hxxps://shapes[.]inc/inverto87/relationships

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://shapes.inc/inverto87/relationships
Sample260804-pdzrnsag96

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5876	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303192393429804"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{4824BA45-B9BE-4429-B0FC-58B439612102}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6028	msedge.exe
6028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2224	1492	msedge.exe	80
PID 1492 wrote to memory of 2644	1492	msedge.exe	81
PID 1492 wrote to memory of 5876	1492	msedge.exe	82
PID 1492 wrote to memory of 2644	1492	msedge.exe	81
PID 1492 wrote to memory of 2644	1492	msedge.exe	81
PID 1492 wrote to memory of 2960	1492	msedge.exe	83
PID 1492 wrote to memory of 2960	1492	msedge.exe	83
PID 1492 wrote to memory of 5172	1492	msedge.exe	85
PID 1492 wrote to memory of 5172	1492	msedge.exe	85
PID 1492 wrote to memory of 5172	1492	msedge.exe	85
PID 1492 wrote to memory of 224	1492	msedge.exe	86
PID 1492 wrote to memory of 224	1492	msedge.exe	86
PID 1492 wrote to memory of 224	1492	msedge.exe	86
PID 1492 wrote to memory of 1232	1492	msedge.exe	88
PID 1492 wrote to memory of 1232	1492	msedge.exe	88
PID 1492 wrote to memory of 428	1492	msedge.exe	89
PID 1492 wrote to memory of 428	1492	msedge.exe	89
PID 1492 wrote to memory of 3232	1492	msedge.exe	90
PID 1492 wrote to memory of 5984	1492	msedge.exe	92
PID 3232 wrote to memory of 552	3232	msedge.exe	93
PID 1492 wrote to memory of 2244	1492	msedge.exe	96
PID 1492 wrote to memory of 4672	1492	msedge.exe	97
PID 1492 wrote to memory of 2532	1492	msedge.exe	98
PID 1492 wrote to memory of 4680	1492	msedge.exe	99
PID 1492 wrote to memory of 4680	1492	msedge.exe	99
PID 1492 wrote to memory of 1224	1492	msedge.exe	101
PID 1492 wrote to memory of 1224	1492	msedge.exe	101
PID 1492 wrote to memory of 6028	1492	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://shapes.inc/inverto87/relationships
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffe1657c188,0x7ffe1657c194,0x7ffe1657c1a0
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,1380523829759529045,3404820801446370502,262144 --field-trial-handle=2176,i,4056610013882548078,6760978121754706031,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,5596914407221964050,17931708235302997409,524288 --field-trial-handle=2176,i,4056610013882548078,6760978121754706031,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,18372036503942133109,10695541568765484679,524288 --field-trial-handle=2176,i,4056610013882548078,6760978121754706031,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:13
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,1185628386484572036,11075262518040590617,2097152 --field-trial-handle=2176,i,4056610013882548078,6760978121754706031,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,9106266148812950516,5111930839248445190,2097152 --field-trial-handle=2176,i,4056610013882548078,6760978121754706031,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,13262368564508219296,6120058377451112839,524288 --field-trial-handle=2176,i,4056610013882548078,6760978121754706031,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,13948932836259216517,1344970271536367591,524288 --field-trial-handle=2176,i,4056610013882548078,6760978121754706031,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,6013648377209460085,162618907089701097,524288 --field-trial-handle=2176,i,4056610013882548078,6760978121754706031,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1136
    3⤵
    PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,14160327233454304541,2612176862113287359,524288 --field-trial-handle=2176,i,4056610013882548078,6760978121754706031,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,14160327233454304541,2612176862113287359,524288 --field-trial-handle=2176,i,4056610013882548078,6760978121754706031,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,15107354490402202611,1824587063308769691,524288 --field-trial-handle=2176,i,4056610013882548078,6760978121754706031,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,10518408606690336257,7139594766937527515,524288 --field-trial-handle=2176,i,4056610013882548078,6760978121754706031,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,12778384516930532642,12983440318544069514,524288 --field-trial-handle=2176,i,4056610013882548078,6760978121754706031,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,11816375882024090596,14842502048222995928,524288 --field-trial-handle=2176,i,4056610013882548078,6760978121754706031,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,2156322780511146634,1943291558696645650,524288 --field-trial-handle=2176,i,4056610013882548078,6760978121754706031,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,4319531393886936266,5416012187417678034,262144 --field-trial-handle=2176,i,4056610013882548078,6760978121754706031,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ccac19c56d83224472797fffd76c1a0a5f313376f023e00eeb2408b8c467cb4e
MD5 0af23bd88c2199ab5846d85b1dd5e6a6
SHA1 8963301bbb2fe993183770b20a4e3033356c558f
SHA512 e696f6da87115313274893137169c7c00737a3c36cbdedf0b599c6f5c14d2cbd2d9e4da40b1f513bdda9473e593b2b9d4ce3eab13815c4a9a06bd784d9fd7206
TLSH
T11EE02BB6CD21AD3B09FE273950505745EB4527971B42891F7B3CD10C8FB173A4545D5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 79KB
SHA256 d7777063139eba1399cccbd30dc9edccad8e50c33e8e6ce3bc5d3bb632c65d38
MD5 18fa6d8eadcda08dc1b41612e2c38ca3
SHA1 8bb9ba1dd00c88fd3c52121223680906bad49e8c
SHA512 e45267a762923b6d26ddfb5438eaed258b8ed64c2a57397df562a0e2835160ae39f61e718dc9558c81feb460b6fad09c766adc6a5053e0b38d9c039cd7a4ec60
SSDEEP 1536:1BHqvURB0Dm4fRZRJdjLJw/t1XUzWMKkckGrbMOt:1BKvKuDm4fRZI75Dfxt
TLSH
T15D8312B53398CCBA4F16A9BE43F78B986AF2C5558CB053E67D04F38D33095320B51216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6085409068ef56e8e4ec0743318948acc75b48d1e0374e7edc55080e66dab6b8
MD5 7041043e214d03a8efcb70b429b575dd
SHA1 0c933f539267c2ae4bc6f97c035ca9ad544355a0
SHA512 b1d970c89cf42916bc557b88b09ef85226015d8a6cbb25a2a089fecc5bc031727df09b40dfd5552f91e5581ae23e2ffeaaeaf73de8b5b8b5a6874446431b9de5
TLSH
T1D4618421879171F2FFDB0BB07EC18A05B171545848231FA341D749FFAD3A6BD35A1858
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5839f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5839f7.TMP
Size 2KB
SHA256 86d973b89cb2e08fa633946b2d93a70ae147a929abb0e0fcc34ca64a03579e76
MD5 15f037b996327563d4289eccd92a45ed
SHA1 307a0966b88ab730da47cc9b4576facaec1d921c
SHA512 493d688005be3d5177bae62faeb995b202c0489a805181000cff078cd492b014a9dab84df5c7be61c0d612dfec1a40c961c0903a339777a2b607f20ff5163516
TLSH
T1744181218B9274F6F3D30B30BEC28705B07184A849135EB246E309BFAD3676C36A042C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f503cbcf5ce69c459b03ef40d76971875b94b62ffd15a976d69aba380c6681e9
MD5 0e86268445542cf776c7f9018ed19c85
SHA1 ab1bc4f7cf2db2d51e710ac514ea1a84a88d65b2
SHA512 7a27a3d35f14203207775627806b27a33c3d493685b05cc60bd3beba5c095f83a81cb473e9ede8532790d88bd3d188ee34ca37b90ac5d5ba8922aa0b65622767
SSDEEP 96:D1tOvVev9FEewAazBaij6VhIy8wELyECFn7MG34GUwQ:D1AvVevgewAa1aij6VhI5wELXCZ7MG3I
TLSH
T15EA19DF7D3E8852E9A2392F0AA14AD2BCE5D1524431C3CB989D4AE0B53E2473F141B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 37157ee199534e057719ea6d1fcd43e02a9be54ee5d2dfbfb04c50807f766b30
MD5 9593e00e5989249331f36d756211943f
SHA1 fad54d0c6c2f927a79fba72d2144a72b08443535
