b37569f1e28555737fa401abd32a91ce2e6b19e3b30b407f79cb6eaad6fe8e0c

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OEBPS/xhtml/chapter24.html
Size 24KB
Sample260824-2ckmksvblf
SHA256 b37569f1e28555737fa401abd32a91ce2e6b19e3b30b407f79cb6eaad6fe8e0c
MD5 191d3d94bd1415e7a6bece226dba4f82
SHA1 3203d331c3ded1aa030c84a1781ff61a5be392a6
SHA512 9c0d652d6c9d9843f6644a575e03349c63f9435ccd15ad870460a4b6ce571d8ddb3b3c4343ea39ea2301097261c31c5178e9b214a1ced8de6ecaa442d95656e9
SSDEEP 384:PIE/yEcHDcYmXNIFbvvZ+Kei/nrr+s6htcSNU7YgFyik3BNgp3p7JOWFBvXQgrb:PTFSFTx+2+qj7Jy5xNg9njb
TLSH
T167B2862AA7445B3706A241B9F14F33B0F352C53C936251526DBEE29B6313C78A17F9E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2180	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320839960407777"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{FE9D7F97-8CB5-4074-A86D-7D1E15347A68}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 1616	5108	msedge.exe	85
PID 5108 wrote to memory of 2180	5108	msedge.exe	86
PID 5108 wrote to memory of 2420	5108	msedge.exe	87
PID 5108 wrote to memory of 2420	5108	msedge.exe	87
PID 5108 wrote to memory of 2420	5108	msedge.exe	87
PID 5108 wrote to memory of 4844	5108	msedge.exe	88
PID 5108 wrote to memory of 4844	5108	msedge.exe	88
PID 5108 wrote to memory of 3356	5108	msedge.exe	89
PID 5108 wrote to memory of 3356	5108	msedge.exe	89
PID 5108 wrote to memory of 3356	5108	msedge.exe	89
PID 5108 wrote to memory of 1700	5108	msedge.exe	90
PID 5108 wrote to memory of 1700	5108	msedge.exe	90
PID 5108 wrote to memory of 1700	5108	msedge.exe	90
PID 5108 wrote to memory of 4268	5108	msedge.exe	92
PID 5108 wrote to memory of 4268	5108	msedge.exe	92
PID 5108 wrote to memory of 4268	5108	msedge.exe	92
PID 5108 wrote to memory of 2304	5108	msedge.exe	93
PID 5108 wrote to memory of 2304	5108	msedge.exe	93
PID 5108 wrote to memory of 2304	5108	msedge.exe	93
PID 5108 wrote to memory of 1884	5108	msedge.exe	97
PID 5108 wrote to memory of 1356	5108	msedge.exe	98
PID 5108 wrote to memory of 1884	5108	msedge.exe	97
PID 5108 wrote to memory of 1356	5108	msedge.exe	98
PID 5108 wrote to memory of 2240	5108	msedge.exe	100
PID 5108 wrote to memory of 4468	5108	msedge.exe	112
PID 5108 wrote to memory of 4984	5108	msedge.exe	113
PID 5108 wrote to memory of 3704	5108	msedge.exe	114
PID 5108 wrote to memory of 2592	5108	msedge.exe	116
PID 5108 wrote to memory of 2592	5108	msedge.exe	116
PID 5108 wrote to memory of 4596	5108	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\OEBPS\xhtml\chapter24.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc04f7c188,0x7ffc04f7c194,0x7ffc04f7c1a0
