049e38f4190eb9d3daa90a97a10d3650821369aa64545fddfbdc9b63d98f74d6

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OEBPS/xhtml/chapter27.html
Size 26KB
Sample260824-2ckmksvblf
SHA256 049e38f4190eb9d3daa90a97a10d3650821369aa64545fddfbdc9b63d98f74d6
MD5 5d65984103c9d2ce1fa5918f71a99767
SHA1 13e91156d5b351c77497996e85f258f4acc9d3df
SHA512 54a1096d172ebb624eae4af393256143cb6a9f396c3f6948d287c40e18d966317433a36c19c88c011e078d32e0e6be7968bf0f27936cd146af5978ffcdd47f93
SSDEEP 768:+ZIElmwUexvJtD4pLuFXYFi+aslHlkKON:AowUIvJZ4pLutYcqnjON
TLSH
T187C2731BA744173716A251BAA64F37B1F342C13C831695223CBEE267A313C79A63F5E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
832	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320839949247382"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{DD554294-E6E0-489A-ACF5-40ED1ECF37A0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe
5748	msedge.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5748 wrote to memory of 2096	5748	msedge.exe	85
PID 5748 wrote to memory of 832	5748	msedge.exe	86
PID 5748 wrote to memory of 1092	5748	msedge.exe	87
PID 5748 wrote to memory of 1092	5748	msedge.exe	87
PID 5748 wrote to memory of 1092	5748	msedge.exe	87
PID 5748 wrote to memory of 2116	5748	msedge.exe	88
PID 5748 wrote to memory of 2116	5748	msedge.exe	88
PID 5748 wrote to memory of 5576	5748	msedge.exe	90
PID 5748 wrote to memory of 3828	5748	msedge.exe	91
PID 5748 wrote to memory of 5576	5748	msedge.exe	90
PID 5748 wrote to memory of 5576	5748	msedge.exe	90
PID 5748 wrote to memory of 3828	5748	msedge.exe	91
PID 5748 wrote to memory of 3828	5748	msedge.exe	91
PID 5748 wrote to memory of 5776	5748	msedge.exe	94
PID 5748 wrote to memory of 5776	5748	msedge.exe	94
PID 5748 wrote to memory of 1528	5748	msedge.exe	95
PID 5748 wrote to memory of 1528	5748	msedge.exe	95
PID 5748 wrote to memory of 5344	5748	msedge.exe	99
PID 5748 wrote to memory of 4492	5748	msedge.exe	110
PID 5748 wrote to memory of 4472	5748	msedge.exe	111
PID 5748 wrote to memory of 4336	5748	msedge.exe	112
PID 5748 wrote to memory of 3432	5748	msedge.exe	113
PID 5748 wrote to memory of 3432	5748	msedge.exe	113
PID 5748 wrote to memory of 4316	5748	msedge.exe	116
PID 5748 wrote to memory of 4316	5748	msedge.exe	116
PID 5748 wrote to memory of 2556	5748	msedge.exe	118
PID 5748 wrote to memory of 2556	5748	msedge.exe	118
PID 5748 wrote to memory of 2476	5748	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\OEBPS\xhtml\chapter27.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x27c,0x7ffec4a1c188,0x7ffec4a1c194,0x7ffec4a1c1a0
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,5537951276635950628,15054162776596014868,524288 --field-trial-handle=2292,i,10853163405598733992,5106909979337199159,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,7623748077986012567,11848792305809962823,262144 --field-trial-handle=2292,i,10853163405598733992,5106909979337199159,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,16941467207942157187,17299501485941223228,524288 --field-trial-handle=2292,i,10853163405598733992,5106909979337199159,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,13769092359938173175,5074679532585743913,2097152 --field-trial-handle=2292,i,10853163405598733992,5106909979337199159,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,7532938721318761228,4857121441104102395,2097152 --field-trial-handle=2292,i,10853163405598733992,5106909979337199159,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,13442797161834703933,4427642982010918993,524288 --field-trial-handle=2292,i,10853163405598733992,5106909979337199159,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,1547765277851725756,16844684992854706048,524288 --field-trial-handle=2292,i,10853163405598733992,5106909979337199159,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,13027997457909592285,17816781685241095474,524288 --field-trial-handle=2292,i,10853163405598733992,5106909979337199159,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,13027997457909592285,17816781685241095474,524288 --field-trial-handle=2292,i,10853163405598733992,5106909979337199159,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,16006848982049329096,6913549240248254844,524288 --field-trial-handle=2292,i,10853163405598733992,5106909979337199159,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,4672781613084176196,16618030771654305532,524288 --field-trial-handle=2292,i,10853163405598733992,5106909979337199159,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,3615967001740120291,11137443193010129630,524288 --field-trial-handle=2292,i,10853163405598733992,5106909979337199159,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,4073731343255809211,8322707651024700465,524288 --field-trial-handle=2292,i,10853163405598733992,5106909979337199159,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,617293245401640364,14816100258925612897,524288 --field-trial-handle=2292,i,10853163405598733992,5106909979337199159,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,14459307361231814209,12540412415723691064,524288 --field-trial-handle=2292,i,10853163405598733992,5106909979337199159,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5328,i,10058128123878371884,2553980100247307415,262144 --field-trial-handle=2292,i,10853163405598733992,5106909979337199159,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 4697083c7eea9f1e47c11606dec230dfba4ffc404278acb6cfe3f8e51a74f2ae
MD5 2b525c42404366a61c883b3ae93e7aee
SHA1 55a60a120c2f2c79fe5dea1263e59101d1dc4826
SHA512 e5f147af4af6224e37724087ae3726395b0553f2124a46eab1929ab221f14470493e87f55898e30fbb1a9acb1e3225992916b774c14a9837c804ef93f6dbb861
SSDEEP 192:tjcE1tKVeVeVeVeeeBBBBBBBBBBBBBBBBBBBBBBBBAeh:tjcE1tK8888eeBBBBBBBBBBBBBBBBBBt
TLSH
T170F13B0786A4C39A9F0954DB8DA0925C04B0770FEBDCE5981B8CDDD9318E8DFE5E1AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7ad70853e771728b47d6179f4114b0beb078d849bbf2db5cf41f26db89a10dc9
MD5 0053d1c562f1e429c7a41549fdc8c14e
SHA1 df3cd9686896ba7e8a848af2d559ee33d13cdd5f
SHA512 fcd5f81aee5bc6267426c2b8f3529192434e83d8414e87754678faa5fd01925e3a6a6124a24cbe15a3acece74f3d89f3925a14ad41400ee933a4dea60eca1a5c
TLSH
T13DE022B6CC22FC3708FE4728A01D8F56E70013272A40894F3A3C81088FF4A2A46C986C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 92dfb3fe197963c4c1cbfb75b4c0c84f954d8b7849f158c9de1056693979fb4f
MD5 4ccdf4db07ecd465ca366bb529808357
SHA1 f58a5c1adbc05b306d86783fdc1be27bb8fffb5d
SHA512 ef0c154fa8c9c04c19fb4f17a16a642fe42ea66cec3072f74456f23c189f68827aa725ebefe128bf81465a405be572ff654014f78aa36e935758a519d3a847c2
TLSH
T12831E2F783F4856ECA0196F0EA18BE2FCE1D0515432C3D9A85E4AE17D3E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3924a55dc875f04bd8052904f04364fe13b41abde03ed188ae327a859b0be16e
MD5 99d0bfd75808e69cb259fb5e818f54dd
SHA1 f0d94c7c186177b8d157e7a518155f3d4c303d61
SHA512 6687115597341af69f0c3a2b2ac0407c815e61cb86510dbb6d6655fe62758b7a4d2d8af95be1354fd689b059d4dac2d35cdc0007129cde7c1749ec020deb7e90
SSDEEP 192:sxZcRfyMqZjK1Ml8UQ0kb/fMsiqaZd+zodpHWHW6+WNGYvVBdg7RGVIg5u4J:sxZcAqPb/fMshazl2HbGEg7gMc
TLSH
T10862F8056A34597BCCDBD219F685BF63D3F91562A1905E44A9FCCA1C00E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 619f693241a15838c88f0c2a42780c1e73be3896d8e8cddbaccec8309b5851eb
MD5 2abc9401b61405354f67e4bac50ce623
SHA1 03c91cd1e245a61795ab71b2121fa9c63eeab5c1
SHA512 3b840c15b2cccf74c3e91147fc240a53e9cd6ac4cd9fba385b1e8e6412792ae69546ce584ed5f5ec55915cc475326bbdaf968f7934b90d97140723349a731460
SSDEEP 192:sxZcRfyMqZjK1Ml8Mkb/fMssOqPaZd+zodpHWHW6+WNGYvIuBdC7RGVIgj4J:sxZcAMb/fMsstPazl2HbGsC7gjc
