hxxps://pub-38e73bbf7b6243e0ad1512a1071c878c[.]r2[.]dev/BIT%20540039%20%281%29[.]pdf

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/08/2026, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://pub-38e73bbf7b6243e0ad1512a1071c878c.r2.dev/BIT%20540039%20%281%29.pdf
Sample260817-mkrnjaywb1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5004	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314363196161875"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{4EDC93CF-A181-4816-A3E2-613840C44A46}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
384	msedge.exe
384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4548	4704	msedge.exe	81
PID 4704 wrote to memory of 5004	4704	msedge.exe	82
PID 4704 wrote to memory of 4868	4704	msedge.exe	83
PID 4704 wrote to memory of 4868	4704	msedge.exe	83
PID 4704 wrote to memory of 4868	4704	msedge.exe	83
PID 4704 wrote to memory of 4988	4704	msedge.exe	84
PID 4704 wrote to memory of 4988	4704	msedge.exe	84
PID 4704 wrote to memory of 4004	4704	msedge.exe	85
PID 4704 wrote to memory of 4000	4704	msedge.exe	86
PID 4704 wrote to memory of 4000	4704	msedge.exe	86
PID 4704 wrote to memory of 4000	4704	msedge.exe	86
PID 4704 wrote to memory of 4004	4704	msedge.exe	85
PID 4704 wrote to memory of 4004	4704	msedge.exe	85
PID 4704 wrote to memory of 4132	4704	msedge.exe	90
PID 4704 wrote to memory of 4132	4704	msedge.exe	90
PID 4704 wrote to memory of 4132	4704	msedge.exe	90
PID 4704 wrote to memory of 3604	4704	msedge.exe	91
PID 4704 wrote to memory of 3604	4704	msedge.exe	91
PID 4704 wrote to memory of 3604	4704	msedge.exe	91
PID 4704 wrote to memory of 4288	4704	msedge.exe	92
PID 4704 wrote to memory of 5988	4704	msedge.exe	93
PID 4704 wrote to memory of 4288	4704	msedge.exe	92
PID 4704 wrote to memory of 5988	4704	msedge.exe	93
PID 4704 wrote to memory of 3412	4704	msedge.exe	95
PID 4704 wrote to memory of 5344	4704	msedge.exe	102
PID 4704 wrote to memory of 1924	4704	msedge.exe	103
PID 4704 wrote to memory of 1800	4704	msedge.exe	104
PID 4704 wrote to memory of 1116	4704	msedge.exe	108
PID 4704 wrote to memory of 1116	4704	msedge.exe	108
PID 4704 wrote to memory of 1680	4704	msedge.exe	112
PID 4704 wrote to memory of 1680	4704	msedge.exe	112
PID 4704 wrote to memory of 384	4704	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pub-38e73bbf7b6243e0ad1512a1071c878c.r2.dev/BIT%20540039%20%281%29.pdf
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffbe6a7c188,0x7ffbe6a7c194,0x7ffbe6a7c1a0
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,15079616116806873439,5112258699757136511,524288 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,8863548747505405081,11635291998516865168,262144 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,13208177583712166443,1553405342725427832,524288 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,13731967351504158740,7032817365269454424,2097152 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,17709540255955043789,7202562649039294875,2097152 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5032,i,12784446316826538034,2955121676818650107,2097152 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:2
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5240,i,13807248371766701564,10429457756076003202,2097152 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,15297605043205666929,5347066817890371529,524288 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,12431695328764017638,1934190976741808520,524288 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,17134613863801403164,5304739623496861445,524288 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,17134613863801403164,5304739623496861445,524288 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,3792805391974481190,1829482600882558601,524288 