3774207e031d0bc9a1aca58b31559e068e7e52b280bf0acc634d23e0966f8f60

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OEBPS/xhtml/chapter26.html
Size 25KB
Sample260824-2ckmksvblf
SHA256 3774207e031d0bc9a1aca58b31559e068e7e52b280bf0acc634d23e0966f8f60
MD5 d80e3eef78412eed1fd5c2b67b14c669
SHA1 16610e541fee60bd890ec46106393c97298534ae
SHA512 3647c8ba112a402ab43d06062be85056f50bea7d05f0a44facdcbf09ba7a84a18745647f0d7ca84e3c30fa27b349bf360d1b632366f635e16a136bd69f2c9f63
SSDEEP 768:Y+/rBhn20t3IUzEWO8TbAyOaHlCjfZn9e:53nX3ITWJ3yBn9e
TLSH
T18DC2B21BA7585B3704B281FAA11F33A4F341C13CC3569A1268BEC25B2357DB9B13B9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4800	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320839974539197"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{4298844A-B762-40AF-934E-285F2AC84EE5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5520	msedge.exe
5520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 4684	4384	msedge.exe	88
PID 4384 wrote to memory of 5760	4384	msedge.exe	89
PID 4384 wrote to memory of 4800	4384	msedge.exe	91
PID 4384 wrote to memory of 5760	4384	msedge.exe	89
PID 4384 wrote to memory of 5760	4384	msedge.exe	89
PID 4384 wrote to memory of 4664	4384	msedge.exe	92
PID 4384 wrote to memory of 4664	4384	msedge.exe	92
PID 4384 wrote to memory of 964	4384	msedge.exe	94
PID 4384 wrote to memory of 964	4384	msedge.exe	94
PID 4384 wrote to memory of 964	4384	msedge.exe	94
PID 4384 wrote to memory of 4272	4384	msedge.exe	95
PID 4384 wrote to memory of 4272	4384	msedge.exe	95
PID 4384 wrote to memory of 4272	4384	msedge.exe	95
PID 4384 wrote to memory of 6048	4384	msedge.exe	96
PID 4384 wrote to memory of 6048	4384	msedge.exe	96
PID 4384 wrote to memory of 6048	4384	msedge.exe	96
PID 4384 wrote to memory of 5412	4384	msedge.exe	97
PID 4384 wrote to memory of 5412	4384	msedge.exe	97
PID 4384 wrote to memory of 5412	4384	msedge.exe	97
PID 4384 wrote to memory of 2288	4384	msedge.exe	99
PID 4384 wrote to memory of 2288	4384	msedge.exe	99
PID 4384 wrote to memory of 4592	4384	msedge.exe	100
PID 4384 wrote to memory of 4592	4384	msedge.exe	100
PID 4384 wrote to memory of 2276	4384	msedge.exe	102
PID 4384 wrote to memory of 5808	4384	msedge.exe	106
PID 4384 wrote to memory of 1028	4384	msedge.exe	107
PID 4384 wrote to memory of 4356	4384	msedge.exe	108
PID 4384 wrote to memory of 2520	4384	msedge.exe	109
PID 4384 wrote to memory of 2520	4384	msedge.exe	109
PID 4384 wrote to memory of 5520	4384	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\OEBPS\xhtml\chapter26.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffa962ec188,0x7ffa962ec194,0x7ffa962ec1a0
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,9059082671472998411,7574477603393432441,262144 --field-trial-handle=2356,i,15958822770917437961,7395024915556754378,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,4492054413317180303,2242809327217787513,524288 --field-trial-handle=2356,i,15958822770917437961,7395024915556754378,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,14386233002195727078,3094789418079372564,524288 --field-trial-handle=2356,i,15958822770917437961,7395024915556754378,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:13