TLSH
T13462F8066A38997BCCDBD219F645BF53D3F91522A2904E4499FCCA1C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 6b6db1dc5ef4e0761c6e3691a9634795db17d8ec37e787c195e4439839a52f94
MD5 a27529c7c8ed0eada23225b732da7fc1
SHA1 2315ac834bd1c7b6ede32e644ffbe6c7d88bfef2
SHA512 6b0ffa259c85943df07a420457d72dcc2956fcec9070a206d91b0036c5b71bc6f26a3609ab723308679a4f9fdf7e998206493fbc4ea82bed81fe55f37bb327e2
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGd:05ppxnY753RNBvRJJdt7p5J9zx/6m
TLSH
T181B27A1A713E0211397E2988B39696365F4235A37058E4AF7FB814A14F67E224CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c1a0b17d0a1fda0b810d23d9e45810705a4574c9291f8ae8c2de1b987add0911
MD5 1feb231e03b08bd4d5911edb63e8e46a
SHA1 25c41ad5bcc22cdbe9d559ce9ffe60c72359e6dc
SHA512 2d96c140a13d630cc898fd5f4bbf9e3015d57b493a61dc97c3a4e8428615843f572831d1438a036ef39086779943607102f12030f1690bb4d3ee1fe449ee313f
SSDEEP 384:nxiFiZcIlZ3sNs8TUNTUlI4uQckCrgNAphiftGnKBqYb4Tptsiv6+arty/7Iguob:YFQ73VwgnkRGoGwqYETptsiCl5k
TLSH
T14BC23A36E8A4C9BBECEA8B85F75A3913AEF4415385CC9AD4D9DD5D1C009B1DE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7aec5137c165805d7589fab44b5dea4dcf01d0f6f2e2499f3518892f76180131
MD5 2064f769c34c99510eb56e39272b4fcf
SHA1 3ae940da7c6ba87599d44124b54891f8874e7ff3
SHA512 a193ffb379d4c1bf43441d782bae116077bff50ff920223d8fa53b39499b48210b93cfd14fd6839c0a6463c96cf0bc401549216250107ff4a3239747c83bff43
SSDEEP 384:nJiFiZcI+3sNs8TUNTUlI4uQckCrgNAphiftGnKBqYb4TKtsiv6+arty/7Iguob:gFQ+3VwgnkRGoGwqYETKtsiCl5k
TLSH
T161C24936E8A4C9BBECEA8B85F75A3913AEF4415385CC9AD4D9DD5D1C009B1DE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a83035783a90b340f5167e605f089deb750b03e686a6a37fddd2373319ba71e4
MD5 423176cfeccdffa68a2ca2bcea0bd6db
SHA1 5a0ff16c4b93369889f06f3f3a3cc0238b291763
SHA512 1eaff40083b92b4a983a96b55b88571f7a8a4937b96bcd813b8c1529ee7837b63de320993a161c59dda1052f73181bf59513cb9d36650c2dfc6e0568a8d335b7
SSDEEP 384:np0iFiZcI+3sNs8TUNTUlI4uQckCrnNAphiftGnKBqYb4TKtsiv6+arty/7Iguob:pPFQ+3VwgnkgGoGwqYETKtsiCl5k
TLSH
T17BC24A36E8A4C9BBECEA8B85F75A3913AEF4415385CC9AD4D9DD5D1C009B1DE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ce35c944654ded958a3b4c4fe68d919bb6e7a60b6ddecbc1916b2c85b75e1c15
MD5 08d0ea80a356c37ba444cd485025d62e
SHA1 59004fd55a392e3b1e4ce54e020540996bdae954
SHA512 97aa9bdf02bba561e6aea6f72a2fe4984fc4c42ccb222d13725c509a639b15490c9c7a1f3f7ec025ca2ea304cdfdeae229a486b8d0baee72dcf6acac55e9da54
SSDEEP 384:npHiF9CcmyWCs3sNJ8TUNTUlIm2QckCr9l+KphiftGnKBqYb4mHpme4KV8p0OHB9:pCFccps3QwgbkUckoGwqYEmAI8p04n
TLSH
T1DCB25B36E858CABBECE74F89B71A7A03DEE00167859C9AD4DAD81D0D10971DD030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0d9c4fc-d6f9-4070-a314-b6289b49d22d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a0d9c4fc-d6f9-4070-a314-b6289b49d22d.tmp
Size 25KB
SHA256 e645c0d47f515fd55364c516bf45c03e5cc000f2108da4b573c01abf4e0cb98d
MD5 57d8cf18da9b538d44451eae0b7c4d95
SHA1 263ad767d3efc75371a3a05c5e45087b6a54978d
SHA512 f7f2180625afc05d0cea4bd4a62492f036efff38776aa7ba211ec6a6dc2acbd186d78d41cbe5a67fc82224c0b2651c903a8382e5c392fa1db20a6a8b47bcd841
SSDEEP 384:nphiF9CcmyWCs3sNY8TUNTUlIm2QckCr9NvNphiftGnKBqYb4T8tse4KV8p0OHB9:pIFccps3lwgbkUhDoGwqYET8tsI8p04n
TLSH
T1B9C25B32E858CABBECE74B99B74A3903DEE04267C58C9AE4DADD1D0D109B1DD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fec7a8a85b7ebf2238ea0931e3aee8db63cab844629e403307359c06198dffce
MD5 4744c9db27aac477d30e0eb12b0425db
SHA1 b293af1ff62505964f4335fb321402538c796266
SHA512 0e075fbb1d04d88081b63f3cedecdebe0be8b4d3249b7d384559c05086a2f719dae7be411b2de372e89e9bbd4330f7e3da6e29d7c319c8b16966c2f52fc1d2ca
TLSH
T18E410958A6EA1158B3B76E1AEBF7686D487BBC772E06D45D10110E4F0A23B05CC71B37
MD5 SHA1 SHA512 TLSH

Submit Download