9ae5357121ed1d3f2b0c6fc57be8c96ec1c0257b8d1cffde52356db9935f2d61

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
v3/2017/08/20/layanan-gawat-darurat/index.html
Size 47KB
Sample260727-ppg11asxev
SHA256 9ae5357121ed1d3f2b0c6fc57be8c96ec1c0257b8d1cffde52356db9935f2d61
MD5 36b9ad6f06a2b3ca5a4c0e6002f11013
SHA1 db08162eb42a9c0d2e68cd8d6ff06d1c8f58fb5a
SHA512 cde9c130e5d0c331663d44b0e2f8bcc47a2902da0c834834f5bafadd4c0fa0831121bfb520b345ef7614959c70b73a80c77885579bf474bf187d8ab641df6e76
SSDEEP 768:Y4QW+TiOmLKg8Z7U7OMIqzBUIr9LWPrTvy61maAv+bDD7Wy0PRe2lmC4/D:Y1ZI7Oizi5Hvy61zAmbDD7Wy0PRe2lml
TLSH
T1C5232CF61899D43600A3F69478A0EF05BAA35067CA15DD9273FD5B981F82EC3A5B330C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1272	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296291193423531"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{9DA20811-BD45-4978-9EF2-638EF8297DA0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 4016	1044	msedge.exe	86
PID 1044 wrote to memory of 1272	1044	msedge.exe	87
PID 1044 wrote to memory of 1256	1044	msedge.exe	88
PID 1044 wrote to memory of 1256	1044	msedge.exe	88
PID 1044 wrote to memory of 1256	1044	msedge.exe	88
PID 1044 wrote to memory of 1344	1044	msedge.exe	90
PID 1044 wrote to memory of 1344	1044	msedge.exe	90
PID 1044 wrote to memory of 5484	1044	msedge.exe	92
PID 1044 wrote to memory of 6092	1044	msedge.exe	91
PID 1044 wrote to memory of 5484	1044	msedge.exe	92
PID 1044 wrote to memory of 5484	1044	msedge.exe	92
PID 1044 wrote to memory of 6092	1044	msedge.exe	91
PID 1044 wrote to memory of 6092	1044	msedge.exe	91
PID 1044 wrote to memory of 5996	1044	msedge.exe	102
PID 1044 wrote to memory of 3480	1044	msedge.exe	103
PID 1044 wrote to memory of 112	1044	msedge.exe	104
PID 1044 wrote to memory of 4084	1044	msedge.exe	105
PID 1044 wrote to memory of 4084	1044	msedge.exe	105
PID 1044 wrote to memory of 4084	1044	msedge.exe	105
PID 1044 wrote to memory of 4960	1044	msedge.exe	106
PID 1044 wrote to memory of 4960	1044	msedge.exe	106
PID 1044 wrote to memory of 1372	1044	msedge.exe	107
PID 1044 wrote to memory of 1372	1044	msedge.exe	107
PID 1044 wrote to memory of 1584	1044	msedge.exe	109
PID 1044 wrote to memory of 5112	1044	msedge.exe	112
PID 1044 wrote to memory of 5112	1044	msedge.exe	112
PID 1044 wrote to memory of 4416	1044	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\v3\2017\08\20\layanan-gawat-darurat\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8c95ec188,0x7ff8c95ec194,0x7ff8c95ec1a0
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,9515062017971179233,18143533401699846282,524288 --field-trial-handle=2280,i,11597629350073931479,3119482717982155162,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,8787542600350013037,15494918718767308215,262144 --field-trial-handle=2280,i,11597629350073931479,3119482717982155162,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,3742633568830395898,7058146364235005848,524288 --field-trial-handle=2280,i,11597629350073931479,3119482717982155162,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,3757068999211973694,6321192051907476914,2097152 --field-trial-handle=2280,i,11597629350073931479,3119482717982155162,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3352,i,5499040066873079179,10819938227125296752,2097152 --field-trial-handle=2280,i,11597629350073931479,3119482717982155162,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,6718375606939540362,13493199754171032923,524288 --field-trial-handle=2280,i,11597629350073931479,3119482717982155162,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,18402078056661142320,15899040491200151283,524288 --field-trial-handle=2280,i,11597629350073931479,3119482717982155162,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,1622578784013026646,2926256282033566096,524288 --field-trial-handle=2280,i,11597629350073931479,3119482717982155162,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4632,i,4502034696015623221,17764000247808609002,2097152 --field-trial-handle=2280,i,11597629350073931479,3119482717982155162,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,9991623422434421301,5065660090651637675,524288 --field-trial-handle=2280,i,11597629350073931479,3119482717982155162,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,726880411763824608,451131255785970607,524288 --field-trial-handle=2280,i,11597629350073931479,3119482717982155162,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,8071862681779268249,10235631486983210321,524288 --field-trial-handle=2280,i,11597629350073931479,3119482717982155162,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,8071862681779268249,10235631486983210321,524288 --field-trial-handle=2280,i,11597629350073931479,3119482717982155162,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,14002792893237856402,4296514668189800616,524288 --field-trial-handle=2280,i,11597629350073931479,3119482717982155162,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1844,i,17532169977960807441,13592913114225236707,262144 --field-trial-handle=2280,i,11597629350073931479,3119482717982155162,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b154995ddeb1654a55ae0e5016db7d6373cfbd9fb5ec2479e3b1d57f9c353521
MD5 44e52f62b5563781f952cb46e6c09b65
SHA1 2042979b12a839aaa48727c8a00f8166623c608d
SHA512 be77064ceb159ef7876e86d385cf77e17d9867a9dc8ddf0b879a7c8de506b1a972297a07961bb9ac81dca79c59559b1fee7b59acd1b93fc5a7acf3a935288242
TLSH
T1EDE022BAC822EC7748FD0719A00DA746FB4027272A40895F3A3C92088FB462A86C596C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f64a13a32532caef5b61fe39894c40758d9e90d42d3eb2056df0596e0145f7af
MD5 dd0e310139053f750c74542557e23dfc
SHA1 a50f0ebde76a4c5fadc1c8bd09b0e15378307904
SHA512 16d5eaa9c3954eebb0643ccc4849f3277b7d0b9d5cd7dc270ac4287e563dd47bd06d0959e585a706f7edf103539e2bfdf27f621302cd78d6d0f88996db3e0efd
TLSH
T11E71A1398F42446AE3D00131D3F115C4B73A8AFCFA432FDE91D498F4AA157E23519B08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596cd9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596cd9.TMP
Size 3KB
SHA256 52c157b9305aabd905104ac4767762c6e47e2b32ff26120d8cb5c1b4d3faf147
MD5 48b05066de2e932e6c702c71d3961968
SHA1 0a8499a6d67b27ec94dbf31e3dcf71e7d31870a6
