ca49b30e9270006e3bf6684ff46b674e55855a9e757d14cc73544a34691cedb1

Analysis

max time kernel
148s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OEBPS/xhtml/chapter19.html
Size 23KB
Sample260824-2ckmksvblf
SHA256 ca49b30e9270006e3bf6684ff46b674e55855a9e757d14cc73544a34691cedb1
MD5 f8e313298f8694d7912751cc1e29fec0
SHA1 6ac031442f784f1a74c17a8b25f8f9665eb5bbe6
SHA512 f051b9cab6d6c5c2590e23ca1478ee8353ea70c335624a9623eac074be68bdbfb6a8764377de17619b84f2520f4d5a096cc5bd357324ea1f306fa3c88a12ef15
SSDEEP 384:VeGuOL0Y+ekwxt7Zk0OKkkcszphHXyyKdTsEWQ6q4Wzf9RSABsjO7UaEe:VeGvL0Y/17ZkskkphHXrYHOABsjO7Ube
TLSH
T1FCB2961BA7842A3B05B202B5A61F73F1F363C138931195113CBED26BA313CB5967BAD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4540	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320839948897401"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{F6EBE6EA-6BAA-4E2B-A192-0ABF20969880}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3464	2372	msedge.exe	86
PID 2372 wrote to memory of 4540	2372	msedge.exe	87
PID 2372 wrote to memory of 4720	2372	msedge.exe	88
PID 2372 wrote to memory of 4720	2372	msedge.exe	88
PID 2372 wrote to memory of 3392	2372	msedge.exe	90
PID 2372 wrote to memory of 3392	2372	msedge.exe	90
PID 2372 wrote to memory of 3392	2372	msedge.exe	90
PID 2372 wrote to memory of 1196	2372	msedge.exe	91
PID 2372 wrote to memory of 1196	2372	msedge.exe	91
PID 2372 wrote to memory of 1196	2372	msedge.exe	91
PID 2372 wrote to memory of 1776	2372	msedge.exe	92
PID 2372 wrote to memory of 1776	2372	msedge.exe	92
PID 2372 wrote to memory of 1776	2372	msedge.exe	92
PID 2372 wrote to memory of 3672	2372	msedge.exe	93
PID 2372 wrote to memory of 1260	2372	msedge.exe	94
PID 2372 wrote to memory of 3672	2372	msedge.exe	93
PID 2372 wrote to memory of 3672	2372	msedge.exe	93
PID 2372 wrote to memory of 1260	2372	msedge.exe	94
PID 2372 wrote to memory of 1260	2372	msedge.exe	94
PID 2372 wrote to memory of 4304	2372	msedge.exe	98
PID 2372 wrote to memory of 3808	2372	msedge.exe	99
PID 2372 wrote to memory of 4304	2372	msedge.exe	98
PID 2372 wrote to memory of 3808	2372	msedge.exe	99
PID 2372 wrote to memory of 2116	2372	msedge.exe	101
PID 2372 wrote to memory of 4408	2372	msedge.exe	113
PID 2372 wrote to memory of 1540	2372	msedge.exe	114
PID 2372 wrote to memory of 1760	2372	msedge.exe	115
PID 2372 wrote to memory of 3344	2372	msedge.exe	117
PID 2372 wrote to memory of 3344	2372	msedge.exe	117
PID 2372 wrote to memory of 1408	2372	msedge.exe	118
PID 2372 wrote to memory of 1408	2372	msedge.exe	118
PID 2372 wrote to memory of 1744	2372	msedge.exe	120
PID 2372 wrote to memory of 1744	2372	msedge.exe	120
PID 2372 wrote to memory of 1912	2372	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\OEBPS\xhtml\chapter19.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2c0,0x7fff6b8ec188,0x7fff6b8ec194,0x7fff6b8ec1a0
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,12106614815918270518,2744737402249963835,524288 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,14329027080701002166,10163009902831417853,524288 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,2791543647801612270,7076298846685731530,262144 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:2
