88308a6bcc8f76fffd1c18c28213cd568fb0d63f2920ffb30f7504d5d89e7ee9

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dexter_dk_release/CasinoLoader/master.html
Size 1KB
Sample260727-se3fqsgp4y
SHA256 88308a6bcc8f76fffd1c18c28213cd568fb0d63f2920ffb30f7504d5d89e7ee9
MD5 2b50c51fce89ddcfb769effdeab7080c
SHA1 c027bff71bf051731f2a1e0eefdd750d33f832f3
SHA512 79b2d8e0b6d6b0e687bb32a5d8a382b202e60f2c7bdc3c762e95f5c6bdb2ba6abfcf78917ee9783914e304ed6b961db52bbcf9e0fcb0cab87e9d51bd9771b9f5
TLSH
T11F3142B3A4FF0D3A93E67C75D2A51142ADDA0700A101934B7DBA79C2669D3E447BB3C8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5956	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296382330610488"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{2BED0F62-BA49-4CBE-BE59-2BE9AFE05F75}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 5108	3444	msedge.exe	89
PID 3444 wrote to memory of 4284	3444	msedge.exe	91
PID 3444 wrote to memory of 5956	3444	msedge.exe	90
PID 3444 wrote to memory of 4284	3444	msedge.exe	91
PID 3444 wrote to memory of 4284	3444	msedge.exe	91
PID 3444 wrote to memory of 1924	3444	msedge.exe	92
PID 3444 wrote to memory of 1924	3444	msedge.exe	92
PID 3444 wrote to memory of 4904	3444	msedge.exe	95
PID 3444 wrote to memory of 3400	3444	msedge.exe	94
PID 3444 wrote to memory of 4904	3444	msedge.exe	95
PID 3444 wrote to memory of 4904	3444	msedge.exe	95
PID 3444 wrote to memory of 3400	3444	msedge.exe	94
PID 3444 wrote to memory of 3400	3444	msedge.exe	94
PID 3444 wrote to memory of 5320	3444	msedge.exe	96
PID 3444 wrote to memory of 5320	3444	msedge.exe	96
PID 3444 wrote to memory of 5320	3444	msedge.exe	96
PID 3444 wrote to memory of 4160	3444	msedge.exe	97
PID 3444 wrote to memory of 4160	3444	msedge.exe	97
PID 3444 wrote to memory of 4160	3444	msedge.exe	97
PID 3444 wrote to memory of 1952	3444	msedge.exe	100
PID 3444 wrote to memory of 2980	3444	msedge.exe	99
PID 3444 wrote to memory of 1952	3444	msedge.exe	100
PID 3444 wrote to memory of 2980	3444	msedge.exe	99
PID 3444 wrote to memory of 4104	3444	msedge.exe	102
PID 3444 wrote to memory of 5804	3444	msedge.exe	106
PID 3444 wrote to memory of 476	3444	msedge.exe	107
PID 3444 wrote to memory of 2416	3444	msedge.exe	108
PID 3444 wrote to memory of 812	3444	msedge.exe	109
PID 3444 wrote to memory of 812	3444	msedge.exe	109
PID 3444 wrote to memory of 4476	3444	msedge.exe	111
PID 3444 wrote to memory of 4476	3444	msedge.exe	111
PID 3444 wrote to memory of 3680	3444	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\dexter_dk_release\CasinoLoader\master.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffeba08c188,0x7ffeba08c194,0x7ffeba08c1a0
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,15782002290221397121,7647871596574464542,524288 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,8669097140586751640,13960152885888249845,262144 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,3050279809636701773,5612710734916165776,524288 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:13
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,7641822654678813377,17110203563422370184,2097152 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,15790443402699152535,2845420225525588757,2097152 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4352,i,3429069158726840398,14274836032398475550,2097152 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,16883636607444688665,2041766167736362728,2097152 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:9