SHA512 1137fef508c59f1530002ef1b68c7aaee9de198f715188d1654b51973eafe5fa733299ec9c978076bc738bea2d7dacd6291c700945c8058a8802d3c2a94aff54
TLSH
T1497180398F424469E7E00131D3F115C4B73A99FDFA432F9F91D498F4AA157E27529B08
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c5aa33880a6b6e6133a2af0dffe0a4c7bd935d49e7f6cf961110417801719da5
MD5 7382cadddf5b5cdc753a93c157d06ade
SHA1 6b00a9a1650af437cd27b6b70674ffa5e90d12d2
SHA512 5a696fdeb5d245515f51f3032353499371b76299c1315d2467bd656bd5eb3cefcd4a13ed068b14ecb41497c6b9e2fc92c500b9bafd297ce3434cb09a1d1589ce
SSDEEP 96:D1sROhvCjamAngaaij6oV1dHzpPsDAN2jutyJ+uw7x:D1rBBmAngaaij641dH9P0qguQguyx
TLSH
T16291BEF7C3D8876E890196F09A24BE1BCD1D055B423C3C5689E8AF4F63E1571D10229F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2b9d114d1289b18caf8d6bb56388875cf950821bb27662e72e326baf7cc20f4c
MD5 6b44bb0f3bb81de0229e640ab3ba761d
SHA1 24780ddd90eba33dcfcf5b7ccb9b395f3cd14eda
SHA512 4bab09587c629f2023321c939eba86eb154504fc0f8bde7488c02bba7ca026b7b3d375675eb3e886878710b7fe48e6831a1f322041681b66a377dfa4637ac6f2
SSDEEP 192:sxZVRryMqZjK1Ml8UQmkE/fwsvPZdZzodpHFHW6+WNGYvMZG55zIg5b+KJ:sxZVIqNE/fwsvPzSlHbGcXh+G
TLSH
T17E62E816AA3499778CDBD209F6457F53D6F91533E2904E44A9FC8A0C00EBAED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1f2d170a4d2c1bea824a98729cb67030018f233319db62340bf9a5aa7f101f77
MD5 b13214266e0c93dbefc073260d17e923
SHA1 cba9fbf1ac4902f2fd13fb8f3de6f9e161ba2b45
SHA512 f92ab86d1d7f063cbc2f2dcb072ca502bac260dc70375649b745bfe157021d57932991a23199fe54a624c1195ab99d179874c0878502719bec220c524e9746a4
SSDEEP 192:sxZVRryMqZjK1Ml8MkE/fwsvPZdZzodpHFHW6+WNGYvMZN55zIg5b+KJ:sxZVIME/fwsvPzSlHbGLXh+G
TLSH
T19A62E916AA3459778CDBD209F6457F53D6F91533E2904E44AAFC8A0C04EBBED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1050679b9b0d45e9f0005d84a26245d4443430a118aef1b9f91578975c1d9263
MD5 592a2b50527e30760897cf29b00c925f
SHA1 1e39a43875078c864f502c6d627c322a93c7e8f2
SHA512 5e8e6a214b621f30cc7f6a63ef91c11f270ffdb50b69faebe21057124c3034a87c04b6b9c11bb3c1f39c28c978b53777ca257fe14f526e51b6a513ac3d1fb2b5
SSDEEP 192:sxZyRryMqZjK1Ml8MkE/fwsshWaZdgzodpHFHW6+WNGYvIC+5dIgjKJ:sxZyIME/fwsshWazDlHbGrPjG
TLSH
T11C62D8066A3859778CDBD219F645BF53D6F81573E2904E44AAFCCA0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c663b5c5175866e2ef17a201f2ed8d8e85553032b7371e4c3ee72973b046f265
MD5 4b2883eab7b618e6890e61a03e983f3c
SHA1 70a3199fc921bdfa3a82bb460f0df200e3d97c74
SHA512 6092b074234883b1c96a5490af768d791e233c60b05373d63b9768ed0cbe51159ff9a15648fe97c37e3465b0e0474d0501567e39f38abe04f67f34bc8d1073eb
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG0:05ppxnY753RNBvRJJdt7p5J9/nxi
TLSH
T1E0B28C5A703E0212397E298CB39596364F4135A33058E4AF7FB814A14F67E225DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8610aa211f2921f071f06f4a63217aaea22e1e1b848f43405f15a602ad188482
MD5 9e03077a193daf762d31dde15363fa53
SHA1 deda660ace92d03c06c3a2334b1f390dc53c5de5
SHA512 aa8bb1a9c5324ef5817c12a76d833398be822ce45bc3ac99d91f5990c087e86ddb4aab56f175662ba99a7b4b8ab4db0377723b0d7667b6122decfff648746a5f
SSDEEP 384:nJiF9CcmyWCs3sNp8TUNTUlI4VQckCrSKbpvBfxGJWJ45Zcd2eRQWpxvOty/7Ige:gFccps3EwgSkA1DG045Zcd2PWfvs