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,1759667902600930781,11712024249092304109,2097152 --field-trial-handle=2356,i,15958822770917437961,7395024915556754378,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,17582894033245948565,4768659656988047524,2097152 --field-trial-handle=2356,i,15958822770917437961,7395024915556754378,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,6358412069331397983,15790105983290874040,2097152 --field-trial-handle=2356,i,15958822770917437961,7395024915556754378,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:9
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,5077720668725440859,14945273542006614699,2097152 --field-trial-handle=2356,i,15958822770917437961,7395024915556754378,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,4031740086248056818,12159546532907156290,524288 --field-trial-handle=2356,i,15958822770917437961,7395024915556754378,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,2042667072268209632,18048066849065049786,524288 --field-trial-handle=2356,i,15958822770917437961,7395024915556754378,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,3954979105573201653,8782870716206415272,524288 --field-trial-handle=2356,i,15958822770917437961,7395024915556754378,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,3954979105573201653,8782870716206415272,524288 --field-trial-handle=2356,i,15958822770917437961,7395024915556754378,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,4014772289949953395,393832013482528731,524288 --field-trial-handle=2356,i,15958822770917437961,7395024915556754378,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,18285667100704493809,11040604355892554521,524288 --field-trial-handle=2356,i,15958822770917437961,7395024915556754378,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,4402758143435440109,11479546553460711316,524288 --field-trial-handle=2356,i,15958822770917437961,7395024915556754378,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,5310753490982039198,3443912244684704226,524288 --field-trial-handle=2356,i,15958822770917437961,7395024915556754378,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6232,i,10167203818737039688,8624826307453621603,262144 --field-trial-handle=2356,i,15958822770917437961,7395024915556754378,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3bd9206e09ea73cc5de66c3acff87c2df6bc749038ac4e757022fb39e865ccf9
MD5 dcd67f0770d8b636bcaf37534f9f8e48
SHA1 b7a16d6a8f7c9332a4506c2a63fd11d3ca87ad83
SHA512 4c6d850871b3a7c279c7e2c7532ea9e26d429abc075942c228698ecc0e25da06d0693c496c15629e83919132c9c7fc0de05e05e14731c6226340890c5e8668b2
TLSH
T15761D55623634DD1DF7744BD52E96898FAF4A895093B2EC06054BEBC48C6F4BC0C32A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599e98.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599e98.TMP
Size 3KB
SHA256 a970839610cf588822be584bb608aab3f651dd1222f556536df87c140e7972df
MD5 311b8e4f56be07a0b92e5905591cffc1
SHA1 730b065caed3635f0c8c14c0ddc35635a1eabfb6
