hxxps://kimi-bot[.]com/activities/invite/share?scenario=invite&from=share_poster&invitation_code=LY3RFB

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://kimi-bot.com/activities/invite/share?scenario=invite&from=share_poster&invitation_code=LY3RFB
Sample260801-vvt6easblf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2220	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300783613343611"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{F8B5EAA6-715A-44FF-8FC7-72CF59E3CEC7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2676	msedge.exe
2676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 4512	3124	msedge.exe	87
PID 3124 wrote to memory of 4432	3124	msedge.exe	89
PID 3124 wrote to memory of 2220	3124	msedge.exe	90
PID 3124 wrote to memory of 4432	3124	msedge.exe	89
PID 3124 wrote to memory of 4432	3124	msedge.exe	89
PID 3124 wrote to memory of 2544	3124	msedge.exe	91
PID 3124 wrote to memory of 2544	3124	msedge.exe	91
PID 3124 wrote to memory of 1968	3124	msedge.exe	94
PID 3124 wrote to memory of 1448	3124	msedge.exe	93
PID 3124 wrote to memory of 1968	3124	msedge.exe	94
PID 3124 wrote to memory of 1968	3124	msedge.exe	94
PID 3124 wrote to memory of 1448	3124	msedge.exe	93
PID 3124 wrote to memory of 1448	3124	msedge.exe	93
PID 3124 wrote to memory of 5992	3124	msedge.exe	96
PID 3124 wrote to memory of 4584	3124	msedge.exe	95
PID 3124 wrote to memory of 5992	3124	msedge.exe	96
PID 3124 wrote to memory of 5992	3124	msedge.exe	96
PID 3124 wrote to memory of 4584	3124	msedge.exe	95
PID 3124 wrote to memory of 4584	3124	msedge.exe	95
PID 3124 wrote to memory of 932	3124	msedge.exe	99
PID 3124 wrote to memory of 2852	3124	msedge.exe	98
PID 3124 wrote to memory of 932	3124	msedge.exe	99
PID 3124 wrote to memory of 2852	3124	msedge.exe	98
PID 3124 wrote to memory of 6032	3124	msedge.exe	101
PID 3124 wrote to memory of 3848	3124	msedge.exe	104
PID 3124 wrote to memory of 3848	3124	msedge.exe	104
PID 3124 wrote to memory of 3848	3124	msedge.exe	104
PID 3124 wrote to memory of 1472	3124	msedge.exe	106
PID 3124 wrote to memory of 5640	3124	msedge.exe	107
PID 3124 wrote to memory of 1588	3124	msedge.exe	108
PID 3124 wrote to memory of 124	3124	msedge.exe	109
PID 3124 wrote to memory of 124	3124	msedge.exe	109
PID 3124 wrote to memory of 2676	3124	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://kimi-bot.com/activities/invite/share?scenario=invite&from=share_poster&invitation_code=LY3RFB
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2b8,0x7ffebc87c188,0x7ffebc87c194,0x7ffebc87c1a0
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,13296478496654142828,9540960069456718952,262144 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,16314484860461071481,11211230163625649144,524288 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,762939149903358921,13686344985768837453,524288 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:13
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,9147571718688823913,8355046258953366187,2097152 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,13760826189906107439,16573682494382061918,2097152 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,18349981405594331246,12374564404766043132,2097152 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,17144814706094819237,18430503605707827969,2097152 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:9