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,14566695314520494885,7884264326277596368,2097152 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,11372107076659582324,2168095000062247393,2097152 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,11847702564323228263,8771980021905878637,2097152 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,17049885509723376679,11111634561205644461,2097152 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:2
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,15284372379334378042,13953521765147763811,524288 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,15109230829355364298,3451972768889874427,524288 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,6055833449789829284,3749708128125756056,524288 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,6055833449789829284,3749708128125756056,524288 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4680,i,17995658758563458821,18320868711862100922,524288 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,14464562939986217771,6085608070973927422,524288 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,3684165602518757253,1762581160187706476,524288 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,2168085377277803161,8259510608439248368,524288 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,12125758711856437478,4765137923272429371,524288 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,8462035656231607380,635175926677408675,524288 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6024,i,7439415396658718550,14065169298035366896,262144 --field-trial-handle=2544,i,6041008295789535393,11499977950534976806,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2bc7f3a4024d9673a2f7a098d546fe1f592a8aa0477eb259121fe80954c2f99d
MD5 403039b77d88ae3c8e79a108e60c95e6
SHA1 478b6a90cbd5967be9b36c911b5a2135e0b7199c
SHA512 fbec8c6863e6042041cea05b5efa69ca53b0340f3bee0900ef55602e442dca5b20c736b16589ad755fc44c45bb2c920ed0e29957fb7ab74fe05e101f104c82fb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7I:fwUQC5VwBIiElEd2K57P7I
TLSH
T1EEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6ad2673c8f399ad0a8f215e4747946bdcca65653da1785a9b79f8f3654889808
MD5 9ae90b58aba5a5b5b89f24a75119e109
SHA1 ceca9e8a0e4d153cfc0d56c229590c4889a56aaf
SHA512 d5ba244b6b32bf4c184253a7c69c089266f07ed8a89e7cf7c1c7d96b70308ce0b3f4785798a53e7240557352e818bdae705fd70854b6ab956727137ad6a4f735
TLSH
T1FEE0209544CCC31DB504A597B168870C81C0360F93C4F9E51B04C4847142CB4E7C1FE4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 20ce80a055d8a6ffcc6ef008db6b07b0d49d8720e438d1d8f8569a8b26c63176
MD5 c74439123efc3f5bd599895149fcee86
SHA1 e70805db99699b6b632c9cd2881deb28e74e4673
SHA512 00ab576769f44fc57800da68489899a2cfc3831d17e6bed33415a1842ed5b87c9d701b3781da1a6f44322decc3945889b3eb99d782043c06f4962518272d462b
TLSH
T1E77182360A534269E7570332EBC2C41A727186EAFA3F9DED24D0587C4D0B3F1816AA67
