hxxps://claap[.]io

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/07/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://claap.io
Sample260717-e1s8asev81

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287359028131640"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{521921FA-E5DC-46D3-A895-BA883FB01566}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
128	msedge.exe
128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 6116	4524	msedge.exe	80
PID 4524 wrote to memory of 3000	4524	msedge.exe	82
PID 4524 wrote to memory of 584	4524	msedge.exe	83
PID 4524 wrote to memory of 2428	4524	msedge.exe	84
PID 4524 wrote to memory of 584	4524	msedge.exe	83
PID 4524 wrote to memory of 584	4524	msedge.exe	83
PID 4524 wrote to memory of 2428	4524	msedge.exe	84
PID 4524 wrote to memory of 4204	4524	msedge.exe	85
PID 4524 wrote to memory of 4204	4524	msedge.exe	85
PID 4524 wrote to memory of 5944	4524	msedge.exe	86
PID 4524 wrote to memory of 4204	4524	msedge.exe	85
PID 4524 wrote to memory of 5944	4524	msedge.exe	86
PID 4524 wrote to memory of 5944	4524	msedge.exe	86
PID 4524 wrote to memory of 5084	4524	msedge.exe	88
PID 4524 wrote to memory of 1328	4524	msedge.exe	89
PID 4524 wrote to memory of 5084	4524	msedge.exe	88
PID 4524 wrote to memory of 1328	4524	msedge.exe	89
PID 4524 wrote to memory of 3136	4524	msedge.exe	91
PID 4524 wrote to memory of 5244	4524	msedge.exe	92
PID 3136 wrote to memory of 2204	3136	msedge.exe	93
PID 4524 wrote to memory of 800	4524	msedge.exe	96
PID 4524 wrote to memory of 4492	4524	msedge.exe	97
PID 4524 wrote to memory of 2952	4524	msedge.exe	98
PID 4524 wrote to memory of 1388	4524	msedge.exe	99
PID 4524 wrote to memory of 1388	4524	msedge.exe	99
PID 4524 wrote to memory of 128	4524	msedge.exe	101

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://claap.io
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffcacefc188,0x7ffcacefc194,0x7ffcacefc1a0
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,8523605748042517225,14248412707706731684,524288 --field-trial-handle=2516,i,1135384921862929090,6600661162223445433,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,15041389681608073795,9315089068969960539,262144 --field-trial-handle=2516,i,1135384921862929090,6600661162223445433,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
  2⤵
  PID:584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,11015581748230558723,9948177754104187386,524288 --field-trial-handle=2516,i,1135384921862929090,6600661162223445433,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:13
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,5460870961931759832,3950337641805645072,2097152 --field-trial-handle=2516,i,1135384921862929090,6600661162223445433,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,11426881766803519432,3557216934787927470,2097152 --field-trial-handle=2516,i,1135384921862929090,6600661162223445433,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,4544910436779056925,3985982885090292960,524288 --field-trial-handle=2516,i,1135384921862929090,6600661162223445433,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,5096267269881245595,17068689509354354753,524288 --field-trial-handle=2516,i,1135384921862929090,6600661162223445433,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,7751223497786754359,4652091925025352567,524288 --field-trial-handle=2516,i,1135384921862929090,6600661162223445433,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,4485515712349402062,2404302701539335295,524288 --field-trial-handle=2516,i,1135384921862929090,6600661162223445433,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1136
    3⤵
    PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,7751223497786754359,4652091925025352567,524288 --field-trial-handle=2516,i,1135384921862929090,6600661162223445433,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,11145624606277484967,16641945844939110458,524288 --field-trial-handle=2516,i,1135384921862929090,6600661162223445433,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,15349543393103136034,18191188142402419666,524288 --field-trial-handle=2516,i,1135384921862929090,6600661162223445433,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,9117438552951783364,12156149172423034792,524288 --field-trial-handle=2516,i,1135384921862929090,6600661162223445433,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,14933806882073941885,10695633664966552311,524288 --field-trial-handle=2516,i,1135384921862929090,6600661162223445433,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4768,i,476636341128366127,17211789474231557748,262144 --field-trial-handle=2516,i,1135384921862929090,6600661162223445433,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e4712873e46a377fe63b839921de1052e24817a28c61fe30d2faa64a334ef3f3
MD5 d20b5126682901376f3cc8cc14b068bb
SHA1 5c186d5614c1fa88e2cd20096c773112f3b6c1a6
SHA512 832771a9c9556740b6e7395dca7ebe809b2292896424f929f3ef0e248fc251f19cdb38271809b2f04b8e090727a9a20157d181eed1e34d26e2d11f4b7f05b7c5
TLSH
T1A5E02BBACC22AC3B09FD271894605786E74417971B815A0F3B3CC1088FB063E464595C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 d7379e6beb6d80451b5fb124e7dd2558f328b0de73d6c96fbe49bdd29400681f
MD5 ed8c404890c659edacce5b8fd46d266c
SHA1 ea4207da6ea437344bed9ee4e7c2d7eb2a0c5297
SHA512 c609eaa058cb6b75505d45a80d31bde4200539df254a504b1834cd2927ba0821b8458fd2366535e7efc11c54c16b8801ed4cd5ea9579bb3b4d110a056b8e266c
SSDEEP 96:NUZR5W1d91V6RndIqlr0S+sm273nKW4BVjrnf:NKW1X1V6nI4+hsnKtNnf
TLSH
T10791523A85924766E7700AF297DA6B0377B076A3941F0F4BB59C8677540EFE039D8028
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe584cd3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584cd3.TMP
Size 3KB
SHA256 1a4dc41dcbda45d3a74e2bdd0bd7b6fe1aebf371d56134a0a969bd6e7f885c3d
MD5 8aa97f445b562de87a597b7db644cfab
SHA1 e388b64439a1a251c17225ddce54d12912dd4008
SHA512 ebaa6e21d6bcd0507c5de5640c165d6236d40c8fbdf492bddf019df74a688f6fcc2a0007b0c7d01b1442a71ebc8b40714b9f7e2a75ae562028a9149816cb7d93
TLSH
T14B711C3DC2520B42D3710DF3ABD9570332B075A7C92F1E4B49988577590DBD039E9038