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,8814856662546922931,13992546310278486822,524288 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,9585408561996646139,16737489995565971014,524288 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,8541295585974560928,4840780701502890450,524288 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,8541295585974560928,4840780701502890450,524288 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6508,i,7603725608839446119,10093449666416116598,2097152 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,8726976609579399072,9297095425500996451,524288 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,2619560539956618218,13677013470423720967,524288 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,13704648149433524208,13092126980549686174,524288 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,10559388917619756047,9427188695183012064,524288 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3388,i,1493912442822392386,1309778774297962213,262144 --field-trial-handle=2284,i,9045927760646475041,6104592517509374241,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6fdc18a791ec20a7e5ba7ff7df00bb23c21b684e43cf72352dec9af114124ba0
MD5 80ef9275fb01aec263c647ba02612ec9
SHA1 5b88452c4529ea01b59ef8b629171348dc7c09df
SHA512 00a7cf37b0865d1efc190a313bf26d394386e16152002323e278f154eb647e0794012a9a693cf958a679ccae5be31d712f8357fe94e75add48ffa5c4c042a288
TLSH
T11771B896B3AE24D1DBA182F1D9DC684932F1C8642117DF43815C5C7C2E1AF8A29C247B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5dd1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a5dd1.TMP
Size 2KB
SHA256 d5c41efbf10c0b437cee8e9c2d950e14fe125a73395afe2a42dcd966367ab589
MD5 c138f0923ed9874ca7682ec326dcaaab
SHA1 e28cb97c7a8ad46fcfc3ef63185577c3375002c4
SHA512 67fdfb6b05a29fc10395d357265fd7c465269cb6bb713477687295d166ca509e3725927dc4ab711f636aa73302c1a700b137528e75f09fded32998f430ffddda
TLSH
T181517497B36E29C1D7B586F1DCDD945432F5C8A82223AF01855CAC7C1E0AF0A6DD203B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e08c6c2c54ef405389bcc69f9b3d5b366711e5e2262cd5b390210dbeb0a07cb3
MD5 005447503d6ad5a93440eff2f38aaa7b
SHA1 c273442039f435344512c54b9224334d5093eddc
SHA512 c257d563d9bf426e38956db352fd1084d3b33a15db779debe1fca58608113d862b5e9ceaa943cae70abe8ab2717677e9e9ccbb09c2db2d57206dc9dc02da6c01
TLSH
T17721ABF3C2E8567D894181F467182F1BCE2D0814832C3E6AC4D4AB5F93F5861D24095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7b9b3393dab832fdd0315d7374bdd91664d7c6d65454a8c9908db253fbd81b12
MD5 a052284dad2bac0818e30393fbdc9743
SHA1 6944211a55e12a188091138fd79d2ea617094e4b
SHA512 84f206cde55754d1d8a2f1b9cd3a04714b415c1ae38cf59cdb9419b21726f5d1ea232a276434f1f433a9e13efba3fedbda72b0aaa259a25f52177851f37c235f
TLSH
T1C051CCF387B48A7E9E1152F0AA196F2FCE2C0515532C3C6AC5E0AE2793F2471E040A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 02364c57ca12da39966230806ddd006ec8c53ed98d19800ac441aa57eff7ca1f
MD5 232a738d424aea38dee7ac130f8e7734
SHA1 dd34d8398689e23e3cbe73234f36a76526c7d51b
SHA512 217ce7c4055b746ece47b5533612aee5bb844fb9edadd2652a0d8af6786f608c32d8dbcdf1b74bd6b4218920325d470048766968fa8d135e4d70b75e6ad633ab
SSDEEP 192:sxRNRFb6/fysaLwGczoA8pFH7/g6+WNybvd/YoYCYiGPjIgIJ:sxRNH6/fysaLpNR/5c/f2bs
TLSH
T12342B6166D28A93B8CC7E21DBB65BF53E3F95036A1D42E58A7FC960C00E76DD220750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 12b46d4321fbfc1eb30241544cd5108078d3a0a24aebb96b9a002f2c703eee1e
MD5 4d5aa3b9121136fdef3793bb1524a657
SHA1 6d42a1b8bf45d1d042ba67569567565f6ce15da3
SHA512 7c5f23ba668efd5164b7375df7a85bacdd0db0965407f23fdec581d1e316460c6305e655a117a08cfd39994c974204885eaaade3be361e340993f5e202dcb956
SSDEEP 192:sxRyRFb6/fysdLwGczoA8pFH7/g6+WNybvd/YoYCYiGPjIgDzJ:sxRyH6/fysdLpNR/5c/f2bx
TLSH
T10142B6166D28A93B8CC7E21DBB65BF53E3F95036A1D42E58A7FC960C00E76DD220750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b3536eecc415f4de5de71ddf9a635d19971a98e38f24782a166a026475f2255e