TLSH
T1E9B23A36EC94CAABEDE74B89E75A3613DEE44267CAC85AD4D9DC1D0C01DB19D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f343d7773868e6b90ba3d6119464128cb934f0b5240e4e661db42eac3dc2baa9
MD5 232a5f6364a26290facff234f2ed5884
SHA1 063933b79621dc3b3a1aea194a0ae930f6e89e37
SHA512 2e67c0a0c642e9efecc2b6511e2bf015857bba1a794c4cf92fe6d505c28251fab68917fafa13ab66ce8769e9cb947119548aee99db780fcf01d10cacdda10926
SSDEEP 384:noiFiZcITi3sNp8TUNTUlI4hQckCrOKbpvBfxGJWJ45Zcd2eRAYWpxOObjI9G6wS:zFQm3Ewgkk01DG045Zcd2HYWf29Mm
TLSH
T191D25A36ECA4DAB7EDEB4B99B74A36139EE45263CACC5AC4D5DC5E0C00971AD030BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 0686f75ebc700bf9b36af0428d00f964e3ad810689c52caeb630dbaaddd1de26
MD5 8ba9afa9e25e3ca863521df4766664c0
SHA1 989cf1bef4ce742795b39a80e16337e26ff14626
SHA512 93da6acd9da49dbd0fd558a6f13c381bac1bb605d759d5a16a02cd7c6694196d15333d2812d75325b92e00ada475e029488425e000b632ef1f299fc5e1f4c463
SSDEEP 768:pcFccps3GwgbkUekDG045Zcd2ZZI8p0MLC:Gs3ozyc2I8p0MLC
TLSH
T110B25B36ECA8DAB7EDE74F89B74A3A07DEE0126785D859D4CADC1D0D009719D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 10dbaf42efc7f0f6815aaacaeab94f26265350adc21493ad2c69f4cf1d8ac86b
MD5 1b38c431859ee25d8c9f9149b69f11cd
SHA1 718a71f833da296adea52ed68400c9a8c103fdbd
SHA512 164be603a33714e2ebf6f51a620c04d417ba2804524c1b711b28d7cfe81d67983f1b9adf49f51cae41d2ca1371734f5202c67662bacc4a79da7d22643fc23295
SSDEEP 768:pqFccps3UwgbkUCODG045Zcd2GWfI8p0MLC:4s3GRyc2I8p0MLC
TLSH
T195C25B36E898C9ABEDD74B98B74A3603DEE05267C6C89AD4D9DC1D0D009B1ED430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 4d5aba841206f576752445545bcfb57a8a261ec98fdf80b4621e8ca40b1c941b
MD5 59f99dc9e8246e95695f2319d4e387c5
SHA1 db51ef3562c4d4941d9adc99011cb1e573f9fc3b
SHA512 df4575b5c08beba49944f2f32189f10df58067ac3789795fff9c00d9a47ce8db073e7ea2ad638446917b950e8017ddd21af5ba217ac26cfa500cad1cba0f9292
SSDEEP 384:npLiF9CcmyWCs3sNp8TUNTUlI4VQckCrSKbpvBfxGJWJ45Zcd2eRQWpxvOty/7Ij:pmFccps3EwgSkA1DG045Zcd2PWfvs
TLSH
T14BB23A36EC94CAABEDE74B89E75A3613DEE44267CAC85AD4D9DC1D0C00DB19D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1a19c5fcbb949b668a3dde32c7a1398b0201d5a37dc209cd5060e60377ce2534
MD5 37f5acd6bad5454f9c41463c5ab0057e
SHA1 6bef6cd11b3c1748bc14caca296af5c22ffa7214
SHA512 fc4bf109e2f47fe60ad3bc08404416b64d3297c71fb331a513ee3ef1c756823b4e8e246fe8cb34f3438382406924e4f820755167a33a7aa6965a01922b39dee1
SSDEEP 384:nJiFiZcIg3sNp8TUNTUlI4hQckCrSKbpvBfxGJWJ45Zcd2eRQWpxOObjI9G6w7h0:gFQg3EwgkkA1DG045Zcd2PWf29Mm
TLSH
T192D25A36ECA4DAABEDEB4F99B75A36139EE44263C6DC5AC4D5DC5E0C00970AD030BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b35d2baecf3b6e90fd1b501720967b026ab588a613b2f8941ddd7bbfa97fd417
MD5 c94337e57eace5406432524d389b18fc
SHA1 28e981d06d262c64f16aa7b3fa434abe34fb4438
SHA512 1318264d925566f6f644a03f3dcdf62f03ef7745a0da92c846a951ecd84f9ddd6ecc337efb5ed0b81622ad50d39b3e2410649f42352d3381d1f8c72353dd112e
TLSH
T1CE41D95DBAF91148B3B7AF1AABF7A46E447E7D672A06C49D00010E4F0672B44C862B77
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1584-250-0x00000208574E0000-0x00000208584E0000-memory.dmp

Download