hxxps://www[.]rteor[.]com/_files/ugd/bbfe34_3cc76cab368445b5b3fa1ec4efde05a3[.]pdf

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 09:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.rteor.com/_files/ugd/bbfe34_3cc76cab368445b5b3fa1ec4efde05a3.pdf
Sample260812-lh5a6stdjf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1288	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310007849860237"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{FD43CD4D-A930-4514-95E7-4E3DCAEFDBEF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2376	4916	msedge.exe	86
PID 4916 wrote to memory of 1724	4916	msedge.exe	87
PID 4916 wrote to memory of 1288	4916	msedge.exe	88
PID 4916 wrote to memory of 1724	4916	msedge.exe	87
PID 4916 wrote to memory of 1724	4916	msedge.exe	87
PID 4916 wrote to memory of 4700	4916	msedge.exe	89
PID 4916 wrote to memory of 4700	4916	msedge.exe	89
PID 4916 wrote to memory of 8	4916	msedge.exe	91
PID 4916 wrote to memory of 8	4916	msedge.exe	91
PID 4916 wrote to memory of 8	4916	msedge.exe	91
PID 4916 wrote to memory of 3000	4916	msedge.exe	92
PID 4916 wrote to memory of 3000	4916	msedge.exe	92
PID 4916 wrote to memory of 3000	4916	msedge.exe	92
PID 4916 wrote to memory of 4800	4916	msedge.exe	93
PID 4916 wrote to memory of 4800	4916	msedge.exe	93
PID 4916 wrote to memory of 4800	4916	msedge.exe	93
PID 4916 wrote to memory of 3788	4916	msedge.exe	94
PID 4916 wrote to memory of 3788	4916	msedge.exe	94
PID 4916 wrote to memory of 3788	4916	msedge.exe	94
PID 4916 wrote to memory of 1444	4916	msedge.exe	97
PID 4916 wrote to memory of 1444	4916	msedge.exe	97
PID 4916 wrote to memory of 1444	4916	msedge.exe	97
PID 4916 wrote to memory of 3748	4916	msedge.exe	99
PID 4916 wrote to memory of 3748	4916	msedge.exe	99
PID 4916 wrote to memory of 3748	4916	msedge.exe	99
PID 4916 wrote to memory of 4636	4916	msedge.exe	100
PID 4916 wrote to memory of 4536	4916	msedge.exe	101
PID 4916 wrote to memory of 4636	4916	msedge.exe	100
PID 4916 wrote to memory of 4536	4916	msedge.exe	101
PID 4916 wrote to memory of 4692	4916	msedge.exe	103
PID 4916 wrote to memory of 3252	4916	msedge.exe	106
PID 4916 wrote to memory of 4784	4916	msedge.exe	107
PID 4916 wrote to memory of 4764	4916	msedge.exe	108
PID 4916 wrote to memory of 4744	4916	msedge.exe	115
PID 4916 wrote to memory of 4744	4916	msedge.exe	115
PID 4916 wrote to memory of 3320	4916	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.rteor.com/_files/ugd/bbfe34_3cc76cab368445b5b3fa1ec4efde05a3.pdf
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff0f64c188,0x7fff0f64c194,0x7fff0f64c1a0
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,3185488969330484770,14633518423324413638,262144 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,8199044578348463474,16139427694321416209,524288 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,18022644260949187075,2777508229755334894,524288 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,12816445976447664741,5605910597458349657,2097152 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,4381515191108245449,1106511076618861185,2097152 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,5693494370328036294,13297720972865141242,2097152 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,1827396453448592781,16902260932945241452,2097152 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3508,i,12225043311159899499,17887385777345977703,2097152 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:2
