hxxp://www[.]a2zprivcap[.]com/

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.a2zprivcap.com/
Sample260728-llcekatxft

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2640	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297050316419636"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{8A9779B0-2801-43CA-BDFD-C655FD63C626}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3420	msedge.exe
3420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4308	5032	msedge.exe	85
PID 5032 wrote to memory of 2640	5032	msedge.exe	86
PID 5032 wrote to memory of 2888	5032	msedge.exe	87
PID 5032 wrote to memory of 2888	5032	msedge.exe	87
PID 5032 wrote to memory of 2888	5032	msedge.exe	87
PID 5032 wrote to memory of 2672	5032	msedge.exe	89
PID 5032 wrote to memory of 2672	5032	msedge.exe	89
PID 5032 wrote to memory of 1876	5032	msedge.exe	91
PID 5032 wrote to memory of 516	5032	msedge.exe	90
PID 5032 wrote to memory of 1876	5032	msedge.exe	91
PID 5032 wrote to memory of 1876	5032	msedge.exe	91
PID 5032 wrote to memory of 516	5032	msedge.exe	90
PID 5032 wrote to memory of 516	5032	msedge.exe	90
PID 5032 wrote to memory of 4944	5032	msedge.exe	92
PID 5032 wrote to memory of 2104	5032	msedge.exe	93
PID 5032 wrote to memory of 4944	5032	msedge.exe	92
PID 5032 wrote to memory of 4944	5032	msedge.exe	92
PID 5032 wrote to memory of 2104	5032	msedge.exe	93
PID 5032 wrote to memory of 2104	5032	msedge.exe	93
PID 5032 wrote to memory of 3104	5032	msedge.exe	96
PID 5032 wrote to memory of 3104	5032	msedge.exe	96
PID 5032 wrote to memory of 3104	5032	msedge.exe	96
PID 5032 wrote to memory of 1628	5032	msedge.exe	97
PID 5032 wrote to memory of 3408	5032	msedge.exe	98
PID 5032 wrote to memory of 1628	5032	msedge.exe	97
PID 5032 wrote to memory of 3408	5032	msedge.exe	98
PID 5032 wrote to memory of 3544	5032	msedge.exe	100
PID 5032 wrote to memory of 4996	5032	msedge.exe	112
PID 5032 wrote to memory of 4188	5032	msedge.exe	113
PID 5032 wrote to memory of 1972	5032	msedge.exe	114
PID 5032 wrote to memory of 956	5032	msedge.exe	115
PID 5032 wrote to memory of 956	5032	msedge.exe	115
PID 5032 wrote to memory of 4240	5032	msedge.exe	116
PID 5032 wrote to memory of 4240	5032	msedge.exe	116
PID 5032 wrote to memory of 3420	5032	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.a2zprivcap.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffbd8d7c188,0x7ffbd8d7c194,0x7ffbd8d7c1a0
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,281660764429275332,1043737313388252250,524288 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,12210641813709367465,5161395595574962728,262144 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,9849755264745103794,13281425671411283837,524288 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,2168343343351165740,13857487942095336837,2097152 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,9989858212512711462,18335049411257881991,2097152 