d75a3bebf581336f672596bb6cb4637c287a0d6390066bcd5f4001f10f808fea

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Galaxy Swapper v2 cracked.html
Size 222KB
Sample260718-tht47sav3v
SHA256 d75a3bebf581336f672596bb6cb4637c287a0d6390066bcd5f4001f10f808fea
MD5 2252e67e4f4e9990b5554c9e93b9ed7a
SHA1 66a0e2130b61ee94c8dcba248a70f583eacf9be9
SHA512 180d42381b8e5ee4b9d08498cbc982ed2a6c33ee545e0e42f156d010b41378aa399d66050b5aa20f6debdbda9b7b790b9b647ea20f7fc6060094da41143e011a
SSDEEP 6144:bgUPFLxfprwz/VZIdxqdnLhjUsnVm7MeqWQ8Wz09m4dyeJ5PTQYbeHxHA7op9hrf:MUPFLxfprwz/VZIdxqdnLhjUsnVm7Me8
TLSH
T11224C6706178653E012F26CAF2709714D7ABE35BEB8956E4B93F92F457C3C84EA83058
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3680	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288642587208285"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{BFC885C4-5678-4AC3-B4CB-774DF4980576}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5648	msedge.exe
5648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 5868	2956	msedge.exe	89
PID 2956 wrote to memory of 3888	2956	msedge.exe	90
PID 2956 wrote to memory of 3680	2956	msedge.exe	91
PID 2956 wrote to memory of 3888	2956	msedge.exe	90
PID 2956 wrote to memory of 3888	2956	msedge.exe	90
PID 2956 wrote to memory of 4180	2956	msedge.exe	92
PID 2956 wrote to memory of 4180	2956	msedge.exe	92
PID 2956 wrote to memory of 1428	2956	msedge.exe	93
PID 2956 wrote to memory of 1428	2956	msedge.exe	93
PID 2956 wrote to memory of 1428	2956	msedge.exe	93
PID 2956 wrote to memory of 2300	2956	msedge.exe	94
PID 2956 wrote to memory of 2300	2956	msedge.exe	94
PID 2956 wrote to memory of 2300	2956	msedge.exe	94
PID 2956 wrote to memory of 1748	2956	msedge.exe	96
PID 2956 wrote to memory of 2416	2956	msedge.exe	97
PID 2956 wrote to memory of 1748	2956	msedge.exe	96
PID 2956 wrote to memory of 1748	2956	msedge.exe	96
PID 2956 wrote to memory of 2416	2956	msedge.exe	97
PID 2956 wrote to memory of 2416	2956	msedge.exe	97
PID 2956 wrote to memory of 2832	2956	msedge.exe	99
PID 2956 wrote to memory of 5052	2956	msedge.exe	100
PID 2956 wrote to memory of 2832	2956	msedge.exe	99
PID 2956 wrote to memory of 5052	2956	msedge.exe	100
PID 2956 wrote to memory of 6104	2956	msedge.exe	102
PID 2956 wrote to memory of 5088	2956	msedge.exe	106
PID 2956 wrote to memory of 1184	2956	msedge.exe	107
PID 2956 wrote to memory of 3728	2956	msedge.exe	108
PID 2956 wrote to memory of 1068	2956	msedge.exe	109
PID 2956 wrote to memory of 1068	2956	msedge.exe	109
PID 2956 wrote to memory of 5648	2956	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Galaxy Swapper v2 cracked.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd3775c188,0x7ffd3775c194,0x7ffd3775c1a0
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,11423050823611890206,5598719407959979778,262144 --field-trial-handle=2400,i,698527467996157998,11023872277591409167,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,16916805370292683284,11073175405019976901,524288 --field-trial-handle=2400,i,698527467996157998,11023872277591409167,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,1351190347953472953,3160583482434173707,524288 --field-trial-handle=2400,i,698527467996157998,11023872277591409167,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:13
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,1726916553590442063,5521596064101896424,2097152 --field-trial-handle=2400,i,698527467996157998,11023872277591409167,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,12683070980024600339,6750826120409079180,2097152 --field-trial-handle=2400,i,698527467996157998,11023872277591409167,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,3265997632322229938,7154656468202941233,2097152 --field-trial-handle=2400,i,698527467996157998,11023872277591409167,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,9498927103171077708,13129731734093645163,2097152 --field-trial-handle=2400,i,698527467996157998,11023872277591409167,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:9
