4Ghf9tPxUQ:rbsbL3HDxmaME6ptx
TLSH
T19DF2AE31A8ACD9739CB79695F21F7643BEB0516389C80A84D9D92B0D439B4DE230BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 28b1414a1659ed80e0ed5f8ae7eb32a4980c2d95fb11c537dcbfc7806d233119
MD5 353453533b6c472a0df13e3aebe32736
SHA1 8dccac1512af99b7e8e64f69d6d4d97cbd0bb73a
SHA512 cdce1d4f87da206e1fa840865ca4205ff0cbdaf68c499df9cac1f649b712c76fb740dd8842f8be7123e07e25adbade2ffce766cee2ad1b8fd45670b63278a074
SSDEEP 768:8F1j+9N3zwgliAq5LALgAam6aQMGdjWca4Ghf9t2A:x9N3fUmaME6ptP
TLSH
T117E28D329C98C9779DA64BD5F71A3747AEF042A3C8C85E84D6DD6E0D029B18E2307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 9ab0903e803267cd205fbf1aed866afe19ed060a12a8e8f4f85e276401da8b54
MD5 032602503081901ede468b5ad9060f42
SHA1 980e603a19ac9eb5c00dcdb369f0331504c0e90e
SHA512 e0dbdd389aa4a1950b141854f2707210103cce1c4b38fda261fad017887848868ad1bc594824d6dc006e1ac4bd6820d2d3567241fca627ad8d31a39eb3398c06
SSDEEP 768:rj+9v3xiAq5LALFRAam6aQMGdjWca4Ghf9t2A:+9v3xfTmaME6ptP
TLSH
T113D29D319C689D679CA796D5F32B3787BEF0426389C81E84C9DD6E0D02DB19E2307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 db3479647a0dc882cb2bc2d5e20c8653ec56ac75f9c0443c5798743b255c04ca
MD5 1e443ee026cf82be2ecaf04269a795dc
SHA1 a9fc37e620f9401db364d65dcece233cfe957fe0
SHA512 4056f1e85164426bbdffd818581076a5fabf7ad46d3921b783a673e630d6a0a39a2167e0a1d6da7f4ebc3e17e7480e38cc9a4c788ccb2de93cea478e82913b67
SSDEEP 768:/rv+4UNbdq3JHq5LXnAAam6aQMGdjWca4GhfBOPeU/:/bsbc32nKmaME6pGH
TLSH
T1A0F2AE31A86C9573DDB79A99F21B6747BEF021A389D40E80C9D95B0D439748E3307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 479B
SHA256 df971de1d83c4ec8d8a5317c7da912d8feaad9129307ead7cac91d8819c039d1
MD5 60aeec055cd3bd04b686b14115275140
SHA1 226ad5a7a3c53e4dbc2166906cae70250583b691
SHA512 0567a6078a9f2c06a9054f75a9bf6b745ad3e3735d4b341e44089627a2e31febb2df182dfc3b521cc3bc180bae5d381bff6248f2806a7339a8f3037dff530336
TLSH
T115F0544E8C2EC994FE0955F500D5C3732415AC408EB55E7D6D0856D364861684CC9752
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 e682b48a36ae61559592eb1b3661781bee6c9da14cda6a85e8b44ab382ca81b5
MD5 6161fad131c87b29106c5d2670b025e8
SHA1 70181eddc1f089079b19273e8864c6324106d787
SHA512 fbedfbcaef13dfde26097ad39f259865395ca49384b9a5a0f70d0bb6c54544ccbd2ee423464db8d87f669b9d89607341e7ecfd9a5412b7d29552d602afe66775
TLSH
T19C51393539E296FB8D602E3ADF0447702E98EDF119634086D21219E84DCA17B1C036EE
MD5 SHA1 SHA512 TLSH

Submit Download

e6d9008f-2770-45b5-8d63-567ab7549953.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e6d9008f-2770-45b5-8d63-567ab7549953.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download