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,7301940834117421516,4908618443394138439,2097152 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,15438397646767260622,8225252715818148665,2097152 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5084,i,17844572295479297378,9955384803530582159,2097152 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,13655531334200614329,348907564449717438,524288 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,1518826708090791695,9906005661737028145,524288 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,7620304845706035501,966068178175983582,524288 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,7620304845706035501,966068178175983582,524288 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,15341153950904761007,8539797969005777700,524288 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,14881597575808387353,8725492103809418555,524288 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,7458138577386637923,17480209360915573156,524288 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,13998053765201180167,14880147545001389455,524288 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,13158953990704480162,4577961428518210613,524288 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5840,i,16807056424198167673,2946481678233306272,262144 --field-trial-handle=2276,i,3384589480832632311,15153071929336022577,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 224c61626fbb1799e1793a87337ea0a7caee0785dbcea1c4f9f728b123c8cfc5
MD5 cd2bf8a0712995cdbb4e7dfba7c2115d
SHA1 ebbc7d91c32238e30362a39c6b2fb80c3a101189
SHA512 4c57ae437464f727c5d5571b35180b5e7638b39b11470dc5b04a376649d76acaf857a429c7a6a245119838cf71bee0a52f0565f6b3ab07c704c608b240c98819
TLSH
T1B4E020CC25CCC36D5120A587517C734D81823A0AE3C4EA16270485D6704259477D3994
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b1c05320611c72eab31849716edeed65a78fc3176c4dc54ffcc4b22fe1c91274
MD5 88123d9220be3423ebef92c5f7bed64a
SHA1 bb0c07dbd9faf589ec66fec387050936be9fd19d
SHA512 9f3a22de1081aa84b3440777f628b4b4ecbc2df17e3773a626f8384cf7156414632b822b26ad9d5addd5d1bcf19e77b8d0e7adae01bee1365a93c12b2981dae3
TLSH
T19A41D6F002A25B81DF3016B190F01B00367683DDF9737E18829299BE3A3AF63852647C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7c2bcf775163a61608e5380c150ca286b573a24f915500a8e4d7c2099189ee85
MD5 4f87a67c93ee3d05ffecc57bee398014
SHA1 a3570bcf753ff3a9b086c77e21c4f0b55c99025f
SHA512 33640b0e4798fed4617498201685bb71489f08971464609ddf0a1fd84ba76236b085b20d826b12cba26c35dcff563274f7c86ad8807ad622c6589417cf7c4b2d
TLSH
T1F4218CF383F5866EC91152F05A14AE2BCE5D0515875C7C2AC9D4EF6793E30A2E10166B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bb8ee6ab329ad2a98ac51d3dfc16b35eedf8b58ffbb305b1a66c41c5e4897876
MD5 597725a64a9d1366d69a9465a804a810
SHA1 0add85860bed1f1b6c0486b2e6a7d6af0822e785
SHA512 2188bc536e6fa0436e2677a4ea90b3134ddfc9a044a8e821c2415d1f28ed1a9928f0eca54bccd420257afe2be17acf2a84e474c999de7b71a070c0a0e5689d89