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,18247666053043340986,11907956777899110017,524288 --field-trial-handle=2260,i,2276576128394844465,15695694908255340351,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,4534046212486137495,10616682197940750635,262144 --field-trial-handle=2260,i,2276576128394844465,15695694908255340351,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1376,i,2771998244370091711,17893842147032094883,524288 --field-trial-handle=2260,i,2276576128394844465,15695694908255340351,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15627911174516800574,5764360859119441463,2097152 --field-trial-handle=2260,i,2276576128394844465,15695694908255340351,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,7486059793821632836,10756683929822259067,2097152 --field-trial-handle=2260,i,2276576128394844465,15695694908255340351,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,900123340414543677,6673014283800910057,2097152 --field-trial-handle=2260,i,2276576128394844465,15695694908255340351,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,9648793509679769934,9871996803810507938,2097152 --field-trial-handle=2260,i,2276576128394844465,15695694908255340351,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,18156574795300825497,11246381582376610807,524288 --field-trial-handle=2260,i,2276576128394844465,15695694908255340351,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,15458303882879983289,15671516789468056809,524288 --field-trial-handle=2260,i,2276576128394844465,15695694908255340351,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,5069144397035617770,10770582343274881417,524288 --field-trial-handle=2260,i,2276576128394844465,15695694908255340351,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,5069144397035617770,10770582343274881417,524288 --field-trial-handle=2260,i,2276576128394844465,15695694908255340351,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,1329122516431519681,8950892475154216202,524288 --field-trial-handle=2260,i,2276576128394844465,15695694908255340351,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,5599205935482772705,8522926042625104722,524288 --field-trial-handle=2260,i,2276576128394844465,15695694908255340351,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,8081912917244959678,10167556909902696662,524288 --field-trial-handle=2260,i,2276576128394844465,15695694908255340351,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,7316287949566135473,4622130149840677796,524288 --field-trial-handle=2260,i,2276576128394844465,15695694908255340351,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6132,i,11755494307780710214,9983212277622837745,262144 --field-trial-handle=2260,i,2276576128394844465,15695694908255340351,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0eb904f540f8689f135264865f77715c06f172a534118dcb1ea884dcdd08050f
MD5 43b518ef1fb78170a5808f3ba3db75c9
SHA1 8792a46c0c934ab8d61b03f3442c48b068802e2b
SHA512 db96f5095cf2a1e16c43a802276287945d2a80947faeacd9cac12210aa59e68d1dd6516ddc208edf4198d4ee3daa049bc9774f8ee464b4f3800f67844b45e3f1
TLSH
T1CA51603C15110862EBC00533F0FB9A54B17985EDFA13AE73C5735D7A5B1A321C00D389
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c435.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c435.TMP
Size 2KB
SHA256 d70c91876316070a7b37f6508f61bde79fc106aabe08983460c757414feb876b
MD5 0f8d93b80cb6ab006bafc9c11fb219a9
SHA1 14bf45c1eac48172ed861a7d29fe2d8e95950065