SHA512 1ee1f4079d6d1a0d797f3a897459bc77ebcccef2468310f426c21f96a885196d433a130bbd368141dcfdf4caf64e3db5501f33cacfb135daaf14efaeba79d6ee
TLSH
T1D361C45623634DD1DF7744BD52E96898FAF4A895093B2EC06054BEBC48C6F0BC0C32A3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9a12cc4dc8c09cd1d4d5db92518365f5b08121c4ede3a17de667a9de0fd19b6b
MD5 b784a956393bafec53d7aad19feebb1c
SHA1 fd4b7df56284584f0ce6ee08470a875dad1db219
SHA512 71fc9591cdb13a2a445bfe4ef62627f3a7620d99e9bb66b639819985f4b1c4f42cabae59f002a58a143dc71c9204aaefe182c2cb5b484cfb7bf495dbcbeef5e0
TLSH
T1FA31CEF783F4856E8E0186F0AA18AE2FCE2D0511431C7C6AC5E0AE2793F3472E145A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 70bde528e4e5a144f9402a63c4ed2eae9a4bcb68fe1daedb75c3e4d481a04e08
MD5 90a1488b1cf2e40ecf5d5ba6395535d6
SHA1 4f67783796b9dec192186a0461e2fbc0ddd25d93
SHA512 f34046a3d2e7e1fa6c54ba2495d3cc241bd08dd93125a653a1fab02c8307e6d06b7fe7cd8e92f0f57e3dcfb6a169996eb4f0f7a35e61a407343b559461b8e54e
SSDEEP 192:sxRcRAb0/fxslPdprQ5RzoA8p40/g6+WNIYn8U5hF+GyIgD9J:sxRcE0/fxs9dHZ/5ITGFAT
TLSH
T1E632B6156A28A83B8CC7E21DFB55BF63D6F9503261D45E48E6FC8A1C04EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9c051fcf980fee6cd87f259cb3d6d83d37f97630d691b6360bf61d6d635d859e
MD5 c4aa330da830a02dc929ed05d337449f
SHA1 651bfd019ae95113b839347d86030c5775d7c091
SHA512 40c18e9404602a0752671a260270d9c498c983354e21ef62a4ff94b9df35ee9af67a14ace4f35e11e959077f71289bf06d998aa9831549fb984971476bc29b33
SSDEEP 192:sxRcRAb0/fxslP+prQ5RzoA8p40/g6+WNIYn8ohhF+GyIgDTJ:sxRcE0/fxs9+HZ/5ITcFAR
TLSH
T15D42B5156A28A93B9CC7E21DFB55BF63E2F9503261D01E08A6FCCA1C04EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 865f2e95cf3ee04c54a53ad7396011004d57c8f8d0bc3d02c8a4e215c1ac8425
MD5 1939bfd665ae74765c1a003e89cdab06
SHA1 ea50abae244e50dba40b0191cba665fbbfef33c6
SHA512 a7befcf1e7635e6878e085b8730ef38996ed4876d5ef17d119066556088fdfce5361bc5da93d3f167d2b6494d9176f6c508f20bddfbfe899b62d56d44c2499ff
SSDEEP 192:sxRfRAb0/fxs+PdprQ5RzoA8p40/g6+WNIYn8U5hF+GyIgIJ:sxRfE0/fxsWdHZ/5ITGFAs
TLSH
T1CF32A6156A28A83B8CC7E21DFB55BF63D6F9503261D45E48E6FC8A1C04EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 3f5cd996025c2c74f4ce57d97ef89fac0fcf025eee15f78f05f6c18e4184314d
MD5 5ba1cf4e3c2bfa9e2e0468db2709bb57
SHA1 8d6f1704dc680daeaa29fa38474e3245ca848034
SHA512 219ce26093e5cf5b1543e0872af1c5d513d26733243f615bab2be9eebd848ed105b021c276100d614e5172d4feb1d7d80d9065859b0974e133f80e5e4b7e0a14
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPbrohM/:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0Vw
TLSH
T13EB2EC3B604DCB7E5F800AADDC19AFDB7D9802C79A988D4447FE950C02C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f18ed06ec7bdfc31f84430ba38e0520ecd3b17fe37a8438df295969e31174ad3
MD5 c9a2d800456eecb04749ccda0c9e33b4
SHA1 663dd1864ad3f3cbacf3f34d2cc8c4c2bc5e7b98
SHA512 8bf57daf40c8696f7a4d2b8e936181f29b51f829f12bf6e1ccfb4ebd4f275a9f0c5b43f6e2af280f3052677268bedfbd3d55a48615e34104bfdbfdaffc5a6255
SSDEEP 96:KRklQUuSW0Wyf/gc0K4xgW0cUUfO0pH7kh1DZpVW9yogdVK4kgzVcbD94AKNiu5A:CklQUuSWLyfocIxgWbUUfO0pH7kh1DZ6
TLSH