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,5717092773715808713,12353294288502568381,524288 --field-trial-handle=2400,i,698527467996157998,11023872277591409167,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,12231301576652073312,3469030133285826305,524288 --field-trial-handle=2400,i,698527467996157998,11023872277591409167,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,3683726497039715524,2868703437116830039,524288 --field-trial-handle=2400,i,698527467996157998,11023872277591409167,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,3683726497039715524,2868703437116830039,524288 --field-trial-handle=2400,i,698527467996157998,11023872277591409167,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,14656579470092913947,2930938763115295570,524288 --field-trial-handle=2400,i,698527467996157998,11023872277591409167,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,4461421051308828458,5546163251432336939,524288 --field-trial-handle=2400,i,698527467996157998,11023872277591409167,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,14343056569852470348,809469387271760130,524288 --field-trial-handle=2400,i,698527467996157998,11023872277591409167,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,12799292065545064221,17869886209595910825,524288 --field-trial-handle=2400,i,698527467996157998,11023872277591409167,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5488,i,7785138178470831027,16342366109479813452,262144 --field-trial-handle=2400,i,698527467996157998,11023872277591409167,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 25529ee1a8450af84a0d493600c772f20c4f424ae256e69d848ca9a039b518a0
MD5 c313556e676cc7b793b78e4ae600918c
SHA1 907022fd865c914523fab071c34a017e84cade87
SHA512 4156e8866937fbfc73fb9a2c88d11c4e42add6994f34c4b16dca54187d88ddca27c5bcefa0923e0a80eb2f7307db1cbd8377d5af5a531ed94877980191f209e7
TLSH
T107619796171A3AD1F73449F757D954D4B7F0BB654D0F9EE222486C3A581EF0850C902F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5966de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5966de.TMP
Size 3KB
SHA256 cb0555f1db3025369757b180af91c717dfd0b84ef94959a22a48345d061caa95
MD5 c46fa8401e52bc7a0e31fbf51ec01d20
SHA1 ec9299f2e58bc18bdc75334fc4fcbfea7c141334
SHA512 2abf8936183b9a105e68f91cd81ca399e6442e003c356637dac03d423a2a60f9857cd28db38c208142df62d1458000a91424658baa7dd1f1d0f8dfd57cc018c8
TLSH
T13F61869617193AE1E73449F757E954D4B7F0BB694C0F9EE222482C3A581EF0850C902F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5078aabba8f5b76df7c35a7a21b1894529a80be1391cd64e881710e386efd319
MD5 35d3572ffa5e15d2e11ef944614d5ecd
SHA1 92a9226014ab2e83a4f1cd0ee5fd906683399a8e
SHA512 3fe8eac3887e94dc706a33cede1667f90b9aca32cbba8605bfa168fea68de082f4fa06625d461c11e817daee25975b2fc0f1de757a7d804427bb4a97b01eac00
TLSH
T1C2517BF7C2E4867D890196F0AA186E2BCE2C0915832C3C5AC9F4AF1BA7F2471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 50caf1e92e235616305693a9245b09a7741905c7c4f878e4cada23888665655a
MD5 2d0ccbc1f7e0fde2d39281241d628262
SHA1 51a42a902246cd0f9b72828944fba8beec761e15
SHA512 1d653bee556b5a44d7e95bd66d6c2c6785cf5cefa197645aa1bbd1b215f247194356809343dfbf7f39e8ce3b802a155b6843b30259400a7489ad9fc2b9d77577
SSDEEP 192:sxRFRNbx/ftstp6prQ55zoA8p4h/g6+WNIYn83h7G4IgD9J:sxRFHx/ftstp6LA/5ITRx7
TLSH
T1463296166A68A83B5CCBD21DBB55BF93D6F95032A1D51E48A7FC8A0C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 215962870badb9bc75e2ba0586f2b01f876e008a123246c8be19554ce922a330
