5dd0110f95ec8ca5c10fb0451f09d4a131950855cdd2c75a3d2359067492487e

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OEBPS/xhtml/chapter14.html
Size 16KB
Sample260824-2ckmksvblf
SHA256 5dd0110f95ec8ca5c10fb0451f09d4a131950855cdd2c75a3d2359067492487e
MD5 29f71381931da9d0e0a7f257e24b8dc8
SHA1 0bbfc019316aa5a61c9f008875c3daf3a4bb364c
SHA512 499eecacf2dd7cfa6c3a083662ece67c1d0af2ee98e335dc87f29bccabbd8cfb14d2d2130fb3a9479906fc40bc91cc58fd9f564787ad8e1751982d35039468a9
SSDEEP 384:HKxrphCXuX/VhT5owFJbsaokn+yZfd3dwVwCWyvkq9umqgGT77RK:HKRUU7u4bs+l3dV1q9k7lK
TLSH
T1D672732B93441B3742B64279BB1A77B1F353C43D8311146668AEE3ABA302C74667F9F4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5092	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320839961151723"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{5A440AC2-6863-42C3-AD96-DBDB2C992050}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2508	1648	msedge.exe	85
PID 1648 wrote to memory of 5092	1648	msedge.exe	86
PID 1648 wrote to memory of 3728	1648	msedge.exe	87
PID 1648 wrote to memory of 3728	1648	msedge.exe	87
PID 1648 wrote to memory of 3728	1648	msedge.exe	87
PID 1648 wrote to memory of 1588	1648	msedge.exe	88
PID 1648 wrote to memory of 1588	1648	msedge.exe	88
PID 1648 wrote to memory of 1632	1648	msedge.exe	90
PID 1648 wrote to memory of 4832	1648	msedge.exe	91
PID 1648 wrote to memory of 1632	1648	msedge.exe	90
PID 1648 wrote to memory of 1632	1648	msedge.exe	90
PID 1648 wrote to memory of 4832	1648	msedge.exe	91
PID 1648 wrote to memory of 4832	1648	msedge.exe	91
PID 1648 wrote to memory of 4700	1648	msedge.exe	92
PID 1648 wrote to memory of 4700	1648	msedge.exe	92
PID 1648 wrote to memory of 4700	1648	msedge.exe	92
PID 1648 wrote to memory of 5012	1648	msedge.exe	93
PID 1648 wrote to memory of 5012	1648	msedge.exe	93
PID 1648 wrote to memory of 5012	1648	msedge.exe	93
PID 1648 wrote to memory of 3624	1648	msedge.exe	97
PID 1648 wrote to memory of 3640	1648	msedge.exe	98
PID 1648 wrote to memory of 3624	1648	msedge.exe	97
PID 1648 wrote to memory of 3640	1648	msedge.exe	98
PID 1648 wrote to memory of 536	1648	msedge.exe	100
PID 1648 wrote to memory of 2380	1648	msedge.exe	118
PID 1648 wrote to memory of 3840	1648	msedge.exe	119
PID 1648 wrote to memory of 3932	1648	msedge.exe	120
PID 1648 wrote to memory of 3932	1648	msedge.exe	122
PID 1648 wrote to memory of 3932	1648	msedge.exe	122
PID 1648 wrote to memory of 3304	1648	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\OEBPS\xhtml\chapter14.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff8e9d2c188,0x7ff8e9d2c194,0x7ff8e9d2c1a0
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,9644131854770597036,5826712465690678052,524288 --field-trial-handle=2276,i,15667922511439607049,14735859820183673595,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,10122584940710315560,4617901717153783013,262144 --field-trial-handle=2276,i,15667922511439607049,14735859820183673595,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,11057759674188596314,6441407659469622924,524288 --field-trial-handle=2276,i,15667922511439607049,14735859820183673595,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,5426768994535173083,13924617926377469035,2097152 --field-trial-handle=2276,i,15667922511439607049,14735859820183673595,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,9370597220307637337,12897172907433608717,2097152 --field-trial-handle=2276,i,15667922511439607049,14735859820183673595,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,458881689073589370,15964766758197750294,2097152 --field-trial-handle=2276,i,15667922511439607049,14735859820183673595,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,12002210327070022829,15189826814545722342,2097152 --field-trial-handle=2276,i,15667922511439607049,14735859820183673595,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,17028167126388794058,17486860156159489193,524288 --field-trial-handle=2276,i,15667922511439607049,14735859820183673595,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,5930180234954887318,334606632441946640,524288 --field-trial-handle=2276,i,15667922511439607049,14735859820183673595,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,2948867652446001537,2209982762690692226,524288 --field-trial-handle=2276,i,15667922511439607049,14735859820183673595,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,2948867652446001537,2209982762690692226,524288 --field-trial-handle=2276,i,15667922511439607049,14735859820183673595,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,7458602082184223251,17101349202501820225,524288 --field-trial-handle=2276,i,15667922511439607049,14735859820183673595,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,18283307198981099340,12420731198491323314,524288 --field-trial-handle=2276,i,15667922511439607049,14735859820183673595,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,8449350727834645505,4184700604594859041,524288 --field-trial-handle=2276,i,15667922511439607049,14735859820183673595,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,2498849058313897316,9774292108510801866,524288 --field-trial-handle=2276,i,15667922511439607049,14735859820183673595,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6200,i,13595746295966367704,18349514582351464757,262144 --field-trial-handle=2276,i,15667922511439607049,14735859820183673595,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 63d70413d3301caddb6aab052da3d76f99f539965b9d8205146d7b3eb772571d
MD5 d8423e3ea1663ed37b7eb45876f20a69
SHA1 fed99b3567056a718cfef976653882e5160c9afb
SHA512 a3a0854badbcccab2c91c6a68d91c53b0faf7801cd0d3c9cfea2fbb1e71da8c4822d1c0fc9849bbf6755ed0c085ca28505be25920a4bfdf80094edca0e0641bf
TLSH
T1B2613B380B5E0482E3A116B1B4E20105707082F9FB8FDE4DEF149DF55A3232AC99249B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bc46.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bc46.TMP
Size 3KB
SHA256 6821428a9454292111791c8fc4544bc1e59e49bd1d1914bcd303677e440e9ecf
MD5 67170c21351f5743263e0590116ae392
SHA1 4e04f1c9cedcd9a76b55f07e4e68d657790ec2bd
SHA512 9581cdb3996cc8345b13c6697a6c29bc6c4039bea9e6d14979d00948dbf09d19e9304170bd098800f6099c47dc116abc697908e5435889dfb321f1db60909b13
TLSH
T1F0613B380B5E0482E36116B1B4E20104707082F9FB8FDE4DEF148DF55A3232AC99249B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 8507f20408ec51b5c88d639409279710f808ce80c4a670490ad2437e376324cd
MD5 8f7c577f3305768348d8d947f662046e
SHA1 0a861d5dcf684f4c6c9cc5aadc38ae1fde0cd044
SHA512 86b32f7e788333c56f5bfad550c916befbd711125527998bccf6afe947f312777ecdcd2fb898622a702f4372cc49d83e67ad3d34b0b7b9d7d3e959ad1628018a
TLSH
T1B0113AF3C3D5956E9D0116F49A28AE2BCE2D0A06421C7C1989D4FF2BD3E3479E10699B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 acc2251d8fffd61047afddfccca5a1567308df9ef6682852e04f9761272c87f3
MD5 7542f87b17363a4f6624a4985c0cf311
SHA1 35fdabba89c1fb810282e43a4b7626df6bfcd336
SHA512 bd1de42bd05ed778a59bbd317fe50112650e6cd3169edd49723baa85b0e66bcc5753ee6c5dc9f3fd490f40844cd82ec84dcc1aec08860ae64178106a39f697a9
SSDEEP 192:sxZBRtyM/jK1Ml8UQIkK/fBsRqApukIdpH1HW6+WNGY9Ik4J5Ig5KJ:sxZBDqrK/fBsIApKVHbG/g
TLSH
T1D352F8126A345977CCDBD21DFA51BF53D6F4547292900E44AAFCCA1C01E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 153b51107a5346143cc7687413c72e8b0b5bd410ecfb520dd7296295f2f86fff
MD5 717ea2830b804a133bf9f258e0745440
SHA1 9f2b06c89706ae73d4a0eb70c78b6999c1c53245
SHA512 fd89dc84ee2dc774def70a0dcc7c3e5c01c90539f602d038bb43acac60e74e453658e6f525dad1a57e30ba3afaeed8bf08190837478a0656ec263ad5cbee02b5
SSDEEP 192:sxZBRtyM/jK1Ml8MkK/fBseqRpukIdpd1HW6+WNGY9IK1J5IgrJ:sxZBDMK/fBsdRpKvHbGs9
TLSH
T1EE42E8126A34A977CCDBD30DFA55BF53D6F4147292940E44A9FCCA1C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 edff2a1c356931960fcf1592757bd5fbd7dbebd8a44cf44984594820fd6e784d
MD5 a8102648c74308efbae8617adf768d76
