b17b0f6fdc1c336bd7cf63bd1d1ae822e24b16cca1bff1c058f41867e93f7715

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
capture/index.html
Size 197B
Sample260728-pg7lpawyet
SHA256 b17b0f6fdc1c336bd7cf63bd1d1ae822e24b16cca1bff1c058f41867e93f7715
MD5 d85c87c1649328d65c2f9220ba2dd3cb
SHA1 a987c75ad0d2cfbaa643b9add1c309d51a9cbbe6
SHA512 3e7bb91389f4be9bad33d80c1479159433e17fb1675111a2f02064979b4140591ea4885741f85044e0b812fb3322554e3a56d274a15734082e722565b96e1e77
TLSH
T1D5D02288C8A1B601E30004442DC0B9081DCAE2CB6281980870DA60A2DF44284C8C3588
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5296	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297147583471369"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{14F38DC6-3E35-4F0A-87CB-11989EC40069}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4056	msedge.exe
4056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 4748	3824	msedge.exe	89
PID 3824 wrote to memory of 5296	3824	msedge.exe	90
PID 3824 wrote to memory of 4900	3824	msedge.exe	91
PID 3824 wrote to memory of 4900	3824	msedge.exe	91
PID 3824 wrote to memory of 4900	3824	msedge.exe	91
PID 3824 wrote to memory of 1668	3824	msedge.exe	92
PID 3824 wrote to memory of 1668	3824	msedge.exe	92
PID 3824 wrote to memory of 4752	3824	msedge.exe	94
PID 3824 wrote to memory of 4752	3824	msedge.exe	94
PID 3824 wrote to memory of 5820	3824	msedge.exe	95
PID 3824 wrote to memory of 4752	3824	msedge.exe	94
PID 3824 wrote to memory of 5820	3824	msedge.exe	95
PID 3824 wrote to memory of 5820	3824	msedge.exe	95
PID 3824 wrote to memory of 5604	3824	msedge.exe	96
PID 3824 wrote to memory of 5604	3824	msedge.exe	96
PID 3824 wrote to memory of 5604	3824	msedge.exe	96
PID 3824 wrote to memory of 1132	3824	msedge.exe	97
PID 3824 wrote to memory of 1132	3824	msedge.exe	97
PID 3824 wrote to memory of 1132	3824	msedge.exe	97
PID 3824 wrote to memory of 3532	3824	msedge.exe	99
PID 3824 wrote to memory of 3532	3824	msedge.exe	99
PID 3824 wrote to memory of 612	3824	msedge.exe	100
PID 3824 wrote to memory of 612	3824	msedge.exe	100
PID 3824 wrote to memory of 2920	3824	msedge.exe	102
PID 3824 wrote to memory of 2592	3824	msedge.exe	106
PID 3824 wrote to memory of 5996	3824	msedge.exe	107
PID 3824 wrote to memory of 1408	3824	msedge.exe	108
PID 3824 wrote to memory of 1192	3824	msedge.exe	109
PID 3824 wrote to memory of 1192	3824	msedge.exe	109
PID 3824 wrote to memory of 4056	3824	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\capture\index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d0,0x7ffdce05c188,0x7ffdce05c194,0x7ffdce05c1a0
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,875842403574745991,14866046889790003599,524288 --field-trial-handle=2320,i,6851804096456401130,16146053152234521742,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,16398058753465453077,2060854459425194313,262144 --field-trial-handle=2320,i,6851804096456401130,16146053152234521742,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,18287468172292475311,7744283546425032947,524288 --field-trial-handle=2320,i,6851804096456401130,16146053152234521742,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:13
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,6729936956640976349,1737730789623885331,2097152 --field-trial-handle=2320,i,6851804096456401130,16146053152234521742,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,16621858746712675356,9995355112384481151,2097152 --field-trial-handle=2320,i,6851804096456401130,16146053152234521742,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,11292581035300687956,7333536012035011181,2097152 --field-trial-handle=2320,i,6851804096456401130,16146053152234521742,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,8968460426167083911,10773427514829616729,2097152 --field-trial-handle=2320,i,6851804096456401130,16146053152234521742,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:9
