hxxp://gyva[.]be | Triage™

Analysis

max time kernel
148s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gyva.be
Sample260804-jlyaxsfe52

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1880	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303031917968508"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{C956290A-2C3E-4891-9240-6D97A2A4E373}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 3776	2968	msedge.exe	78
PID 2968 wrote to memory of 1880	2968	msedge.exe	79
PID 2968 wrote to memory of 1404	2968	msedge.exe	82
PID 2968 wrote to memory of 1404	2968	msedge.exe	82
PID 2968 wrote to memory of 1040	2968	msedge.exe	80
PID 2968 wrote to memory of 1040	2968	msedge.exe	80
PID 2968 wrote to memory of 1040	2968	msedge.exe	80
PID 2968 wrote to memory of 4028	2968	msedge.exe	83
PID 2968 wrote to memory of 4028	2968	msedge.exe	83
PID 2968 wrote to memory of 4028	2968	msedge.exe	83
PID 2968 wrote to memory of 1792	2968	msedge.exe	84
PID 2968 wrote to memory of 1792	2968	msedge.exe	84
PID 2968 wrote to memory of 1792	2968	msedge.exe	84
PID 2968 wrote to memory of 2180	2968	msedge.exe	86
PID 2968 wrote to memory of 2180	2968	msedge.exe	86
PID 2968 wrote to memory of 2180	2968	msedge.exe	86
PID 2968 wrote to memory of 2988	2968	msedge.exe	87
PID 2968 wrote to memory of 2844	2968	msedge.exe	88
PID 2968 wrote to memory of 3960	2968	msedge.exe	89
PID 2968 wrote to memory of 2988	2968	msedge.exe	87
PID 2968 wrote to memory of 2988	2968	msedge.exe	87
PID 2968 wrote to memory of 2844	2968	msedge.exe	88
PID 2968 wrote to memory of 2844	2968	msedge.exe	88
PID 2968 wrote to memory of 3960	2968	msedge.exe	89
PID 2968 wrote to memory of 3960	2968	msedge.exe	89
PID 2968 wrote to memory of 3952	2968	msedge.exe	90
PID 2968 wrote to memory of 3952	2968	msedge.exe	90
PID 2968 wrote to memory of 3952	2968	msedge.exe	90
PID 2968 wrote to memory of 1684	2968	msedge.exe	92
PID 2968 wrote to memory of 3584	2968	msedge.exe	93
PID 2968 wrote to memory of 1684	2968	msedge.exe	92
PID 2968 wrote to memory of 3584	2968	msedge.exe	93
PID 2968 wrote to memory of 2312	2968	msedge.exe	95
PID 2968 wrote to memory of 3192	2968	msedge.exe	96
PID 3192 wrote to memory of 2748	3192	msedge.exe	97
PID 2968 wrote to memory of 1568	2968	msedge.exe	98
PID 2968 wrote to memory of 3112	2968	msedge.exe	99
PID 2968 wrote to memory of 2408	2968	msedge.exe	100
PID 2968 wrote to memory of 1452	2968	msedge.exe	101
PID 2968 wrote to memory of 1452	2968	msedge.exe	101
PID 2968 wrote to memory of 2036	2968	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gyva.be
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffbff2ac188,0x7ffbff2ac194,0x7ffbff2ac1a0
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,4217490868139577,7276914009551636636,524288 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,14667544011785884365,4708870748899121750,262144 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,2181137388705415221,12618422174419989487,524288 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3352,i,10130782905942150218,7534696825344993955,2097152 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3356,i,4767279110100086317,10843294823519190404,2097152 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,2939463394289393873,9138364276660320351,2097152 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,5330724678158072693,4258446784099957997,2097152 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:9
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4200,i,2483340075368914597,2885920879298334552,2097152 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4212,i,2785423144507454222,4169112421122515755,2097152 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4328,i,1396170598167744461,15677659825437546208,2097152 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,5627055114474742754,15539713734446677940,524288 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,14797304614136584847,16473288623091227199,524288 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,6152149091237950299,12411885447787411620,524288 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,6152149091237950299,12411885447787411620,524288 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,6462031765827161452,5275213847964970293,524288 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1148