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,9585192466814728323,17567466551930464686,524288 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,9275200911719024597,1653466671790138318,524288 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,10959222335460197281,9328873445641903265,524288 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,13910284904049907091,17867710867906325468,524288 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6300,i,5228899490343120003,16784607106921695515,262144 --field-trial-handle=2212,i,6035343303133583404,2739287807386115118,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64fed8f0-21b9-403e-ac6c-973370cf6506.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\64fed8f0-21b9-403e-ac6c-973370cf6506.tmp
Size 33KB
SHA256 4532dae57f5074e25e30d377cc41ab4078222db8675484d5205793a77f19cd2a
MD5 c2be6e2bd5e9f7a5f093de5d868f3ca7
SHA1 bc3e4db1a3b714fc341407ad276b17e0d48598e2
SHA512 1bffadf99f5947f552da867cb965b2a11752909d1873d3c068ea37d5d2d2605c6ff4865e69a98ab284f9fa4549b1d13a665dec94cfd90a3c9c23b402173d4c90
SSDEEP 384:niiFiZcI43sNW8TUNTUlI4k1DcYqbqRfBfFGbveZs3m8oXKIzp/OOPrXLpe8C/NF:pFQ43pwgl3dGbv/3mZ9/Oi9P2/
TLSH
T1A9F2B2F198D799B6E8EE5B87677D2E029AFCC153B1884A84B7C85D1CCC860BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94ba4a82-b519-4381-90bf-2979d778605a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\94ba4a82-b519-4381-90bf-2979d778605a.tmp
Size 28KB
SHA256 0525eb179e2d0665a2ad69d2df5ebefd75d38b3d63e63adc666a0f31c3313697
MD5 06cce4a1485a4d65edf3407ff31f12f8
SHA1 26193478b6d028cae1b6419bd0ca79d898ae3366
SHA512 0cbd1bd2f41c5f02a321b7cf48b85827003479d30d0eabe42239a51c605b3041b7e41b6f775ceaf8b89cada0cc5bcd9c381d1cc7a8fc7457d635f397e3944631
SSDEEP 384:njiFiZcI33sNW8TUNTUlI4k1DcYKIRfBfFGbveZs3m8oXKIzu/OOPrXLpe8C/NB/:OFQ33pwglDdGbv/3mZa/Oi9P2/
TLSH
T12DD24A72D8A4DABBBCE69BC5A74A3A03DEF4416396CC5AD4E5DC5E1C00DB09E030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc69248227d1b80ff41106426895bcd599abcddfbfe7fdbeabc0fcc2aca903ae
MD5 be6741080fa256162cf6b0264133ca7c
SHA1 4914334b0edd1e4c3a470920450bdee63ee2f5b6
SHA512 8d42ac6412ff316aaa68e317e92c2167dbcac331381aec8d8be8410c5bfab4657127a0601dfc90f771660e393667d62af5e917155d6fcc5c7aa6a8ca1e03f903
TLSH
T149D08037394D7015E35D5175A463C7152B664C611497DF01F166CA7CD9B61C462C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 60ee695b0fae2582443c0ea4e7e116efd02ef68574e25cb358dd7cf1cf524496
MD5 28373cb32901cbcf8a63cd18234a11a2
SHA1 12d1e8c38952df550626f89c56b3c42a394a91a2
SHA512 10d2248590badec289296017bffff80cdd5345cb2a3c89e462f65d5901158dfaaec1a8bdccd69c4eccab6f1a1ecdb222d37c33d1b360fbf283e7a8939c3cc9da
TLSH
T1D8E022E9CC31A83708FD0B1890A1078EE786239B2B814C8B3B3C800D8FB563B4186C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e42e04bfeb373d0c7651ba7530cab11bfddd3700c97f7359922c4a9da6188f81
MD5 4d5062f3d751e8382548cea0a76fe81a
SHA1 8f6fd99b0455ec4f1d396660a6846a556578686f
SHA512 474b51f7e4711e0cada49bcf2835e922fde4b031acd91e7414bc8dc4c4acde5d2475ff7c581d1205daddfacd2f11934867e492faee4f2983c904a5357a9e4e39
TLSH
T1A371717800B64398E7E3027164D10A46357E81A23BF3DF1AF1DC4839A61E7517B3745C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f6c8c8618306536edc22bfc3fcbbc5b2b7311e304088aaf276a8844c0143c54f
MD5 81bef9560ba741c96298e2a79226d591
SHA1 59750c29e86f88d882e4f6bd4be2de47b6c6beaf
SHA512 7039496579855a039927e175ed981e7998cdcc53415e75655c43fa322d5f5f68ee4058e738c8188f5bc874c079c36f267c1e3b2093ec1d52bd4aa93ca674d38e
TLSH
T11631B0F783F4856E8A0196F0AA18BE2FDF1D0515432C7D9AC5E4AE17D3E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1c55963159533e903fd6f9ba4f82f06c3eb600dece7c7a465e1bcbcfee42c5f8
MD5 76cbafdcc691391cd923b99d2003b9a5
SHA1 e355aa6c6b8951ec29c6e1541f337bc029910042
SHA512 a5a8f8013ffefc6a7e3edcb1362c949d0a6468b3906aa84c1f7317236a10842f82e20722cf94f0637d2c3a118c9b4759eb92cab00dc2c87151fd553b6efd3433