MD5 f83756f4f377913f915a636bf313f638
SHA1 a2772df31e00c3210a132f4d504723bdcdfa0af3
SHA512 f5cff23b571a0c317eb98443b6db28c8832f446becf0b6a0362cb7f7856b13eccececd3626bdcd0962aeb52352cb2939ea0ca44e7797dfea77bdff0c1fa6b40f
SSDEEP 192:sxRyRFb6/fysdewGczoA8pFH7/g6+WNybvd/YoVCYiGPjIgD1J:sxRyH6/fysdepNR/5c/g2bb
TLSH
T1EB42B5166928AD3B8CC7E21DBB65BF53E3F95036A1D42E48A7FC960C00E76DD220750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 03f100ec631ddc222382e3e2c5d370c895ab7b4bae893a5c9552db4cb9631cfd
MD5 2516dabcf490098b4a425af2f866ce8e
SHA1 ff9b5d0ffd37dca1dd5ac8915863a89e039f8f10
SHA512 8c108ad0471889882d6e24d7172d8c1c1054665655f4fdf12a1a9e95b5509f4f879dd24fc176d40e5d7c9018f789389bd99f289dd92b54459ef5f735a7b701d4
SSDEEP 384:jzK6H0dfCtgsqFf02KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRXjro98l:j26H0RWgs2f028F1+UoAYDCx9Tuqh0Vw
TLSH
T13BB2EB2B640DCBBE9F800A9DDC196FDB6D9802C79B588D4047FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ac843.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ac843.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6f5178a8bc045ef9b941c7da39048db50f7b94d4f81b5b83a424e687772961bf
MD5 877035e0f2c29f631b1db205050319ac
SHA1 3e737cccd8f416c05d13beadf5e1c3f29822be2e
SHA512 427ff9adc4ac1e5a8817cdf414441e69afd87d676353e5eab81d42afc9569d18736cf87a032e3bd776185489723c6ccf19bc8e6b0c2796e6f1b9259267eb4ad5
SSDEEP 768:EZ3UpMTf/TBOWJLt166ONXyer1IRCzni952ewBKZOR:EZ3AYfC6SIqny2evZu
TLSH
T1EDF2CF75E858AD334CE1E386B1077343AFF8506BE5C41A60AEEE6F1D0193A5E130F926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 13196e57a43b3f61773624d3520d541fc16056bdadd6a92a0b674c3d36901a22
MD5 8ccefd07fe80c835a67fa680703a3e86
SHA1 cfd288a9730796803fc3f3c147c84fb7a84c1f63
SHA512 577bd587d2057c8f7b3694826c1be681905d013891e628ea0b58eb3c5e1a19c853ed897d79402fda94d48817b3d89f92e0a3b5354deba8b90665450ca1305313
SSDEEP 768:QZ3dpETf/TBOWJLt16/ONXyer1IRCzni952ewBKZOR:QZ3jAfC/SIqny2evZu
TLSH
T142F2BE35E858AE334DE1A38AB5077343AFF85067E5C41A60AEEE7F1D0193A5E030F916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 66d4c424862baa28b57bc02a903faef9b7baba0c4be119270f7b2a5ea5f774ee
MD5 bd2db268766725f91d448f604c5f1214
SHA1 51fae7ecef4df3c0987f13fa43eeffd688dfb286
SHA512 a8c325cefaf046ba125f268dbe2b1691eb9836a88ee0e3e7fcb4519532f94494be13d67fa866c806f6385db3bc9e3d12b1d959522be8ac3f0dca756a1b813e2e
SSDEEP 768:GFQ33qwgdpETf/TBOWJLt16hONXyer1IRCzni952ewBKZOR:N33CAfChSIqny2evZu
TLSH
T1271348F298C79937C8AD9387A73E2E02AEBCC057B4805650BBD96A1DCD5257FC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3fe9c4096dba2000b9b153bb827e29abe859326a2b52cc2456347e1294d7bc7a
MD5 72678439a61bba4cac6db3e20c78fe2e
SHA1 33a3f25ea7531f82672b2662347b62c3a2b099b7
SHA512 ecd1aa09aded112ae23746eb72465b3018fc4403a4606278fda386631cc70d9cad7b55a01ddb98b5f7adbfb19469f8e9e0444480c67a8f5db94afb1309560061
SSDEEP 768:vZ3UpMTf/TBOWJLt166ONXyer1IRCzni952ewBKZOR:vZ3AYfC6SIqny2evZu
TLSH
T1F0F2BE75A858AD334CE1E3C6B1077343AFF8506BE5C41A60AEEE6F1D0193A5E130F926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7ad5d18629c6d7167a640db46e447f7caa8d47c05958f3b9b50afe6a921dc41f
MD5 6fe35bbe4f82ec8e22ca4045140c12ce
SHA1 7ee1f992556519cd6db9fb4a0b6a5c538dd4b15b
SHA512 8309f7e45662c7095a155309d5a3b40743d132426d08e1ebdcf4bb01dba7d9a9f3d9e3aceeff1770b74ad89dfb9e9e935ed70bb7642cd2c9ca4543b57058aa83
SSDEEP 768:hrv+4UNbdz3nI/TBOWJLtJONXyer1IRCzniBJeVH1SK7:hbsbV3IzSIqnyEH1l
TLSH
T19503CF32A4A89E338DE2A3D6B14777037FB86057C6840790EDDE2F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04415e05-2aba-46a4-8efe-e3c01656453b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\04415e05-2aba-46a4-8efe-e3c01656453b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download