T156912205757B1240387EF90C84A5992A96C1B8633158A67F37E841F60FA7E12CDFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 aeeab4d142704c4c05d74b751877d4287d7663a86da8b4c9c44ec7375de46401
MD5 aff8e8a94670957d0b06480b1f89eb27
SHA1 c394a8ae5b913eb5482a7ee9c7cff705c1b2f9b7
SHA512 75a308cd0336ea3267fd324d6ff3c4be226591ea5527099f7fab0085622422e161743d34d771f6022992e838299212ef1d81d90b191ecb522fe32dee21d6d291
SSDEEP 768:Orv+4UNbds3zcDZIO0ZQRIWs4Nzc4ReyIs2NeVH1S5D:ObsbS3MIWs4tc44bsOEH1Y
TLSH
T18A03CE32A8689973BCE69682F04735537EF4A21B82C81E94C4DE6F4C4A4B4DD035B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 45f336bd378c8fb1c1b17820d4f7a71322678c10bd2a52266aa304088df3177f
MD5 81c13d36581a2e484da1987d303e4c7c
SHA1 17f0ad5dbece069c81a8a220d0a83d086e3b355b
SHA512 55f1b02eb3a58c6ef87786458e6abdd9fd81295efaaed0d4b288ab43e8df3e8355633a599c077c971452e1c521061017b5775120ec0dd21245b9a12b0bc22cb0
SSDEEP 768:8rv+4UNbde3eXyDZIO0ZQRIWsZNzc4ReyIsPNESs:8bsbw3eSIWsZtc44bsVo
TLSH
T1B803BE32B828AAB7ECF65682F1073953BEF4511B82C42A94D5EE6F4C464B1DE135F813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 22f756561a196038877574cc8bab043419b08c8a7167483768771814b769b8a9
MD5 7bbaf4ddbcf31363fe45bae1d6185f58
SHA1 79f66d50b184ba7c0cbe2858fe8e315ad4ef9021
SHA512 435e2c6244d943588d98f76537c4fbe5ed0e794917a85932d5070a3ef6d46243c99b7e71e09e816526289775844aca7b49da5c3f4303d7ea0c00ad5549057c1e
SSDEEP 768:Y13yWyDZIO0ZQRIWs3Nzc4ReyIsPNfll1O:Y13yHIWs3tc44bsVf/1O
TLSH
T1A8F2BF31AC299CA3BCF99381F6063A53BEF49117C2D82D94D5EE9F1C054B69E035B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8016fb4a2059c74f4e2d3d5e95a72ef160e667642659b84d3ceba7677351d070
MD5 39387dae8bb3381725105548d8963916
SHA1 01fcc10ad9c38de963d0b4409fa42da5e0ae1244
SHA512 c1ec4f02713109113229122d38aff3542b4f719145ff42b18fd0f25fbee84e9cb45355e1d0bd7b69510661b7cb23a07b63ec5c84ef0ce81d0c88606fd9a675b9
SSDEEP 768:4L3lWyDZIO0ZQRIWsfNzc4ReyIsPNfll1O:4L3lHIWsftc44bsVf/1O
TLSH
T153F2BE31AC259CA3BCF99381F6063653BEF4511BC2C82D84D5EE9F1C054B69E075B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9e463521b3aca370c38665a12989d2ca486ca621f0e70c8efac98919576a3f28
MD5 9c66bf9938a7998be98307fd281412b8
SHA1 62074929edc1dc3f76a431e17ef6abf88298a607
SHA512 cea86780ae9204b492e622a2411a581318099b1ce2a3fe798b417b108db72152206f04be2a1e4b1453c954be111fc1ca6f2909883982c9236e7a14c39439b547
SSDEEP 768:613lWyDZIO0ZQRIWs3Nzc4ReyIsPNfll1O:613lHIWs3tc44bsVf/1O
TLSH
T1F6F2BF31AC299CA3BCF99381F6063653BEF4911BC2D82D94D5ED9F1C054B69E035B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3999c74aef9ac4d32a48f4f5a84a0bfcbfbf88c8ace4602b0f856f53519adbea
MD5 d1ef6848f3aee14128c0138092277e17
SHA1 e46fa421eed3d07f1a1409b4f04f4d9324bc920c
SHA512 b136bdc5145c6005a29880c93e60a2b9255df42d45943f21d272fa6198859f17e6897ad7f107e3fa828c4137c2cf5cc5b19a448abf3048d360d1e63262aca5f1
SSDEEP 768:6rv+4UNbds3gODZIO0ZQRONzc4ReyIsXjeVH1S5D:6bsbS35Otc44bsTEH1Y
TLSH
T1EF03DF32A8688A77ECF6A686B14B76537EF8512BC2C81E94C4DE5F0C464B5DD030B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9a92daf-2c23-491f-9535-2ddd6d80f89e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f9a92daf-2c23-491f-9535-2ddd6d80f89e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download