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,16639120251860683124,15231351053863899022,524288 --field-trial-handle=2320,i,6851804096456401130,16146053152234521742,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,10526365388157532965,12217717175860921148,524288 --field-trial-handle=2320,i,6851804096456401130,16146053152234521742,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,17590051262782628746,4650623484908476771,524288 --field-trial-handle=2320,i,6851804096456401130,16146053152234521742,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,17590051262782628746,4650623484908476771,524288 --field-trial-handle=2320,i,6851804096456401130,16146053152234521742,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,16960763395573281041,3637041644183514826,524288 --field-trial-handle=2320,i,6851804096456401130,16146053152234521742,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,2425833619831408480,12433630996904762936,524288 --field-trial-handle=2320,i,6851804096456401130,16146053152234521742,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,4279482483325559900,6814989463504724612,524288 --field-trial-handle=2320,i,6851804096456401130,16146053152234521742,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,6794066557563330889,2411253254621978885,524288 --field-trial-handle=2320,i,6851804096456401130,16146053152234521742,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6452,i,1135732718970416966,7669724658938503449,262144 --field-trial-handle=2320,i,6851804096456401130,16146053152234521742,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8a7c3f27a0aa9bcbb49604a5ec37c4bb6bd71ab9fa63520aaa3041aaaebf6ca5
MD5 fea6b02dd679ed9ef65cf469b05d96af
SHA1 3180cb50d94a8a0a98ae01063e20db5bb63d8ad2
SHA512 20a76018e8635ddeda4029f2091ccbef0795ed517678e8d867ecb2ff03e0972cf2efb6779bf5df4038ba9e483f39744630f31b78ba4f9fde96326587c5c34234
TLSH
T17341E7D41BE90AC2DBFC8EF520E1AADD37F0C4AE01176E8064422E700B0AF9691D2973
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c23d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c23d.TMP
Size 2KB
SHA256 037953d464210bec7fbd4b3d911394957a1aac08abdc45e6af8688a365620a6f
MD5 7b0672e3e7fe3937cde9a3be2688ebbc
SHA1 788cdac97a4d7a99147f5d11fb6d2bb8d04caabb
SHA512 810e9df4b61d868f192e37e01d725da75351c28c55c423f90cee2f5d7e0317c649d5f0f281d6632595e1094d7374af757c29e3a669786bb4f521b4a14a1ae21c
TLSH
T13D41E7D40BE90AC2DBFC8EF560E16ADD37F0C4AE00176E8164462E701B0AF9691D2973
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 88573d2ca3cedec8fc1982474a284575572868a12a1225d18164c6e9c95cdd60
MD5 cfb20fc36b1410c019be6623e0aa005d
SHA1 ccad0e620538b61a0a1daaab9688fb7cb5c36b83
SHA512 7b0b9f28494806b736f25ba34cf3a88cca36701adc5d83b5d7f2f2cb919c8a0fc31c9fd2dc43e0597a1b58d936dc8736af67c7505c418b144d0f06f995875464
TLSH
T18541D0F7C7E4893D890146F0AB147E2BCE1D0914832C3D5AC9E4AF2BA3E2471D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a274752944b98465545de6779aabefc3dc07d619247dbd7c18cea3faf2f6b34e
MD5 8848a41850dd6716014d45dbf2ba0403
SHA1 fca4dc2c90de91dff9c3f4783e5b0a67ca704865
SHA512 a55645ef38ec2013c3dfe4e785604323abde6f6439bd193b3f1acf0383fb1ed9b23d427ece93e286c59840f14df588753f32f5684f89f1217ff2918196e72327
SSDEEP 192:sxRYR9b9/fjsy7Dde5lSZzoD8p40/g6+WNIYCyuOsG4IgIJ:sxRY39/fjsy7c5lU1/5IQ8s
TLSH
T11832C7166E289D7B8CC7E20DBB55BF53D6F95032A1E02E49E7FC861C14EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 24dd9e2235037193863464de4f55b511bacc5144e3e4d7818ae6f4526eb43e4a
MD5 fc06deec59208dce18e5c031c0347df0
SHA1 7cf4f6f41e0bfab81deb6cfeaabc87e616642c1a
SHA512 71155fdd5d6927b2c5303a159949c32428dc77fae2e6ea25c064464cf12b8ba1de996304f2547d3b1d74d24df5b9105ea7a694df2a6895ba95f9e36931558166
SSDEEP 192:sxRnR9b9/fjssRDde5lSZzoD8p40/g6+WNIYCzuOsG4IgDNJ:sxRn39/fjssRc5lU1/5Iv8r
TLSH
T1BE42D8166A289D7B9CC7E20DBB557F53D2F95032A1E02E49A7FCC71C14EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 287bb9e2a126a23d7b2f84317e9c83d7e3983b45adf2fb48b8a5b908fafaed9c