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bd5f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bd5f.TMP
Size 3KB
SHA256 1650b39a6694be96971e829e023fd700661eaa8361c0d1976bb54aea07cd516a
MD5 4b0fa2eee1b297b4a22d9aefb30cd02f
SHA1 bb824c57e4005ba6dbacd1c8c541e99c34596138
SHA512 f2328c0cb76e54d100f6dae9bc2d2e1e5d6e2c100a5437d11711f401341d8b9e43a2e3d3a0bb645119ae1b4347825e13e0f9d6c3959d54f7177b8c4baf00bba5
TLSH
T17B7193350A534268E7570332EBD2C51A727186EAFA3F9DED24D0587C4D0B3F1815A667
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 e2477d654f64e7506748094616af69433ce0ca581fbbb2299e695d6479374248
MD5 c567010841354f11113abe0cf8706ce3
SHA1 f912ea854f876d452c8a39f09b1e3675a3f5aada
SHA512 eae157eb63328339beee85e3583146c2cb5d9e71cc4c77ff5c3dacf2e8fb53a2ee6c4efb638a861b3f0c63e177d189baac3cf66829d5f9cf44f20ca4ff2bc62b
TLSH
T1B6113DB3C3D5856E8D0116F09A24AE2BDE1D0906425C7C5589D4EF2BD3F3479D10595F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0f5d9ba9bed0ebb605164c028df541f3bfff7c53436d37e181904323418e6143
MD5 a62aed2aef69d31c86cedd806eb57d03
SHA1 2100929d7b59c527a116c52dae92acb2cba37a08
SHA512 43f87bd8eb6e579b8cdb1c3c091ed45e3a32608eee4331c54249f5624167212b159536049442659382bd41baeb0223e1c3e1eaa82ec3bd934214ad1ad3e65cc8
SSDEEP 192:sxZAtRvPyM/jK1Ml8Mka/fssiP/GKXIdpdAUHW6+WNGYzQJ8+1IgrJ:sxZAttrMa/fssqeJWUHbGWq9
TLSH
T10F42E8116A34A97BCCDBD20DFA557F53D6F51472A2900E44EAFCCA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 09849cf50800ff11caaaaafbb80b2d97ec1be69a40616baf65dfd67e320cf7ac
MD5 89be3002f723095ccff34c5c1fdeed86
SHA1 3df8a49ee838c255a9e4a167657a269c18a6ca77
SHA512 4afe96c021ead4581ca6162d822d3dcb04762a306f73f370261713548915c00d6e69a616722401d877709344f86118fa85e5c76fdc8bf90d1b427d03e8aba089
SSDEEP 192:sxZAtRvPyM/jK1Ml8UQoka/fssFP/VKXIdpHAUHW6+WNGYzAs8+1Ig5gJ:sxZAttrqLa/fssd9JgUHbG5qa
TLSH
T1DC52D7116A349977CCDBD209FA41BF63D6F5147292900E44AAFCCA1C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 dff2e035d490c31f90c1ab26b7dbecebeb1ef89241ba304b098e7507a7fcf019
MD5 2fffb54b2d69ec94c914d0d28b95eba7
SHA1 d327c3f56a774318c6bf1dae8ab0bf28b0f45d84
SHA512 33019deb92dcd8ba84044f63714ca1e51d9f94007c543c380857eeb492322b0dea4e9f747a2104eb1d4ecdf64589b1892d6075df9234e1bd90701e30bea3584b
SSDEEP 768:XWW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjYroI2iqYt:XWW7kf0Wvqidau1jaa5LA3jjyt
TLSH
T191D2FA3B684CCB7E4F840E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ce083ac69f840bafa77e00805c28398338c1c917c7ba742310ea664e54489281
MD5 3c364c7bbb51a2e8e7e41455b153f4f8
SHA1 1a026d36ab485508f114ea551fd5069b41540173
SHA512 9c2656e9bcae489b86b6100bf22a05e0b72c4fefa944d2492ddf2e1707b9af0a1c2f3261ff598d90c9b57e217a8e51a5dfd336ab1a1d716a249130ba6e9378d8
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbEIfKFmc3yZ8ILK9KcljIFKk8:KIbCKcbEQKFmeK8gK9Kuj6Kk8
TLSH
T120917746727B160138BE2C48A755D6368E42315338A8A8BF7F7544A21E67F128EFCDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