SHA1 4823e31ecc73eb7f9f0ef24a38623d4d57e372d8
SHA512 5e0b6999203a4d70c0054225f6b973e686f2a16dd6b94f16f9064da01a8591bca0d8f7734f50950c7eeb27ddad4447498e5d4d280ab70636fff566d2d18c5177
SSDEEP 768:ujcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNNrobg6iN:ujcv21wWvu+Z+u1jaeFLeRNmbE
TLSH
T117D20A2B280CCB7E4F841E9CED2AAF966DD801CB56988D5447FA884C03C77EB511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 05128d2f70f5b932825567f503df4ff110a3517682abec86eb80a3610b95c259
MD5 d9581cf3be36df6167fd767924996282
SHA1 3e421103d476dc1d16c19fe64685adf09b6950a6
SHA512 291116b7921e77417a9948863de6d80a67dee8b603eba6ae4b72b261cb72424038f666a6d6746f71c3ed3a1f1aff099721abc28aaf72432fcac79e4056c4fdf3
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDWGpSKS8KuH6KsoT:mTi19w
TLSH
T1EA91870930BF02413C7EA85C9695D6366F82B1633458A47F7BA800E24FA7E219DFD9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cebe348f00489f61cf3c44166a471ec2b8956324a532ee98f7e98d54da18ef29
MD5 40d2149c59269e6737c771dc8b40ab56
SHA1 32aed1668b382642b10ace617cb34b428c941e64
SHA512 b233c1d1908dee678c8c0464ffe83e29867aef095a1c732080f3892c344ab081087710275f488db5e19bcb9e0389573c4ce5d5b536b00e122b2dbf8d69fd7f38
SSDEEP 384:kGZcIhsNSaHqKziULoe+CBd0esFHiv6+aUob:kUhoqKF7JxsFHiClUk
TLSH
T1EF828C31AC385C7759E6D241F94739139FB89063DACA3F90D5EDEB2D01EE6A81307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c3ba8529253a3bd55c4b790c2ea86d1546ada376e373912b11d6b6e30e5f0b09
MD5 3e1a221d26feaa244722ea67b0dd48d0
SHA1 e2f50f818c00ab4270c72b8557f23d486f8ed6aa
SHA512 a4b697eb3d0eee098a8ee68412667548bb99a0c188c980373b4c8ce52061f33ed4c0124c42132666f4a9fb8b82915ea5125d455aa7780e4e4371f85bae65e116
SSDEEP 384:lOqZcIksNSLHqKziULoe+CBd0esUHiv6+aUob:l5k5qKF7JxsUHiClUk
TLSH
T11E928D32AC385C7759E2D241F94B39139FB89063D6CA3F90D5EDEB1D01EEA981307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bbb6fdd2215733db3735a180363d0395f30a0828a0ea4652b917ae72e3d79110
MD5 09bf0f8b06823a1db0f6a9eab5350a0e
SHA1 634a946d2789c86e2d7ef873d6a53b01af35db15
SHA512 b3bce3d8111aea3bb81f022b83eceef9df6a0e6b4ce10d35b312fbf08c24009cc8c7a5fdf6edfd758a81fb862b7dc0cfc8bb98bbfd8936852405795c71f25d28
SSDEEP 192:JONa6v+YLNQmiUyE7Zh+CGD+FdeP9ospusEK2AU6:JONa6vz/tZh+CBd0esJAAU6
TLSH
T1CE02E935BD382C6B9FF2AE45F4873A275FA82177E9912F84D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 762e8d17af4eb4f29ab32cb737f2397e3643f0416474060de65f46eeaca8a8d2
MD5 b0ee177c37edbe7e59053625bcd6aa01
SHA1 05f6a3aef9319650f595869a339c6b0314310e29
SHA512 b5c2d284d735cd574fa2edf053b0c4f50110f9567a1ed0d9e4fd227f286da6936747e18c724e7d07d877b6637722d2604e998ec426931a7dc90946c68f316bce
SSDEEP 192:6ON76v+YLwQmiUyd7Yh+CGD+FdeP9osNOeBqCHEPq1U6:6ON76vzUSYh+CBd0es5HU6
TLSH
T17D122B35A8782C6B9EE2A551F48735139FA55133EAC63F80E5EC2F1C01EF69C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 57dd9ba2e23ba44186bc468083b2ca63a2577f16c05f68ee0a282e4b6b622dc8
MD5 bda6f42429bca3fc64ea0524f4f8aea5
SHA1 2a3e357dcdd41088ebf26d3a70c675aef33662ff
SHA512 7072e12c0d9fb8ecdea209a74716f0221c006eec48f09a9a4a35ac7b5c8e7eb3332845e8bc5da99c8a65a57ac5840bf623f1154fc85a876b17ab38e9bf66c3d9
SSDEEP 384:dGZcIhsNSLHqKziULoe+CBd0esFHiv6+aUob:dUh5qKF7JxsFHiClUk
TLSH
T16F828D31AC385C7759E6D241F94739139FB89063D6CA3F90D1EDEB1D01EE6981307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000d8d26-262b-4e9e-bb2b-e7a9cae221d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\000d8d26-262b-4e9e-bb2b-e7a9cae221d4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 175f4783b7d3a9b00b83c7d2b0925b754d95b22c3bd3f371aab2f521f5f15422
MD5 3b77beeb00afd12121ee1c69c63c0eb5
SHA1 380b72236ea484e6ce8f0bcd401a63cfa5fb8fbe
SHA512 6597c2fdcd549ce3e173d68a4328e4718570f654339ea96c64cbf1e35520d4ae81d7578ca9053e316710d4cfae74165d3bfa20c20cc39fbec923ae7944db0459
TLSH
T110413E48BAEA1148B3B77F565BF6686E447BBC772E46D45E00010E4F0963B40C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download