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5296,i,3651350008259435693,9392371707892275270,2097152 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,5947554364667721163,410803232386390516,524288 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,3120469786644718318,9532339589197946867,524288 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,9503301257190654764,12260584116797741265,524288 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,9503301257190654764,12260584116797741265,524288 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,395931935863954620,14844773374835883410,524288 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,1948659798784279470,16516994865640350168,524288 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,17319168497871213516,7234041325960664189,524288 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,12097922106816641976,15663735915112942469,524288 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6528,i,12591566340258927963,1124498568447574790,262144 --field-trial-handle=2348,i,4348530267565553482,2175810258829337421,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 1b69a93e3e36ea9cf4b53afd3ddf6ffd4ccdd354c5cf02aeb71dbe19d5270771
MD5 a67c683494eea855c3f8531fcf8107dc
SHA1 35769ad8ff980303b8010549e572a1a840c5776d
SHA512 b41ad045033777257eb6ae967fdaa2a77c0753f9fdc310a99029051adc74ec1918699665be8b010460bbe44371e6dccdba0849b75190dd9a10af9a073b4d30c9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T1F4B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6aa38e8d7f0a0a44215d677d260ec88761d7b3e470ae3626c5642ca110d36fa6
MD5 c64a4841c1c70778ff119ee7241c2dfe
SHA1 6310dc91cb3fe34b57bb0a1fc179983c5ea2a575
SHA512 8e834db9ea397524137b3ca2a5979c9f7e06c29fa42f3820847ca9f4dc36b9116831f920285ab1294f649647dfa6eda65a25351931fc7b7c7e99bea752fd12ca
TLSH
T157815F3115B2C7B0DBEA12B19DD36FCC38724EF9F51B2E9338A4C8B69A65F048646117
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583ff2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe583ff2.TMP
Size 3KB
SHA256 7e73d116963383c37fda8e5e7127df72157b31667f818948a1765594da38d0ca
MD5 7ec7d5d3653ab994d577ec1edeb3fba8
SHA1 1fc5465e7ce7d3b7602aab051f2fb33e3f62a4e8
SHA512 2da94c811b3647b00eb154a4495afd589019e105308c66187e9b0d2ad7aebc80067e1ad9a44ff481240e7a5b54b24367fdce1bca7f11fb53969c1d8aede8d5b3
TLSH
T1AB7127340972C3B0E7AA02B1ADD72FCD34728CF9F51F2E933891C8B6A6A8F14464514B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 10a723780d3947c68eb7e25f7a3b9019259f8f180a64d238bf687e5328a85d46
MD5 a0c6c16d0970672df8f10e1397cb4d7c
SHA1 b230f8bf5fdd7b83b346c57bf3f8377dee8512ff
SHA512 1897b376cb9a9ce7508787da748978f6abef41da8e1e207106c64184fc50c9fe84bb72ec91c815f8f5e9c1b11f903f8dfaf9a0cb9fbe976b16ec9f8d1ec69616
TLSH
T116219CF3C3E5856EC91156F0AA24AE1BCE2D0909832C3D1AC9E4EF1B93E3071D102A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b91bb7c98d6ad62f54b16d84b94d90433dc5c0ea9161fb9040a1a31658f11548
MD5 c4786647377d363cd05fa6bde11a92fe
SHA1 5c557de3ae17d8081138898a48060b0c47778761
SHA512 8b33e9f11127d05cd0bf6ecf6dcc727939bf0a7a58028ca8b0509e5806f19dc3b24754e0a548ebc8be1e9317316b256b2fdb601a53170873695b996e39b01abe
SSDEEP 192:sxZnQUnzRdyM/jK1Ml8Mke/fgse5hGCodpEBHW6+WN6SJ/YCGyOwfpneIgrJ:sxZrnz3Me/fgse5hm8Hbl/JOIW9
TLSH
T1FD52E811AA34A977CCDBE209FA06BF53D7F91572D6940E4499FCCA1C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 46a87c245bb6367c6bd295ebaf12a4dfb6b90d2030ec67b6ce889ad9ac34ae7e
MD5 5a3efd0372c05d6d2330513139346736
SHA1 0b93e139a53b4bb3f0c776402e7b75ea83722967
SHA512 51eadde32aa64dc5a486d74dba62b3731f202b00920acbd9a3a3cbb48d725de960d6d8e8f0b89293468a105f70e5bc0167911579eeea33dae59cde253fd25aa9
SSDEEP 192:sxZnQUnzRdyM/jK1Ml8UQIke/fgsu5nGCodpSBHW6+WN6UFw/XYC6YqOw4eneIgL:sxZrnz3qre/fgsu5nmaHbL6/XOtOkWL
TLSH
T14062E711AA345977CCDBE219FA45BF53D7F91472D6900E44A9FCCA1C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 304602cf257ef444a884a91db014ccadd7bb3f33c97456c9e3b22e8d70c0ac3d
MD5 b8801fe66eb6c1a69abe3b01a43e2f9c
SHA1 0ca942e686517267f3783e312e4ac6bd2adce828
SHA512 3d955d494cf122281c6fa1974cd671f14e2dff27dd7917325e0f49960065dd4af1dd13e408bacddadfb5e28ffa663eaadd732ae599f73b76e39b6bccbf97f427
SSDEEP 768:gh8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVHro9:gh8bqn+WvSCt6u1jaCZLbWVU9
TLSH