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 ca3c1ee6ac67f36c441d9552a48443500574cc93dedc1e0757a403d3540ae0b1
MD5 04b86bcc0baeaf893d1d0c4e83c27b11
SHA1 dc84e17f9c7b8ffbf47f1f699d710f678fbbfa72
SHA512 bbc161c65ecca2f86f30ac52888afd2cf52e5b045413daf69eeee38204f0da6ef720ad6547b88360a4818ca4397f94ec7a8cd2e9a2bec62d77767057aaac4664
SSDEEP 192:D1QWzb2OcGoqt21Aaaij6BFEQTfRBIVxyoIoHybMYJ/ojw3MD9obo3rTC5GtT:D1xzb2OcGoqt2KaaiGBFEQ1BIVxyoIov
TLSH
T1C7F159B7C3F4862EDA11A2F4EA183F2BCE190515435C3E5985E4AF0BA3E2471F241B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 74fd792cb6f54f33e80c9284b6951751309d0751ba0c0d4096d619ec550fdc7d
MD5 1d3339a13105cc3383afaecab36803df
SHA1 849f1666802217e13658aeace6e01e602a1daf0e
SHA512 e0c794b8c25741462529dd273dbd6d264d0b9d80197698e9dfa97e510cab6f82c95be77362204dacb471e030e4e2fcb1e030cf1ac59f076cfeb473ed5db9681a
SSDEEP 192:sxZnROLyMqZjK1Ml8MFA/fDs+SKTG/wCzodpZlR/W6+WN4CH/Y0hnYlz+pIgj+pJ:sxZnVdA/fDs+SUHt/bB/5gSj+T
TLSH
T19562D8166A385977CCDBD219FA45BFA3D6F51563D2904E445AFCCB0C04E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e617ca4308ec238207d7f6ad23d5ac8cdcd5870d910744f8a8bc03b242811bcd
MD5 b302eb11ee95063053f7f048f7691c6d
SHA1 f53bf0987d8a72a235103b58e6436634c3c5f957
SHA512 c2b5f2ba726f16abe4a0ee8f0a30ecef5fd928c4a536dbbfaf0ccccaad1952e5b572d7517760af23de4d35122317f8759d14fd0c1960310f2480f6258ede5b31
SSDEEP 192:sxZnROLyMqZjK1Ml8UQPFA/fDs/hKTG/wCzodpZlR/W6+WN4CH/Y0hCYh++pIg5O:sxZnVqNA/fDs/hUHt/bB/5GSd+T
TLSH
T1FE62F9166A385977CCDBD219FA85BF93D6F9157392904E445AFCCB0C00E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 25298c0c9a05a2ae3f381abf174217b076b8919bfa22cb8061c36fde327ab410
MD5 b350dd3f6ca3e91c5ee9583662447171
SHA1 8ce9bf30160028935e2880bd95d63749ce4a30ec
SHA512 d74ca5c147f9bc11f26b891a6810ce6a48a9522157b22e65acdc5eb30d6e38491d6f8e9e9b28422a3e6bf1635592a1e3bcc5862232ac824874247a83c1812a65
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5k:GZLVDJjEDPV0/ZdwPiUHgUaCS2
TLSH
T15EA26B1232BA02023C7D391C92969B674A82F5633069ED7F7BB900B54E67E125DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a27cca48-ec7f-4efb-b9bf-77fc426b61df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a27cca48-ec7f-4efb-b9bf-77fc426b61df.tmp
Size 31KB
SHA256 bb38d2843fac1676545fd1dbf46602eafc3617f0c3745aa49a1031db89ab22d5
MD5 c258ab0ffae4e902108528daa451bbb7
SHA1 94e44101cf4854bc8266cb0bf62310392e8e9398
SHA512 3ec692d2f7ea16ccdd85ca60febe9a9af8d14ee54e97dc94bcb3cae8992bb419a44865ee591a8d960ffbbb2f42a725ba3cb82349855708e5bfdcf7a2377fc549
SSDEEP 768:wQAKq8y028bWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L4Ll/f10EMEroSO:wQAKq8y028bWRmj1QWTu1jaKL4LpfiEC
TLSH
T1FFE21B3B284CCB7E4FC44E9CED276E8769D802CBA7588D5447FA494C03CA3EE511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0f57e467446cf706f57cc4928f32c78204d39719fbabdfdcc6fe5a08167d04e4
MD5 64112446f60095c9afbd0e71e87ad655
SHA1 87810d24733652044c424d43b7baa4764325fc7a
SHA512 f50c4a32436078514529a74c5dac19c5d5572391eeb142e4c69501845a831574f5d2bf8cba5ccdd2f6399f04cac53f42f1be9a65e55c3d3cbace49480620c260