176c65f4-68dd-48dc-98d5-c8dc3a931ae8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\176c65f4-68dd-48dc-98d5-c8dc3a931ae8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 232448d32f7e017f9a76bea507187468284849276bbdaefdbae8a2fdbe3fc8cd
MD5 ebe0e688c599381b041589d916d01da4
SHA1 731a780d4e2f6dc774cd64edc29b41d1eb7b7080
SHA512 400c75764a61a82ffb653ae5094cd895939bc54bdd48eaa8c71e8ae3f3728b15fd362fe79378894b0e1ab8d61751f1570e5c13df219ef5725a380dddbdfd1c6b
SSDEEP 384:wiFiZcIRssNZ8TUNTUlIlRgRbeenZ6PdlhCEJrmViv6+aXob:LFQRs4wgURCeZk7hmViClXk
TLSH
T1D1A27C325CA4893BADB69741F94A36179FF54077D6C8AA90E3DDEB1C00EA6D81307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0a72835a5e20505bdd33e86c3305d395f74f287c0d26ba16c1e84f7652c1e9cb
MD5 6796ccaa52227eb42196a61ef711894f
SHA1 dd767ca6a3f2247581fc2b3b975f969bb8c15ac2
SHA512 b3efa01e26e5529df2a98b4a584faafffa527ae0deb3395b14457440d0f87dc6e1a0cc1c124cf67bb3138ae8a3f89b82f0b00cbd63039dc02c4b4d722db31a66
SSDEEP 384:6ZcIhsNYUygRbeenZ6PdlhCEJr3Viv6+aXob:4h8RCeZk7h3ViClXk
TLSH
T179828E315CB45C3769A2E242F9463A179FB9803BA7C86E94E5EDEB1C01FE6981307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9ac697c79b9f60b32e84fdc2fb86e70cf3c4a5a5d4b51c9816fb80bb52b68199
MD5 aaab29ebeae126762a251e0066026036
SHA1 777b0c560499c1901274de6d3d7248f8b1461854
SHA512 8011b9e6fa8bb355cc5ed95d711ea03ed66d42b33cd6c4a0367b4c19e9433211e9b6c8add39c0faf04624c04678b3f3359a1e7b13cca3f257005328737b97261
SSDEEP 192:MONB64BAQmiUy11AW5GBPKDv+FdGEIaDNrU6:MONB6eAyCWAdlxNU6
TLSH
T19502F938AC786C7B9EA2AE45F48637175FD8103BE6C51F44E6E85B1C009764C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bfb05a26d34f53de5cc986d6ee2e7ba55ea1023ebd812235e67929d2486174e3
MD5 7e321a821b70e2b4c8f7de9b20ff5312
SHA1 ac49618f6ec674f4d3920b12af1256023cb9a3bb
SHA512 74b4182d1b0580bed4b39b2ec79eb306ed821fcf340370fe5f358604d8bf4b277b6a4816dbe23fd6cc1360cc361fed937115332aaf244904bc42e8e8d797a83d
SSDEEP 384:wZcIhsNYURgRbeenZ6PdlhCEJr3Viv6+aXob:OhNRCeZk7h3ViClXk
TLSH
T1FD829E315C745C3769A2E242F9463A179FB8803BA7C86E94E5EDEB1C01FEB981307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 342459cdf52cd3fbcd5d464e9a636560a7863944274e41000cc238c88b918c71
MD5 2802e9aafd22acad4d06e8b5bab29426
SHA1 1463f17447ffb3c16d23c917fa37dea339765de7
SHA512 173d3329d575da29ac67fc6f7135b3a92efe96ef4827d9072a82ad88f5d5e52ef80aa2f19ada50c807b55392e8983c04bea97da257b74fabf8c7d97cae78f1aa
SSDEEP 192:KONC64BRQmiUyuAm5GBPKDv+FdGE1VFC1SJrfWwvqCU6:KONC6evgmAdlhCEJrLVU6
TLSH
T12E121B35ACA4AC2B9E92B151F48736139EE5413BEAC56F84F6EC6F1C01EB69C1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83b102b1-dc42-4077-8967-7485558fab34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\83b102b1-dc42-4077-8967-7485558fab34.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 209f1fb1a6a5c49fc57e44107bc926321ae13d4bfd5f7b2311821fb8509f07b0
MD5 03c0bd8196ee20a9244ea500e65ae6e5
SHA1 290680ba94a227ceeac42643de7943ea7b823bc1
SHA512 53da520308a02666308f8c1580e9f8c7d86acf9ae708091c1aa7957b8219a09a60df50dc8ce9821abe23399cdf82abeb06e3046962738eff36587332ec9371f6
TLSH
T10741185CBAED1158B3B76E56AFF2A86D447FB8722E0AD05D10110E4F0A63B41C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download