T187D20B3B280CCB7E4F845E5DDD266F962DD801CB6B988D4447FA884C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b0e8bfabb03a50aa888650ae6f62ed4e7db27d644afae9de01bdc69d3f64b756
MD5 c973d5eae3b354fb2ea401cc374be2ae
SHA1 899f5958f38f582d5c970fe241489932c26faa77
SHA512 9c66d5d45c29e9059e98160172cd708e0fa384f7706c356629b9a222c90e956ab359f94ef461e56a053f76b92562e14d90f0e9f91a6569bfd13b6d3b1a8faa50
SSDEEP 48:KwZIFKCwwPyNlIpKuEsKcI7KlScXyIn6VhnlK:KwZ2KCwiWliKuEFcwKlSevn6VhnlK
TLSH
T141914211347E02412CBE790891D5DA6B8D42726B392CECBB7BE851935E6AE111CFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6dc5b5f8-e87f-49cb-be3e-4c9c7c55efe7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6dc5b5f8-e87f-49cb-be3e-4c9c7c55efe7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3c37f3756bc028d0f84a0e7de4c10af048247eab72ac29dbe915d00dcae8bf7f
MD5 633c2ec7001006892b50821e06de87ba
SHA1 c85b049e34810b176cc835a51288ae415bd6c66f
SHA512 5517a2b37766bb27d126508370b6a918a6543ce6b57879b5cea154b6b1fd1ddec28f7438d16afde160bc01b76bce159f7df93d6e191cde7a5395b22c0226574a
SSDEEP 384:EZcIhsNLrfbZNPL+/NaEa+wOS7+2KKMsRnlYJBe:ihiZN8Ra1OS7lKKhn2ne
TLSH
T1EF928D32AC782C766DF6A542F48B36135FF89027D6CA6E90E5DCDF0C01DE598031AD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 df94a1df4839aa66cbb047fa97653ac6f278704e950f0299918e5dc002f2a8cc
MD5 2de6d5e20264b4adfe13a2fe95fa0dd4
SHA1 b04fbbd05af9be7332ba2632af7ca47e3080e176
SHA512 25ed4bfd3e9abdc9ab6a6665402610d2f243f617715cc00dcea3ccc65369f2ef51a080b678836be7d77f4842af1f4e22a2bea7cd05cbe9e26f809cdf7d35d872
SSDEEP 96:EqONkEQsjpf1bxX5ih/cIPURHl8h4otop51nD3BfPgvE5BzatIRdy+jCOmhsR1Rh:vONw6Db6QmiUyJxHBa+jcOmiRqRgFbU6
TLSH
T15E02F93568786C779EA26E48F48B37275FD4103BDA966F40D6D85F0C00D765C230783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3fc117fa4bfe29647a267a34408f09da99399b2ce50fbe3560ebfc1cacd0e91d
MD5 dd668bede59a02de5fe0b1fb6435d098
SHA1 cc4509e6d5d26fda92919ae686db430a689547af
SHA512 34a867eb55542132afdc82a014944c2f1aa8049fe3c20d7f6203c4c4486e4685bc9e618ad744018c2c49229992e474d97d1e3300e19e2f0c2b3dccf19d3a2b23
SSDEEP 384:niFiZcIesNV8TUNTUlIlsbZNPL+/caEa+wOS7+2vKMsRnlYJBe:iFQeAwgQZNBRa1OS7lvKhn2ne
TLSH
T175D22AF248E74936D9AD5743B77E2D028EBCC067B585A950B7C89A0CCC9A1BFC30AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a5512e997240128fd13d46da9faf50fd1173642f46ba864a7b136d6f86cef41a
MD5 9ce10e189fa27e2fe97e791b60f63c07
SHA1 299fe870879ff175e32dc881908cb2285f0078f7
SHA512 0655b0d7fc37be919ff2afa7c862310932e49954ce264e98b8cb7187a0bd148ab57f1cfd0d196a1a45e32a248064a4cdafeec177921557d8fc27d01c5dc815a1
SSDEEP 384:lZcIhsNLsbZNPL+/NaEa+wOS7+2KKMsRnlYJBe:dhxZN8Ra1OS7lKKhn2ne
TLSH
T166927C72AC785C366DF6A142F48B36139FF8902BD6CA6E94E5DCDF0C01DA598031AD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f6df5e3007f90e84a9d3f5767b22a0245b36b02f16cc20689953faa14ab1de3a
MD5 c94da3f93ec5e4aa00e54ea66aff19a6
SHA1 a0849bfc35c714a6086326d86e3312a03d90e504
SHA512 fd1403410d0694fe7a93c7c5830c30a4aa650dea59683c963c29803a754facef21ff6b3e93c7e4d0f35c0ef0c469e58cd92a970081ab8f2eea2cf6ac82891c05
SSDEEP 192:XON26DbMQmiUyNxGBa+jcOmiR67+25NzDqVU6:XON260MGBa+wOS7+2vKU6
TLSH
T18612093668689C775EE26544F48B36139FE8502BDA4A7F91D6DC5F0C00EF69C234F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

075210a6-3de4-493f-a5e1-0e0846fd1474.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\075210a6-3de4-493f-a5e1-0e0846fd1474.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 feee768d1cd399bca2e0abf7afc30cc5ba96fbbb0ae15f6e95c18424e244b037
MD5 a47f0d1a30d4583380bb39d64747769a
SHA1 51880093663c8e3b4dbe6ec5cf41dd4366c5fa6b
SHA512 a388ebf25bce25cac4d0083b1dc35cd42cd349cff1d736c594da8cbd808da6900e1aff0cafeb649e6453a7cd996131b07f9eeabad1511c0148a90bf32531ba2d
TLSH
T10841215CAAF91148B3B76E5AAFF7A82E487BB9771D06849D10110E4F0A67B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4692-213-0x0000029203670000-0x00000292037B9000-memory.dmp

Download