MD5 26ce845672a43e91527f7cdb9c625eff
SHA1 b528b2e5b5cfec1288b54bc1260c113330df5ef0
SHA512 bcdd9ee031552e2b5fe69fcd4afc9b7b6439070da2389d56d79c9998d768be36f1d020b9d56ac7d0e348c356ab369644d56cb8f333f3e4cd09a545b4d77ac619
SSDEEP 192:sxRnR9b9/fjss7Dde5lSZzoD8p40/g6+WNIYCyuOsG4IgD7J:sxRn39/fjss7c5lU1/5IQ8B
TLSH
T14332C7166E289D7B8CC7E20DBB55BF53D6F95432A1E02E49A7FC861C04EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 1924dc118393049dc9773c6a3b52a10d5eff5081fb36aaad4cf0182a60137f81
MD5 e8edb2bf54beb5ecc555c172485e9b22
SHA1 a334cb01f2e7571a49bae5a91eb725ff19b5c80d
SHA512 b40182f518782f9247fe86225cf5e6de7db3da1b7d46c5d414f9754f9b9095613cfddef22502452d3ba9f01489c8924db5cb94fe48b9f2882f5a16ce5bc0562a
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvAroZSo:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0Vm
TLSH
T1B4B2EA2B600DCB7F5F800AADAC196FD76DA802CB97589D4047FED94C02C77EA92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 64a1a9aed12f6987873b73b23d55054d5e5a2844da85e1091240f769c9543e9d
MD5 8530d4adba4d3308c23ca5479f157911
SHA1 5b147ab1669f0c4c2c642043699192bfb061d914
SHA512 753f67c7c2ec1300bd69235ecc798d4de213bcac63e2662fbf190d417c8c8ffcd5500a074fe92bf7028690860f46c659d9bfee2aa3c07492c9efc1df4692fd9c
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHFSr/VPTXWbAOgHXK42gZXc9l0kwK1yO6/:CbEBVj5JAdSp9/EgTK7j6dJOHFSr/VP3
TLSH
T10F91A511757E0781383DA50C81798C2FDAC170F6346AA52B3FA825A61F67E425EFCED8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7dd69640429c8fbd2b912d00c04326334c06a0e09bed7f3cda1c243c6e943266
MD5 ea78d578654ad0d8587e74e4464395ee
SHA1 c78c0082a729c4852d68084034f2d6ec6c83d0ec
SHA512 269013126cc12d6d68f1578e7cee34d53bffb9ba29525cd8fcb747a5f92719bd7d14e62cab261cbff988ba1c3e6b55ff10fe97ee5dc149df9acb24c716941161
SSDEEP 768:Xi3cb2QVqZp8+p3bd66j+4BRv86aLIW6w3b9Mg:Xi3vH8+p3Z6n4yJ3b+g
TLSH
T13DF2BE72ECA88E738CF6C754B28637036EF49663D7D41E8898DCAB0D059716D470B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bad656db85cb3fac574cbd894effbea0b8f360dbdc5a6ca616c57d84a0a34d57
MD5 54a800d79ee92bdd176278548c9052c9
SHA1 661c8a893e843f076c84c617d0bb3d5c9b3c38d5
SHA512 8d585cdb788d9bc0dc4a716ef1023f89040e7c60c2613bfd4a616289e63902c1a497dbf5023f9d7f6c648d03012c27d21d9791321bdc5f38435340b024cc9218
SSDEEP 768:Drv+4UNbdR3aF2QVq5p8+p3bd66j+4BRv86aLIW6w3g:DbsbL3Fn8+p3Z6n4yJ3g
TLSH
T1B003AE72F8AC9D739CF6C644B1873A433FB8516396C01EA4D8DD6B4D419B1AE130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2c2e0948534813f07ab92f8287ccdc88fa66babd78e79ab47a8038fe5c741a12
MD5 2f8da9d505a051ad5e72cc34ad5e9b16
SHA1 84546c6d816ac46362282cb4c191d8c277c585fe
SHA512 e3be41010534158bba9e16abc7e1f4fa27cb91eec599bed6a316c7a22ec9fd36086fa95923d33036b524bdee986b5233cd9e9901d574944bd63e375bf97b0583
SSDEEP 768:Fi3Pb2QVqZp8+p3bd66j+4BRv86aLIW6w3b9Mg:Fi30H8+p3Z6n4yJ3b+g
TLSH
T19FF2BE72ECA88E738CF6C754B28637036EF49263D7D41E8898DCAB0D059716D470B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 f8cafe43d661580b4e5e08a103759a697254f38e1600f1712e2e1d05bbd52776
MD5 c02219193174ceeb2fc2a542136b71df
SHA1 8dfe0007f7b6db282485a5ff90c7226ff50305e0
SHA512 d906cf985e63b1510f25ee7916090ad37028d8e494b2ba5b76f65d3188f8b870154267e60454682c4688ab783a34315545249ffcb010ad6aa0dbc9ac00831596
SSDEEP 768:0FQz3cwgZb2QVjp8+p3bd66j+4BRv86aLIW6w3b9Mg:Xz3q8+p3Z6n4yJ3b+g
TLSH
T1B103AE73DC988A77DDFACB54B2863603AEF54163C6D06AD4E5DCAB0D41970AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e1fad2c3ee8aac74dcbf06668ed46c2b006dab216611a1ce2641cfa59da7cbab
MD5 29ed70ce3de64223a8f4fe0ee4c3b093
SHA1 22feb2b26a9779d2d931e1f300e96d4369332d4f
SHA512 1ca6108870640b199939b85c6ef3f5c5e2ca6f28b811b6732d4fdfce4b64e2f71da5cccd5105730007568064af8ffdd2d2793fc94024988b4ec76dd5fef3e4ea
SSDEEP 768:Irv+4UNbdD3JcQVTNp8+p3bd66j+4BRv86aLIiq2bwCl1:Ibsbp3lL8+p3Z6n4y40ww
TLSH
T1D503BE33E9A899739CF6C648B2467B433FF851A396C10AC4D4DD2B4E419A19E230BD77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download