SSDEEP 192:sxZFRkkU/fRsSB5dWEdp2vSHW6+WNOZJI/Y9IqPtIgrJ:sxZFRU/fRsSB57ESHbwI/K9
TLSH
T17122A6166E38597B8CCBD319BA25BB53E6F9503291D51E58EAFC860C04E7ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8811e49c6f853d4dd793f7729f8b0b32824b7a19aa86583a10d5cbb9080a04d4
MD5 afa2943da49ca75eba785035ef52f262
SHA1 c0bc0d6cbf54f16d1d622a0fe3cd63d7502a31f8
SHA512 645cd053b987b02fe31e33b79e62a965433dd4be3ad9bd0bb72d36fc4cd794102b99ee348a1931d2d80ca93e7f9fbdc2e17b4dfce314376a4f6f38a23bafac9d
SSDEEP 192:sxZFRkkU/fRspB5oWIdp2pHW6+WNOZJI/Y9Il4stIg5ZJ:sxZFRU/fRspB56iHbwI/JR
TLSH
T17332B7166E38997B8CCBD319BB19BB53E6F9543192D51E48AAFC860C04E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1735b26bf78912730d964188566dbee3186ae3375e6ba1b2dc7ca5ea20003ee6
MD5 fc0de7304ea83bfcb7d0aae21a70ff72
SHA1 be98eb02d8b9b9b6acf3f9015572f6f448c65978
SHA512 287aa31de791ab0d49c8aed0991fef3310c6e4653016128dde7fd875b0736cb098fb1d50cef13303dcf8be7f690f6c5435301ae5a074222a8080260050d2db17
SSDEEP 192:sxZFRkkU/fRspT5oWIdp2pHW6+WNOZJI/Y9ITMstIg5DJ:sxZFRU/fRspT56iHbwI/H3
TLSH
T18032B7166938997B8CCBD319BB19BF53E6F9543292D51E48A6FC860C04E7ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 dae69976bdb1b7f486fac128ddb3b120920364089d6f19b133eef11e1a33e6ba
MD5 46c969b1197405f5e1476d49d525dac5
SHA1 52a75fd78c1d893c04824cb7cd5a5807b4dcee74
SHA512 80fac2554f4cfc351be94df7bcff142c2ad28a26df8300526900010a34aa9af05a7a53590487692082bd5056d352235707997f349472cac1f3cda645bb43d7ea
SSDEEP 768:FLyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7erohbqmmg:FLyvIZwWvu+Q+u1jamFLeR71hD
TLSH
T12EC2E92B240CCB7E5F801A9DDD5A6F9B3EA802C7A7588D4047FD994C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 82d74f2c18b5e77637af34996e454fec6a0aa31aa1e499fb8ee57350277ecc8b
MD5 a122224e4b0dbe4656ccd9ba40773c5c
SHA1 63c3dfc0d611c7a822ebfb560a55c7fbd53f47d1
SHA512 8e18e850fb0b1b9801f7deb6b26199f8523e4de0feb1478e3b46182298880fba806d86a960c68fabc2a213e0812293eb794c83312d7988544c2a7174b0cf0de8
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDaAYKhy+iVoZFf7Xkn76P59kKBB53ktlFah:mTXjiVoZFf7Xe76B9hB53ulFafJ
TLSH
T1FA910406B13A02D339BF685DA3A689368E4131537A18E97F7FB900918B27E121DFC4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7fff697e-81cf-4d8a-b4fa-00795d6d48d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7fff697e-81cf-4d8a-b4fa-00795d6d48d4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 fb348cee5333f1bb829792117cd06af33d848a96ae8a33deed32ceea5bf44d88
MD5 4c6b684a6a6bceb96977429f46cdb27b
SHA1 a71bc92f36674b8856eeccb8c46f6f64aa15ffee
SHA512 42c5fb650d35687da7dbd6ee8ee08b33b2541d3b70a3ad4cd67a8053a1770a7aebb38ea3673e4e229f0cd92a8f752e74ff159735ed0d158e2816f4dfd797b470
SSDEEP 192:uG8LsNbF0QLC+YLeKCQmiU1fMb4e+CGp+Fdes9omOQN6JiTqnzQ3XraVa:nasNb+8CzixWEe+CndHeRezEzQ3x
TLSH
T110424C36AC785D7B9AE7A542F0473A139EB85463DBC62F80D5ED9F0C01DF69C130A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f99b536c9d15a92ac480c60135968aa629a3725dbc49065ac3153890e527b9d4
MD5 104f0187e41ddb4ddbd988edfd1d9c05