SHA512 3e8c7f1f98f0c50081aef2ebf69d7c89e4a40fc1b784d1bbec4361310081430f4b0687e05b70c6790e0a7133c436a8ff76e8a4d652f721705d203fb2d68721ea
TLSH
T19A516E3C1A120862EBD00473F0FB8A54B17985DDFA13AE73C5B35D7A5B1A321C00D389
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 6652d8fd9ce202220175c2d05c9a494544bffbdeaab33bd4c1592869d9da03af
MD5 95922108448974a531b1b6e0f220d798
SHA1 6df743b0282cd5b43de973c3dd155fb5271dbc60
SHA512 4791f42e4d168f9663b007f629b8552481a70aa9bcee7f0f4827ddb5a165d12238483a0d07f5c65b757b89f671ed89944c16caa1aac92a465d50802617e866a2
TLSH
T148117AF3C3D5956E8D0117F09A28AE2BCE2D0A06421C7C5989D4EF6BD3E3079E00699B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 423555d5689bbe0f1c2892a6ad059968e260e9e475339f5aceb94f4e7e3d1442
MD5 18deaba4e08411ee3c3e0a2f5c427755
SHA1 376b0f4cbcc62f30c52e4fdc0916a5dcfe572794
SHA512 88b422c9f7dfdc80a53b681fe83286a65a705b1280277823f7bd786326fd4f380aa5e49c5f3e64abc38afc4d5d4a2f9391c2e1c89a7ab5823855bd38db10be64
SSDEEP 192:sxZQR1ki/fHseqNRn8IdpdhHW6+WNGY9IKvtWIgrJ:sxZQ0i/fHsd7lrHbGt9
TLSH
T17622B8126E24A8778CCBD21DBB55BF13E6F95032A1951E58E6FCC61C05E76DD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ca2184351617678bcc4d616a11fb5841c646990ffb25e995a5136cb4149ff7e8
MD5 5e312aba0f452fb62bb6efa05f3cd9b9
SHA1 7601109a055adf5838cd7661ead3f1e2c20c6277
SHA512 2fe4665ea8c5919171a5cb16a38306cc5874027edf904942d51410342d4093298a3267ec6ceb6284b0937387d52e735f32d5f92b73f2f48f5ba8a0ccb8d7b2f3
SSDEEP 192:sxZQR1ki/fHsuwqNRn8IdpdhHW6+WNGY9IKvtWIg5GJ:sxZQ0i/fHsm7lrHbGt8
TLSH
T13822B7126E38A87B8CCAD219FB55BF13E6F95032A1941E58E6FC861C05E76DD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c770366fd8e27a0e68e06aa1b684f71be93a5d391e8e8a98dddf954b1bbb46ad
MD5 3b44c67a171f7d64aebdb2b563b688fa
SHA1 cdc4a52faa98348707c24e75d7f2b4e2aa85de8b
SHA512 0e880fff67a438a686789aecc7cda484164415fb72eae14a27023be180584bb2e6c384bc4c807c633f1a1648e333a91d710af25ef4e16ef8917f30210675f5a8
SSDEEP 192:sxZQR1ki/fHsuwqtRn8IdpdhHW6+WNGY9IDxtWIg5sJ:sxZQ0i/fHsmblrHbG+2
TLSH
T10022D9126A28A8778CCBD21DFB55BF13E6F55032A1951E58E6FCC61C05E7ACD224B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6d7a4ae992f1157ecafe566b513fd12819b00344b177d52b2302842cde8013c9
MD5 f1a8dd39f43a52427d65d0093fe14444
SHA1 c38f98ebb55073e8f1562600bed060e7c93251cf
SHA512 34286da33a875d5234a20eec43b2b2180ca6b2723325e3489936d6250b3c7dcdd428e81cec607b0c10ed613bf34ae85ce52c3deb3b87416ef8b1a434ff5008fc
SSDEEP 768:PdyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7QroPbqI:PdyvIZwWvu+Q+u1jamFLeR77PR
TLSH
T140C2E92B240CCB7E5F801A9DDD5A6F9B3EA802C7A7588D4047FD994C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e9b640bd5e0ef9a3689a1f6864c1a66b949a252e619df1a1bec9705ad1f42f7c
MD5 8f8f976c647a0b5d054f6ae83e3fd7f4
SHA1 24cc152020a82062a65eccaa3d719ba802572bf0
SHA512 4ef645feb006dd1a8659348f5144f08fcd705abb518b5b83cc92ca213a130368ad93934494c4ef639c4b50b0186cdf1a2ff7462651b0f53867536a7c9cf5b0b0
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDiV5SKiUai6DEg6U0xdANs7oxKT47axHCqI:mTDdi6DEg6U0HANEom47aFCqVW
TLSH