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,3533478712723236257,2225128199645645803,524288 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,2025301097130489162,12907297351756965207,524288 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,16828252869462353796,16016765256143313580,524288 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,16828252869462353796,16016765256143313580,524288 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,12992538658530138073,11606387535949606772,524288 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,6746812005404470576,2104540173908523356,524288 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,1019701164804654798,4396603932815096151,524288 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,12276292911534990187,3562780270199817069,524288 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,11713249213189261474,7144458436823219814,524288 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3840,i,16116055464601754813,10438488512506367233,262144 --field-trial-handle=2128,i,4837599113237225986,5178579651887029552,262144 --variations-seed-version --mojo-platform-channel-handle=808 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

87939888-db6e-43fa-a23c-888de68c1b22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\87939888-db6e-43fa-a23c-888de68c1b22.tmp
Size 23KB
SHA256 6512879069769e90bfa467eb7dc2c8e9352839c7ee519ec2e118014880747acc
MD5 10ccc273eb9b65fbb55a16a09c9c8d05
SHA1 a966e9e77e7cbfa2a8e8ee37ef9c3b98ee43d520
SHA512 10e401dff0c4f6c93504f300a12d030348208cfe164c089696e9bff717ac034473bf8cb34935cb17081329bfa1f84126630dcefef36fcf85b24c3e4e431d90b1
SSDEEP 384:jzK6H0dfCtgsqFf02KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRX9ro98T:j26H0RWgs2f028F1+UoAYDCx9Tuqh0VU
TLSH
T10DB2EC2B640DCBBE9F800A9DDC19AFDB6D9802C797548D4047FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0801f5acec09dfb083464d6816f902ba9e8a86b125eeb73872d3d0e36389eacf
MD5 4a09606ddea398bcb249aa4847b04df8
SHA1 27e130b0f4f65324b4cdc9e39fc3374bd69b189b
SHA512 367520dbeb50f672a8b0607d66f164a565167a0d02023ed9f11d62f80c219b5638b71fff4d20bf1de1ae9da18cb366e2f70eb3cdccfcc25c5bcdc6cf9d6e1368
TLSH
T1536183B7A32906DAEB20C53190E5846835F4CA4DC24FBE9EC0ED5DFAA406F0542F281F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594174.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594174.TMP
Size 3KB
SHA256 92c8dfd5eb1f0ad0e2d205b5475be0fe6105617f3240376e74ef6d5d2b287b0a
MD5 47052d492c399b2f419292aa7c19cb7f
SHA1 e4999e58207cf1c34ef4332798881aec6a0f7323
SHA512 e085b7933f310e1ef212bc6d0bbed41531c77e1d6e50319adf1cda70e1cbdd8af5af8b2814d58f3f283d374964d1db49926bff6cd07f479e866bd4fb0f272ffb
TLSH
T1146183B7A32906D9EB20C53190E5846835F4CA5DC24FBE9EC4ED5DFAA406F0552F281F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1be36ab87fd56ecf10d153a44ad8473268a23e6d1b9dce04ed3f0fe0a6e01691
MD5 9a31241f0efcf1ee0c81ad57a90d20f9
SHA1 ca4f77da81545675fb42ded7513e8eff86287c29
SHA512 f4e113de756af61bceda93ba39777b6b549839e3f5f3d25f923e045160287849363904ca2a72f015886f76c9a8c0dee1643cdc7583c8904e85b3c422906ef23c
TLSH
T16F41ACF7C7E8856E890156F0AB186E1BCE2C0915832C3D6AC9E4AF1B93F3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8e84f06d027354c35534966def86b013daec81f0e2cc233886de4a9ab23962fb
MD5 6bd0d6704c1b4b0a0195d85783ce846e
SHA1 3e9c25ab7743601d4472525df9a66c94d8be231d
SHA512 aa385cd63ab3d3e53951aebae33fd67a0e63f724155d4f0a56a87841d4c37efa79374cc9f7382d2a1e144d85523188bbed64f88021c8836bddd3b760a3b0f07e
SSDEEP 192:sxRuSR7b3/fXsSyowGizoA8p4M/g6+WNIYoXCY1GUIgIJ:sxRuSN3/fXsSdpvt/5Iy4s
TLSH
T1AF32B7166A28A93B4CC7D21DBB65BF53D6F91032A1D42E48B6FC870C04E7ADD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3a3df98ca78b8d033c16cbf2ce799d651aa543f16228d94e4e71418dd41638b7