    3⤵
    PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,10784835997777930700,16237687329715459537,524288 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:14
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,9124005048045029362,10115225660652208829,524288 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,18207572733611983117,15810252598963293985,524288 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,291651819514652613,9542799687975208995,524288 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:14
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6528,i,11626988624003005504,10500889185808730959,262144 --field-trial-handle=2164,i,5511895055807629029,117257386858339885,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 484bcb5c661e6c1ab7c1e8eb0c2dc5467b2aad2bbfa7193f8c39808e2bc6a2bc
MD5 0303b5ff4733f8166294ea49530b902f
SHA1 dcaf0862a7b91f354c8fbd6433da224b0d79fe0f
SHA512 3c3ff7263abf5e7941634b2d489f03a0b875cc87021be2b45ea0f9cc3587625ccfb24009d6570292f82c542e63f3bb31ee266157332eb559db4019f9a6131084
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3143177facae2cd6dceecac41f4d733162a24490c8b4f30b118ecb549f5228aa
MD5 b1fa0fb45d5eeeabd408b2f0a6b378fd
SHA1 6cfded3cf6c7296e7d687cafcbce0565e4a38a1b
SHA512 1ee18b51288024f0b31c60e64148bed38ed007f9eb358914731d79bb8b07ad78c5f237211f5b41993f1df6a364885b236cf29ff3571c9ac39bb5e10b6e3f5e3d
TLSH
T17981942984D2009FF3D0E930F3D145283BFEA0D65A83AF190BEC8975550AF90E676D2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ce96.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ce96.TMP
Size 3KB
SHA256 a09dd858977dadc2915f93c5584f6ba226a30ecf14fa6d4a939b56e395b3d07a
MD5 8c1675be87d4eed189db0c717835c9d2
SHA1 5cbd85bd8d18e134a12b8dda250c5b38570aa47b
SHA512 d847a4770b52e263a8ee844fb2871dc63e2d35368690b97f4074c752a2c69156e0bb3ba1bd7fd8c8f3eb814b83a0c64e00fb500e55a36c44197f184c107df005
TLSH
T1A571922944D2009FF390FA30F3D1463437FEA0D6AA939F2907E889796509F10D975D2D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c363b0bd0d2d7feb491666fc8681945579ac8d999a91cecba3ab7d44627bb1a9
MD5 3fc6ee7931c19659b80e7b076dc1d41c
SHA1 769308b783d6f69a5d9122e41122f4b237b7dde9
SHA512 b4d7b09a3ee269d9012700299e145ebbb16a1e0ac7bba8f606700d355bb6f7387837a793303ed3ccf6becce94c81d7ed79905918c347b60a34fecfc0d30ad46a
TLSH
T143516DF383E4956DCD1552F06A28AE2BCE5D191243687C1989E4AF1BD3F3475E101E4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f67ef4536fc0441bd331f4714868bdf4a33771ee1941404b6117f1c5432fc8cb
MD5 274827635eb00bf5670bf00c47ae7567
SHA1 51beb9fb1fa34b5755e53cf0629c9b8f06f700af
SHA512 9ec0b0924891a9b12bf4e678bde3b2549f76985881c2c976e598d36c077f3bae986ec3eca9da5798fe8fc2caca2dad6165bb44f1f0a97f8739783fcfef1b8962
SSDEEP 192:sxZRRnyM/jK1Ml8UQVFU/fmsaqZcjpIdpaQ/W6+WNvETI6/Y0oazPCCIg5eJ:sxZRlqzU/fmsaqZcjif/bvu/5h4
TLSH
T15F52E915AA345977CCDBD209F945BF53E6FA147292A00E44A9FCEA1C01E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 483e3a56151d5dce8c694be499dd758f4b06e435149bbba273c41d22cc09c52d
MD5 a740093280c0f951977e3c63ad235627
SHA1 a9beb52c2045cfecbe135ab1a7cfd3d80519a039
SHA512 ef9275636d3c7536c6d6bc311ec5bb640a1f17f34d12fcbcb659310fb4d5e6c89dc6fe1a59207c27c26df322e73892dc3ac2c68ec59c807679b5b340430f71c9
SSDEEP 192:sxZRRnyM/jK1Ml8MFU/fmsCqZejpIdpMQ/W6+WNvETI6/Y0oagIkCIgrJ:sxZRldU/fmsCqZejiJ/bvu/5d9
TLSH
T18052F9116A346977CCDFD209FA05BF53D6FA157292A00E44A9FCEA1C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 61031c1f59b85c85dcd908cc1dae29e281a5fcca7bde0b45b2a56568c86f9476
MD5 1f41f36832b1ef7683a8a7f3f74cbe38
SHA1 95d2951ce7ac636a47a5d38515aa2afa894ebc6f
SHA512 3c465a723cdf8abcb7696bb6d69608a14c22d3ea352f17a9b104146bf1685be4ece5a8c4926605dd01342011462ebd0fe4057dd1a9281be3998a15c69055b366