SSDEEP 384:nPiF9CcmyWCm38NT8TUNTUlIRPPm3ek32nn9tExe4JfbgGGkp3sUqsjn2/wabtye:aFccpm3AwgFKekmkiGLVDowaSa
TLSH
T1BAC24932E864DABBACE64ED9F74A3643DEE04163968C9AD4DADD1E1C00DB0DD034B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7ee7b5a642940d44e44a69c440850d3b0099c59f9c36383a0ecfafc0a50a6e07
MD5 9e6ffa5bd8213d3853e2730b4e5bf320
SHA1 aa2b89c2b2a9d6463a1950f95a41392e0e365652
SHA512 0c73b98eea163ada17d113aa90be2f266598a659fe3331fedbffb59884956ab8edb3176d8d922cd50be747d96761a3c84c95699dff73185a4f5436163b830c6d
SSDEEP 384:nPiF3tNn/s3n9Si38NT8TUNTUlIRbPm3ek32nn9vExe4JfbgGGkp3sUqsjn2dwOz:aF3j+933AwgFKekmGiGLVD4w29MG3
TLSH
T1D2D26B32E854DABBACE64ED9B78A3A57DEE00163968C5EC4EADD1E4C00D70DD430B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 40e92c85c925f7f43656763078a02e770a09453da3c65bc49edd5206b1464c3c
MD5 a561f0036d6e3350f12af0750308abee
SHA1 3dc097741ce52b26d286858fb39f32af0efcb61f
SHA512 d79893b3a01bac9e4cf97d2fc0933527595b3bb3f8d10854eb8a1015fad7ab6a4ed74e8f743485168a56f678a406590447134086627dd9edb4853064abcbf5bc
SSDEEP 384:nAiF9CcmyWCs38NH8TUNTUlIxBPm3ek32nn9PVv4JfbgGGkp3sUqsjn2+we4KV8V:bFccps3QwgPKekmrtGLVDfwI8p0o
TLSH
T132C25A32E858CABBACD64FD9A78E7542DEE04223968C9AD4DADC1D5C00DB1DD434B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 909706a0b31b4c539e6940f47fc3cdb5ae7154e4ea5253a7303b1ed874cecabc
MD5 e32c58b299cc3c3c9e3b9a6c2c1ee960
SHA1 effc515ab1c8095e75984a57d6267ca1de0df2fc
SHA512 beec7a76953eb2c864bc18e693df88e2ba43d652d755c2347caafa770c7d7e86a4759105ca20ff685b691301e84709c65f58159647865a1c06771c3e8230c183
SSDEEP 384:nKiF3tNn/s3n9Si38NT8TUNTUlIRbPm3ek32nn9vExe4JfbgGGkp3sUqsjn2dwOz:BF3j+933AwgFKekmGiGLVD4w29MG3
TLSH
T138D26A32E854DABBACE64ED9B78A3A57DEE00163968C5EC4EADD1E4C00C70DD430B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 bdcf435c137be59fc86a8bade9b3c925b4f78f15daaa416f9bfe3657ca21e855
MD5 366727e9cc75290b83b273b90c0c9a97
SHA1 938505c35bdb73dd942314d82f461ff452b8c70a
SHA512 7b0fa1956424cbba008e22096ec7a0ab5e5621e862d8a657bd9fa364c55bcc8ff4554ccf3f45d9afbbac175053013e318c8797e0b0153bb2b88d188d69013259
SSDEEP 384:nMiF3tNn/s3n9S838NT8TUNTUlIRbPm3ek32nn9vExe4JfbgGGkp3sUqsjn2SqwQ:3F3j+9H3AwgFKekm6iGLVDjqw29MG3
TLSH
T1EFF2D4F298D78977D89E4B97A37E2D169AFCC113B6884984B7C81D0CCC860BFC306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf01c09c-cbac-4012-a29b-2d352472b7eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cf01c09c-cbac-4012-a29b-2d352472b7eb.tmp
Size 25KB
SHA256 dd280115fcc395ed263c6dbdca8299dc61d3a5c48a9cdd6e0b95686b368b24aa
MD5 dfc75e11b10be9f75b5efa93c5a6ac4c
SHA1 148698dc4f205c1557a04ff946abc6a02a8d653f
SHA512 cedbc33115b9c4666b45dd638c968f5bc2daebd048fbe8bf8537084b0193c87d1d1fe32e72f0e5d8f97f6e597527151028805f9f41b4e307171df37d804b253c
SSDEEP 384:nMiF9CcmyWCs38NF8TUNTUlIxBPm3ek32nn9BDQws4JfbgGGkp3sUqsj/3Me4KV8:3Fccps3WwgPKekmrLsGLVDN3MI8p0o
TLSH
T19BC26B36E868CABBECE64FD9B74E7A42DEE05267958889D4DED81D0D00971DC134B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5244-368-0x0000024FC83C0000-0x0000024FC93C0000-memory.dmp

Download