MD5 8ecc479ca2fa37c4e4f16d166193d029
SHA1 ab81c735b2b5c714b0a44a0be66fd43a2bf22fef
SHA512 25d778f2606d868b030783a72eecddcb97a60744c1bc5cb68a440be0da4638be422fbb34fe6ef501c47b85428e2fb02b091bc07f2b809d59493899f33f7b8455
SSDEEP 192:sxRuZR7b3/fXsg4owGizoA8p4M/g6+WNIYocCY1GUIgDnJ:sxRuZN3/fXsgLpvt/5Ir4V
TLSH
T11C32B71A6928997B8CC7E21DBB65BF53E6F95032A1D41E48B6FC870C00E7ACD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b9d528d0fc8f52674bc080c8cc4fa2cdef2168422c29f70c17476c5207c671cc
MD5 13a16153db68b830d861afa124a3970e
SHA1 ae62ffc3c26c0da6ce1baf09b712dd7dc88a6e06
SHA512 c638434ec640e19ac1b274f8c97ddfaded75aa96ca9b0062c7527c349e2955191ada3b561d1e590592e6614695b40e2f18093df202a97070ed6f553089c09ac5
SSDEEP 192:sxRuZR7b3/fXsgyowGizoA8p4M/g6+WNIYoXCY1GUIgDRJ:sxRuZN3/fXsgdpvt/5Iy4X
TLSH
T14532B71A6A28997B4CC7D21DBB65BF53E6F91032A1D42E48B6FC870C04E7ADD621740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f4d7486b6c61902515d1d934a3e674c07206691a7f94954b8a8eb3d3afec95ac
MD5 f760d0cd9d7b0a75975e34ce2f864930
SHA1 60241198b1e490f1db34a639a9b3300dc2a2d66d
SHA512 bbda65f999aa7862182f97d1607e5a178922304041149c54235988159728ae5eb222eb426bc08c4e1f3d730fd233afa4b6c76064f89dfb907b3dc140f09de6c6
SSDEEP 768:kr37rZ/TBOWBbatEONXyer1IRCzni9zb9MKN:kr3717SIqngb+KN
TLSH
T1F9F2BF36E8559E338CE2E3D6B14637537FF86027D6C84B40AAEE6B0D059796D430B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 b6b928a3613b88ea5a0ca6bb3797f3c9f783a78a3a997a6adddffecf5ee004f2
MD5 c1eab961529a202a091da21ac8f8f4d3
SHA1 9bc297025679c595d3095323e25f8168c8ffaea3
SHA512 35dcc7412d2948fb4c9f26ecad43d3c4192bb262429c3d68fcbd13ab756bdca8c56c2d31aeb463cf3dc1780a97faa28f5207ae5fd681741c86c5a09878a19041
SSDEEP 768:MFQe3QwgSrZ/TBOWBbatvONXyer1IRCzni9zb9MKN:/e3h1MSIqngb+KN
TLSH
T16003AE37D894CE378DA6E792B14A3713BEF56067C6C49790AADE5B0D01939AD030B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 48bf8923e365caa0427935c69d675b6505dc9923dec821b60937b8d1fd0e4310
MD5 860a7058f946bd26986ca4ceca4601ae
SHA1 5628035c373269a9227fc23d01afa7a637b0c0fa
SHA512 073135b27bce386ceca37e9b414c271e40f36638651b356d9f9d00d3fdcd5dbecaafde032ea026b36c35a6716a3dd2685b084d7f513f52977610cd6d82a3f6f4
SSDEEP 768:vr3crZ/TBOWBbatEONXyer1IRCzni9zb9MKN:vr3c17SIqngb+KN
TLSH
T130F2BF36E8559E338CE2E3D6B14A37537FF86027D6C44B40AAEE6B0D059796D030B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 367542e60f3a8d810648f9051e9f382d0f63696b5e190f4ada6d056e10225f50
MD5 1c28f65aa4a906ee3f74b6ec5f95de12
SHA1 392bd18bac5c342bce2dcb8eca8c006e10e51264
SHA512 6c22e2923496031aabc98d77ec30ff76ade081dbd7bd355347e0fee30227833e506ac59a43034323c6d85e87913f23e964d3480722313fd09b0696bdc8b3ad8c
SSDEEP 768:5rv+4UNbdo3cwZ/TBOWBbatBONXyer1IRCzni9zb9MKq:5bsbu3ceASIqngb+Kq
TLSH
T1B913BF36E5589E338DE2E2D6B04B76537FF82057C6C40750AADE2B8D06978AD530F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1fb43da9921bfbfbac7187e24e47102bc9cf48f623bdc6e236a17bba99b75792
MD5 d3c49081c20cb761fc5eff8996932104
SHA1 2e1542fe0bbdabce4b475e5c31d6cfe2c788d5a8
SHA512 0ca330f78b4281dc9a514fecc81ac7150df4de2128ff0b927025cbc7c4b9966a398dcaeb5f4e6df0417a0195402b0daf1ab395baf91f5a53da66da234339d90d
SSDEEP 768:hrv+4UNbdz3Q6/TBOWBoONXyer1IRCzniBfeVH1SK7:hbsbV3lESIqn0EH1l
TLSH
T1C603BF32E4A89E338DE2A3C6B14776037FF86057D6800790EDDA1F4E069B59D230B95B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c842e4ab-9542-43ea-af40-66df7d013809.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c842e4ab-9542-43ea-af40-66df7d013809.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download