MD5 c4dd43be6982dfa221b6eadce4463fed
SHA1 e0c3af3e0f6a6abdcf03c6a362b863946400a70d
SHA512 9ac2e9f2de95b6962f8663fed5a7897c76e55de149722b144b397f017c398ed4427cc0b4211cef1f95f694a6d6293a4af956642610457e541eeb9c73a18d928b
SSDEEP 192:sxRFRNbx/ftstpmprQ55zoA8p4h/g6+WNIYn8rh7G4IgDTJ:sxRFHx/ftstpmLA/5ITdxp
TLSH
T15B3297166A68A93B9CCBE21DBB55BF93D2F9503261D51E48A7FC8B0C04E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4e9a54993d1a1ef40920572bcfd29b865ccc7d0c5886979d5db3dc74ba2498e8
MD5 89a9e820326584159cb211b5bc10f424
SHA1 bf49670c524c3ea58efe2c5f402e4c37fae9b0e0
SHA512 1c6bc88e348e1d8f7de9dd12de4dadadcafc56ebc188d2d71be796335518da23577f7d0ba155d58279afc5da8185a76cfe8942d6cb22601a6727dca5a699b798
SSDEEP 192:sxRuRNbx/fts0p6prQ55zoA8p4h/g6+WNIYn83h7G4IgIJ:sxRuHx/fts0p6LA/5ITRxs
TLSH
T10D3297166E68A83B9CCBD21DBB657F93D6F95032A1D51E48A7FC8A0C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 a9a4f847ebe9a6d6101f2ed22225c568ee2346d2a5d44e2efb94b1f8a6fb355c
MD5 dc3048b7d42482c5b4dfd4412b573a03
SHA1 20ba346347cf0f3487dd1ff7ffc7f3e987469c90
SHA512 d69cf115afab8144d86d677d0b82fe1ed3f052f3550d685a142bbef8fcc9ef2bc2949ea91f0996ebc17e0bfa4be3e947231fe58ed00f70756fa85987eefc419e
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPcrohM9:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0Vb
TLSH
T130B2DC3B604DCB7E5F800A9DEC19AFDB7D5802C79A988D4447FE990C03C77EA51194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0214.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0214.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f9cba926805c2686d8ec45aa9c7a82523ca1773704e0a4381aabeb71f40a5f55
MD5 c725d9178349511b4283478e051bb483
SHA1 e5993f87256fda8c40ab0e95db199227b364b480
SHA512 56c0b4eee19559220c7ba512e2b03f913b4f1e3766bbe63814c399ba1431c30762dc4d29e80e8b965b478e33dd9f97b00d92a3501a441867ba502543abc80b05
SSDEEP 384:HftNn/s3n9Sd38NN0D80a8e3JDZNfNoXOVSUUboXTUpHETRzcoXfK86sfxEZxxsR:/j+9m3aQMDZIO0bI3Nzc4ReyIsP5b9MO
TLSH
T14CF2CF36EC24DD67ACE69796F6073692BEF4422BC2C92DC486CD6F0C0A8769C435B413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e3981148f6a31c3e410d9eddad273ea477f1de472e40bb885298739458082575
MD5 8869f94ac2d1ef6c0f9d7bd38e22b05e
SHA1 fa1693efad7e63794565db0f74f0e0e75b499eae
SHA512 70b0fec3935fe15dc8b44de3006e4e39ad0fb99cdeec08aba03c789ee918518764d94604840f907087ce1c10f406e8df25f6daea389ae5ee2e2c65087ffeec40
SSDEEP 384:HftNn/s3n9Sd38NNRD80hae3JDZNfNoXOVSUUboXTUpoETRzcoXfK86sfxEZxxsR:/j+9m3VjMDZIO0bI2Nzc4ReyIsP5b9MO
TLSH
T14EF2CF32EC649D67ACE69796F6073692BEF4422BC2C92DC486DD6F0C0A8769C435A413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 ef8845ed022709587bd64fcf4c909e093d808f1b0abe524e96015f05d0d99a16
MD5 73d1e3d9fd08916a29d5719bc9624133
SHA1 b77f97db25da77a81fdbd8c9bcb18d0ea365e523
SHA512 bd6b647991205b72b15e834b40d67f3634e3d4f1edb63cafef0b9a76ce5920746b426889db58a76a33bd65fdcc8ce09d7cf4f9b6f3dbd5b64635c3608a2df7a5
SSDEEP 768:RF1j+9w3AwgAjMDZIO0bIyNzc4ReyIsP5b9MO:w9w3btc44bsRb+O
TLSH
T1CD03AE339C54CE6BECE69B96F60B3292AEF5426BC2C96D94D7CD6F0C05871DC434A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1cd453096ba4937d6a78308c138f606aaa2c721a1f68102da469aa5f583a19f2
MD5 545e6515a2e209d87aba3a8581daffda
SHA1 452e0f25f26f7c2a734d45fd59079c89ce3f3629
SHA512 85fa5baaa3ff235110c11d4426352cac696b8c2c3b6bdac3664127f55d4163d474ae7fca47470462e7eee19a6cf0284878c4ee29d6212f05e218e5fa5bf9293b
SSDEEP 768:6rv+4UNbds3KeDZIO0bxNzc4ReyIsXkeVH1S5D:6bsbS3ktc44bs0EH1Y
TLSH
T18403CF32E8788937ACF6A686B14776537EF8512BC2981ED4C5DE2F0C4A4B1DC130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b248bb0-825c-4e53-be3c-235eff667633.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6b248bb0-825c-4e53-be3c-235eff667633.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download