SSDEEP 192:sxZPRXyMqZjK1Ml8UQ0ky/fFsgTaYZZyQzodpxekHW6+WNDtkBXYBUgOwue1Y+If:sxZPAqPy/fFsg+mZs9HboX0OuR42tK
TLSH
T12672E7156A385A77CCDBE209FA457B93D7F9156391904E84AAFCCA1C04E7ADD320382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 06b6a17321367ebb27d563907e44b29fbf3f0beba1e0136d41a824cf7f83c158
MD5 2446f9a63a0be1e6524016198a56fd73
SHA1 06f3e336b39e245e3397647de95eb4eb08df991a
SHA512 ce773fd3aae7b8d0c593f1ca9dd2bfcd955abe1b4d809114579f0f5c9b83188a67ba601b004b10e51906ad30710641cdf3fc33abfda6c8652006d60f69a9d60f
SSDEEP 192:sxZPRXyMqZjK1Ml8Mky/fFsz+YZZyQzodpxekHW6+WNDtXJ/YB3gOwuN1Y+IgjtK:sxZPAMy/fFsz+mZs9Hbn/XOdRjtK
TLSH
T10062D8156A345A77CCDBE209FA457F93D3F9656392904E44AAFCCA0C04E6ADD320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4a5db2156eb4fef5daa5096bff3f90657bd3e3f7e4afca552041515b3bb00ef9
MD5 d8fc0d9ea27f21fb344721ee644926d8
SHA1 13d74fb1b76636436ea648ef0842d2db1c86ea2f
SHA512 6e20274faa19d10d87a4ce06ab63f89516038cb2f97b7aac380d044960e3c29640ac920260a09b885f4ab19ece0927ab3c06e980b145b56014170d5af7d4cccd
SSDEEP 768:P4E/aX6WvCuFO8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDVLlFX6BaroVNm5Pa:P4E/aX6WvCuFOu1jayVLfqBRVMha
TLSH
T18FD20A3B280CCB7E4F844E9CEC266F976DD801C796988D5447EA884C03CB7EE511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f039bdf0476ba41799bbd588339ef55143241a1490c8c8b88a3447282ab91bd0
MD5 644a51aed5504d688c475a2c20a724ce
SHA1 54d7e0c50798713ec6b12ef75df3ae98016f2f91
SHA512 5c6de94fdf97c9f7687137a176b2c2ddc128c5967fc679ce527c237dda8d07de715d2642385c17e42558e734d1f3307678a44a306c0801afba57cd1204dc3c5a
SSDEEP 192:OotE42aG3iLEAs1AOvQA7uItfg1MhlfznKzO5tZBBHaFlufF5XYP7cNBv3dR5LAM:8ptDYDcfvNR1ANAJpv0e
TLSH
T11FB26B12713B065238BF2508A29799379E4235A33818F4AF7BB814A61F67E215DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 73848044f6fdc801ba19e1f394ea2114ba9054e87b9d41049e24a68007f68d9e
MD5 aae19ee71e28eb5457d65c6ef2c6b3e1
SHA1 5f25f7192038b2856b5091723a2ffe65a438e737
SHA512 e1b40033319b31e3e11bbb12e8e64388fed325924d1363433768af98060b8f6e1363cc4937e30044298d96ef3ef5c47b7ceb65bd6460e3a9cbd0d153479c01fb
SSDEEP 384:nNiF9CcmyWCs3sNS8TUNTUlImkrDcYWvSfBfFGbveZs3m8oXKIzi/hkP+lFYS/EO:EFccps35wgxQ6Gbv/3mZ2/hkoFYS/Ay
TLSH
T133C23A32EC98D9BBECD64BD5A74E3A47DEE04267868C9AD0DADD1D1C00DB09D470BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c6a2d8bb1594f792052b0df19d31db0cd11c5241f480bf6cd6af19a108194659
MD5 3658d5c88863e1f82a325b0fabc0eacb
SHA1 7ca95ad8b4ba630de025898e9736a3f544aa4b50
SHA512 4e7fe15f277c7f9da64ee4c368e2ead0826774b915214853920161541f41a437e3014a4f6818e9f70b65ffb9774381c63fa6b2cacaaf74dfde9b22fe81426cd5
SSDEEP 384:nQiFiZcI33sNW8TUNTUlI4k1DcYqbIRfBfFGbveZs3m8oXKIzu/OOPrXLpe8C/NF:rFQ33pwglZdGbv/3mZa/Oi9P2/
TLSH
T1C0D24A72D8A4DABBBCE69BC5A74A3603DEF4416396DC5AD4E5DC5E1C00DB09E030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ddb2ca48e45cba999d969690227eefc2b0e84644c817a6b692fd6e23d5e61918
MD5 400d5ae84f085ad8af1e6aa128f54aa7
SHA1 6601bd8d1c4ac6625388f32bbedc42778c16d49c
SHA512 df86272cc7289e8da51570018182d193c9a99bf289d1482e5c0ca34d2b3ea6488026bf1c832c94b722f304a793e9d69f9e6a5228a481e464a4281abe8f773c76
SSDEEP 384:n4iF9CcmyWCs3sNX8TUNTUlImkrDcYhE9fBfFGbveZs3m8r5hkP+lFYS/E1lVHyH:DFccps3owgx4xGbv/3mY5hkoFYS/Ay
TLSH
T1CAB25A35EC98CABBECE64FDAA74E3A47EEE001A7869C49D4DAD91D1C00CB1DD0707816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a9c80433225b4b5794f2161d086a27f2ce189d9a69798ba2f49f5fbb8dcf2594
MD5 4757b0911115716d8107ce0eff1ea7f0
SHA1 55f4f3678bff64e0004648a8fecdabd62593feb1
SHA512 b098e50575ea4089513b5c9ddcb421b448e49438c45ba17ac23cc394f3034e430e421300e4c7b9720a147180ecaa11c89797e7189fd7a9832c41a61be00951c8
TLSH
T18A41F658A6E91158B3B36F5AABF6A86D447FB9772E07D45E00110E0F0A72A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3412-217-0x000001A4634E0000-0x000001A4644E0000-memory.dmp

Download