SSDEEP 768:lTc0s8Ww2YfWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BOLl/TB0OT+roWe:lTc0s8Ww2YfWRm/JQg1u1jaKBOLpTuOX
TLSH
T1C8E21A3B284CCB7E4F840E9DEC26AF966ED801CB66684D5447FE494C03C77EA521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cadaf01ab998218768e406774368232bad8c84c9c64d530eb37852f2f0079ecd
MD5 76329f2772cdc97caeb6a500b85a722d
SHA1 d91376930a7b12d54e4a41daa79c7b7c070af9ad
SHA512 16ada5c35728d67b523d762a53864ba588a8667450e0eaf17ec9c9de6a2ed6f755b3d091944474373da5958ac34c7b6ed25b82cff2a060a75103a1d75e07d38d
SSDEEP 96:KUgAK12CBJ4/7JvPBWbWcgDBKYogJBsxZeDvCBobcYa2KgWedzgggKY1gSgsQgtr:6DvTJz
TLSH
T135913A9776BF02023D7E290992959B560B42B1A770B8742B3B6900BA4D6FF114DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd341f47-e769-4914-9086-9a396b7f5e07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bd341f47-e769-4914-9086-9a396b7f5e07.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 344a682c0496ccfa897ccd720cb3567f4f6bed288817665ee0e04398ec21c2aa
MD5 3d98ae90d642e63ed4ca38aebc7c95ae
SHA1 15b5086d5f6228aa026b1c771980f96dbc01935a
SHA512 9fadc6c9bc9a24ac19a0084ca8b5b1386bb5f9bcb652aa7f8a2ede5855f637f7569fb896ae51795a133e06771ea66619bb1932b014dbf4bf0488c888a5d07306
SSDEEP 384:jZcIc8N2EpfbqkzUu8YEus8W1uKYoO1BeRs9JKgqijUkE:7c2fZgCE1D1BW1TjKgqmUkE
TLSH
T1B7928D305838A977EEA77684F98636178FB55027EAC43F94D5FC7F0D009A598230A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 17f65e0e10662d6fc1718326f3ccbce682b3f81ee747b978795904aa13784f29
MD5 f20667f0518c9fed33f659cc264afcf6
SHA1 f52078a9aa902bdd88dcb0d72dbcef7a48d61247
SHA512 6680eec5c81b7111d5386b98a36604d438fafd4d1f560e8be71a5c0436da258cec188a5936b78ba5a89a48bc507e5528dc45504f9a790c18f3908eea1b30436e
SSDEEP 384:XiFIZcIZ8N28TUNTUlIllpfbqQzUu8YEus8W1uKYoGC1BeRs9JKgqijUkE:SF2ZXwgpf1gCE1D1B+C1TjKgqmUkE
TLSH
T1B9D239F148EB9536E9AE5B87E77D2D138EBDD063B5806A50B3D8690CCC460BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7dc8940ee5d78d98cbf36a64a9009a76f7725a53dd0024012872d1f386a24e9a
MD5 c67d41a46a318589ade7686adbbdd714
SHA1 08a75845e436114fa71be5d16f0deeb1613a319c
SHA512 35d5ab071a491c3ff378be08874e4deab2e64c5535f86029932ed4a377f30963abf2fa41eb9e3d86757136e4bc6102ba425eeb4e90089d92e0dbed10f24ebccd
SSDEEP 384:UZcIc8N2lpfbqkzUu8YEus8W1uKYoO1BeRs9JKgqijUkE:ScxfZgCE1D1BW1TjKgqmUkE
TLSH
T1A6928D705838A977EDA7B684F68636178FF45027AAC43F90D5FC7F0D009A598230A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 eeb9364cc9e15f40691c667ab9c4912f8d2c5a37e6e0d0f40ad290dab9f16f29
MD5 0e69657feb50c9109e665708339da856
SHA1 648dea7db87c4196bd269115d18ff07d20f09699
SHA512 9601f7abb43ecbac623f2c8ddabe2dafd915aa399d6a4c9032f1eb152c67bbd81fd23808f8dbd418e3789b27b899b951ba325898188c5c4d4369312fae7ed2fd
SSDEEP 384:fZcIc8N2ApfbqkzUu8YEus8W1uKYoO1BeRs9JKgqijUkE:3cWfZgCE1D1BW1TjKgqmUkE
TLSH
T168928C305838A977E9A7B684F98636178FB45027AAC43F80D5FC7F0C019A598230AD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3e385e2731f47325a3a0fc03187bfa40f59bcb2b99a49179507e5978acc2ceb9
MD5 6726b4190834bf114bae07eedafa4a8b
SHA1 c58d2280589e9497bdefee812cf93d2536d9803e
SHA512 d1695760fca730c071e6d7866bdce6d62fd1c7d83e09adec62cc17b4c6a9a7e26f2cd588a754a63c4c3707b070243ce25b4407f8e5fe1747467a6ae1e911f688
SSDEEP 192:XGNV6jCQmiUywIzf4SufoPxzY5Sus6l1okSnUsTfU6:XGNV6qzIfju8YEus8Wx5TfU6
TLSH
T10602C9356C78787B9EB36E45F68737139FA5212BA9852F44DAF81F0C00D769C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 46d6f9917ceddd1e73c7439512c604629587c5b722a45e1c211e8606083baf94
MD5 4ed094ec9e98985a857dff9d7f5677a4
SHA1 a4180bca065c40e5eb052f8a4656cb848a88a0a6
SHA512 0829830e16c22c76122e6794db5755f084d5ca535129b907f55d29a08a258d298298b535c049ac5c1e636c4f5a84483a49438da1d8aeeb47413f045091a5e4e3
SSDEEP 192:mGNH6jrQmiUyyrzh4SufoPxzY5Sus6l1oaSuKPwozOMcqXU6:mGNH6R1hju8YEus8W1uKYoL1U6
TLSH
T1FA12FA756868B8279EA36694F58736139EB55127DE8A3F44D5FC2E1C00EF19C2306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8576bfe4-c3c8-488e-b9ce-a5ad914674a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8576bfe4-c3c8-488e-b9ce-a5ad914674a4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download