SHA1 6929814597a3a7c6cb835a1f6d3609cce88202c8
SHA512 ab9bb1ee32aaa0433e9676fa9d883381a95cbb8a36da866ba3d6434c1b0c30b954ad2b5d2bb450b7b46fc72906ce1787c38f2cafc53dd440856e23c3177ca89c
SSDEEP 384:8uiFiZcIgzsNl8TUNTUlIlq8CzixWEe+CndHeReIEzQ3t:8FFQ8QwggFPfEJEzQ3t
TLSH
T1B8924C335C68897BEEFB9A81F54A36139EF85073DAC56B90E6EC9F0D019B19C130AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 4996190d6c276c01910580f8df87e996993d776149533db5fc3f4cc0ed417280
MD5 513e4e9fe72215dc795f4b3a7ba40938
SHA1 73f07f5493b9f14b4ce3f47b4ba9da67ecbc7b47
SHA512 34585b85c84f5382aac59d5c5d8e2c5d6bcefafe1078dc296e2af35de657e768da10e721f911cde7d7ace3c6b60480ca6ce611fb997e7c18c72c0b2f0b43e8e9
SSDEEP 192:u58m+xasuheOwQxMGsNbNQLC+YLeKCQmiU1fMb4e+CGp+Fdes9omOQN6JiTqnzQ9:EvZcIhsNbN8CzixWEe+CndHeRezEzQ3t
TLSH
T110727C326C781D7B9AE7A542F4473A135EF89033EBC52F8094FD9B0D01DF6A8130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8a8d9de70e7b1a5b517bbfbeca6874954e366b3a6ba6835b0d7fb24d5ba80f17
MD5 d7790140722af20b40849245dc849715
SHA1 5d4cae8f07f607a3b40ffffcee3a4db187586b01
SHA512 a468ac6781e11370be3bf6b2a7a15e5e4c4defc6d4837f437c8644f347f16f98cc1c7a3deb9b54dd37d7fec5a24ea1938249eec13a00bf3a72b573dfd34e68c7
SSDEEP 192:DusNbG0QLC+YLeKCQmiU1f0bZe+CGp+Fdes9omOQN6CiTqnzQ3XraVa:DusNbT8CzixiFe+CndHeRe2EzQ3x
TLSH
T111423B36AC785D7B99E7A546F4473A135EB85063DAC62F80D9EC5F0C01DF69C1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8934c3a1d46b897d2202564d6d77f130db50727033385e2a6d54537d00c65d1e
MD5 913e56e6cf55e33e0cb317d220d533c8
SHA1 1e64669e98509b4b3cdbb00b778f06702643bdff
SHA512 0770450f67af2661e13583198809845ceceeca802ffb4e5f152dcbced4b76800a99c2d889572e7fdc1c4dc6bf85c627a75cfaab26ba5f5e03390eec24d4aecb8
SSDEEP 192:MONW6v+YLxQmiUyLCEh+CGp+Fdes9omOQNUCHTqnzU6:MONW6vzbpEh+CndHeReNEzU6
TLSH
T1BD121B36A8785C6B5FE2A551F48735135EA85277EAC63F80E5EC5F0C02EF6AC1306416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a0270cba9a7b201e750d4526e80384e06c2c867996677e6c0997425d17b86d9c
MD5 3cf139ac086af5f8d90fe0f13254c00f
SHA1 c9f974e124f27c3fbd040688872e4256c820ca20
SHA512 587ffb930c16cd113809bbaead13aa930ff6f03f57d0ce106caef31b659705dc8e102c3e82c84d7b6c1619377eee02ac715dd5335850e3a617689cdfab149ea0
SSDEEP 192:JONii6v+YLNQmiUynCZh+CGp+Fdes9odus4PU6:JONii6vz/rZh+CndHe9yU6
TLSH
T19102EA356D381C6B9FF26E45F58736135FA81177E5953F84D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

527f1323-53aa-4d63-bfa2-dd8dc6cf50da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\527f1323-53aa-4d63-bfa2-dd8dc6cf50da.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b69205545f0243cb1860992b5b0a9553652e3278f793159a1a6c438334a63f13
MD5 f8559e4731a762234aab07d588155f43
SHA1 d04c6cbd9dad90bde529e76c324378070f76822b
SHA512 f044d4ca3c6736a46a0a9a0804f274cf4b57805fc23c12fef0bb096ef0f940f9a9b794758d7fb15b5ecc9c5197169eabb4dfe7a06957d2e24a2fe12e92305b3d
TLSH
T17341395CA6ED0108B3B76E5AAFF7A56D487EBC362F0BD59D10110E4E0A26B40C871733
MD5 SHA1 SHA512 TLSH

Submit Download