T14991770931BF12412C7FAC0C9691A6369E8170637458E57F7BA840A24F67E169EFCDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 dbdacfb66de4360cf652345441c550eefcb0ccb6d486d9b174963470015fef52
MD5 b7d55b7b8f9f5d372078c8627baaeccb
SHA1 d8228ff2f7e936ff56473893592ca4fcecc40d54
SHA512 64812289536f3c640fb9a28cb3cedf5e7cdb9a3b74b929792f0ae365e57537373e4035e35e569570cc757d1b92d38e2782930af5dff76b47b1781a879e04a9a0
SSDEEP 384:OZcIhsNlarpziMtFQe+C9d6NXeb4ivX+ayok:shdnFzFF4ivlyb
TLSH
T1C8828D329C381C6B59F29241F5463A139FB89467EBCD3F90D5ECAF1D01EE698130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 52acf2b32cc68ec2764ea67a36bc710788c3849fda85075d4a95d8b385d2ea81
MD5 75b398a43f730f49749528ed70eaba4d
SHA1 08244137cd89208b1afb08db64a48296da1a2d2e
SHA512 f2baa49a59b33fe5c6fe372a5e8d825c5e12e5eacdff98652ecb3e53184e65bf764f74cab70026cc1ba5c5e8b04ad50ead53a1f65a5d369890555574b85e0ed6
SSDEEP 384:BFiZcIosN/8TUNTUlIlbrpziMtFQe+C9d6NXeu4ivX+ayok:BFQoKwgjnFzFU4ivlyb
TLSH
T14DA26D334C64887BAEF69741F94A36139FB58067DAC97A90E6DC9F1C01EA698130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2a3c4bf7d2f1c40e5024b4274e3f23b0d2c8622757b2da23987e2b6dbad3cf7f
MD5 6d646c89b1aab01b4c9e7aedc1fe96d4
SHA1 860dedbf7627f1648d1909ebb78ea301e51a9858
SHA512 33e083d57a3a9c5cba0410ce3c06e2930da5df919f01c97ecb8fb4f97bb7107297031b2cf13619402adaf51cb86306fffdd9a57b99e4d0f5f92661914a27a106
SSDEEP 192:JONWS6v+YLNQmiUyjlgZh+CGX+FdeNNmus2pU6:JONT6vz/WgZh+C9d6NIOU6
TLSH
T1E002E935AD382CAB9BF2AE05F48737135FE41177E9952F91D9E82E1C01D765C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d3d285432c40fdb162e610731e189d6024c01d8aded3d49db6ecf188f56c96a5
MD5 da194877c261c8c287c4fe8dc14aa4fc
SHA1 9acba2eb3ef2a12c80380a429a006a45c87002cd
SHA512 e9c68d88ba4ed0e20f1713008e699932125c4492076b18e9a095380fc14a0760a5165c669b1d40f2eddcd08c26543dc69ac790f656aaf7ffb210bb8b79a49fa9
SSDEEP 192:tONg6v+YLwQmiUydlgQh+CGX+FdeNNkGQN+CHHqjU6:tONg6vzkOgQh+C9d6NXe/4U6
TLSH
T1C1122C32AC385C6B9EE2A541F48336139EA55137EE893FD0E5DC6F1C01EF65C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cf5bee15fb773ba92275a5ae3be9fe56aa0c5283079ffadaa45a295c58fcc323
MD5 eab2e3bcb0e134017db8012e94ece119
SHA1 5c896489f5fa53f4f208ef4d99e3858021655e98
SHA512 2e1d9bef42d49a5fe8d0b9e960da7926483c5c2e5e72bbb60cfcf9670f720251ea9dbdcd711477ca62e1753a0dd68c5c732c5bc2a3b81d0f791cb61ded6c604a
SSDEEP 384:FZcIhsNlbrpziMtFQe+C9d6NXeb4ivX+ayok:9hCnFzFF4ivlyb
TLSH
T147827D325C381C6759F29241F5463A179FB89467E7CD3F90D5ECAF1D01EEA98130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29afe531-bb00-4610-9c1f-f651cb06616b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\29afe531-bb00-4610-9c1f-f651cb06616b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bb7fa48357f1a0a1152520fcdf4f623fdb3229bff0be3a7cb8d8dafc254496a6
MD5 f8e86f432a38b4dceafd7c835beb1bc1
SHA1 26cbd2495cfd7a7d37e144f5164f446741056b0e
SHA512 6c6ff9bc13437099016ab8503fb81b601f3c8c7984c8f8931d6aa54430800ae61e8ad5e735fccf76d10d7ee3e92de71a749cd697aa87099564b4343b028c5f34
TLSH
T121412758BAFA1148B3B77F169BF7A86E587A78732B0A94AD00110D4E0623B41CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download