SHA512 5fe1b19232ddefab98facdbad781b0914f85b85be393e1c58da0ddce40f74dfdfabcd659bdae9dc19bd6d40e606c6855a3cf05dfba05bcfc115520393b2f0eb0
SSDEEP 192:sxZ6RJyMqZjK1Ml8MFI/fAsVsKTGdwezodpOuCFx/W6+WNY3IO/Y0h6sucRyIgjU:sxZ6qdI/fAsVsUBXCT/bq/5j0j+h
TLSH
T1CB72F8116A345D7BCCDBD319FA45BB53D2F915A392804E44AAFCDA1C00E6BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9dbc92246ca2e4dd60274e4f25b67f4e3d54c91ff29f883b4babe79c06604bba
MD5 7380ed517eb17c97b76b514ba112867a
SHA1 684878ef9bca03ab7fb7660c5883a7ca16645db9
SHA512 01070db6f9b0a54b1c52c39943beb010c9b543a8320add469d6e26167f9b6a8b2849d774c1a4063ab9822d251bc6153666b976dbb6185cf0276a999acb018f7f
SSDEEP 192:sxZ6RJyMqZjK1Ml8UQIFI/fAs/aKTGdwezodpOuCFx/W6+WNY3IO/Y0h6JcYRyIR:sxZ6qq+I/fAs/aUBXCT/bq/5203+h
TLSH
T11E72F8156A345D7BCCDBD219FA91BB53D2F915A391904E44AAFCDA1C00E6BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 bb38d2843fac1676545fd1dbf46602eafc3617f0c3745aa49a1031db89ab22d5
MD5 c258ab0ffae4e902108528daa451bbb7
SHA1 94e44101cf4854bc8266cb0bf62310392e8e9398
SHA512 3ec692d2f7ea16ccdd85ca60febe9a9af8d14ee54e97dc94bcb3cae8992bb419a44865ee591a8d960ffbbb2f42a725ba3cb82349855708e5bfdcf7a2377fc549
SSDEEP 768:wQAKq8y028bWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L4Ll/f10EMEroSO:wQAKq8y028bWRmj1QWTu1jaKL4LpfiEC
TLSH
T1FFE21B3B284CCB7E4FC44E9CED276E8769D802CBA7588D5447FA494C03CA3EE511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6f6375b6e72005887d0cc842d053958752a80fdbdad1e53448f1db462bf6a1fe
MD5 19c6174d718d055a539bbca13be29345
SHA1 890ba82576459817fbaa7548cb84b8125ee8acd3
SHA512 e6c8f9d80d8e7aa207e9d980caa4f7717931762701f0cf9fba86ef4bdf4f06238a2c737f5e222f5f83e52ca77a7916bbeb4c46f6471f11e4fb4ce5b50d1c8167
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5U:GZLVDJjEDPV0/Zds5/d
TLSH
T1F1B28A1232BA02023C7D290C93968B675A42F1A33459ED7F7BB940B64E67E125DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f89d5ae9a7dddfc2e384abcbe2f8bde75c28c71528f06ba1e20f45a2cd668192
MD5 ea7067e7f1fcb48ee6c1d5b25afa91ac
SHA1 f2ee67237d51c52b2cb62686cf086d0359dbb536
SHA512 b78b8c4b5f95fa067e0af5cf66f92b437c0bb92782bc921037c61511a1ac70eeee3794b397a2fcb1612b09cff37a99cf7cbd1f0ff9bd58dbc6ae725f05984f1a
SSDEEP 384:nPiF9CcmyWCs38NF8TUNTUlIxBPm3ek32nn9Vlx4JfbgG2DT+b1Za6ape4KV8p0J:aFccps3CwgPKekmRLG2DCrGpI8p04U
TLSH
T1F4C24A32EC18CDABECE64F99F60A7506DEE04267868C9AE4DAD92D1D009B1DD530FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 892148de9ac1b21cefc9ee8f078078ed03a1a8bdac1aa8dc84b9813c1920c694
MD5 efc86cd5813765397ea7cc82b7805006
SHA1 84d78fb157b91634acd19ddde0fa194217fd212a
SHA512 5652b0f29f70b79952c003eca63c6d73dd5ddeb9e66beaf74b3c78d77a53543666c7daa21041146256a2287649d6c4bf299c40ed621684309bdddb55433ebd11
SSDEEP 384:nDiF9CcmyWCs38Ns8TUNTUlIxBPm3ek32nn9BvQ/s4JfbgG2DT+b1ZUWe4KV8p0J:uFccps3fwgPKekmHMsG2DCrUWI8p04U
TLSH
T15DC25A36EC58CDFBECE64F89B74A6A06DEE01227859C89D8DAD85D1D00971DD130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a3a23a9bcd70a75ee266414ba0990ada63253e2ad01004d6e3db5f195adf9df3
MD5 0c6de12163102708074eb96b92c0329d
SHA1 1af685c20f2823bc52b585ce300e449f5b7ed554
SHA512 9e8c3ac0774f65592fb372bbda458fcd2d0336e26b1e7f0bc245bc6d8393d1b3c4c2c63754a225d9c174a1d9e68fc5384477c47446d8383f8670e52b9351b43c
SSDEEP 384:n5iF9CcmyWCl38NJ8TUNTUlIRHPm3ek32nn9diE4JfbgG2DT+b1Za6ep9ty/7IgO:QFccpl3ywgtKekm+kG2DCr6pt
TLSH
T188C23A32EC64CDBBACEA4F99E70A7643DEE041A3968C5AD4EAC91D1D009B1DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 538aee3b4fdfdea55a414f86125e237d8f0717442ca3a0b9b7bd0ec00f1c63dc
MD5 8170e67ed3be4ba160e87768d07a3a45
SHA1 892dfd9f8a2f2830a195afe3919a8187a1465f23
SHA512 ceb2759da91a416315c8a981d256bcb96caf9cf35112b0b42a76d08dc9d5159dd72ef919b4b73367f5bcaabc495ad02b979d7e9db65b6d4a5c894bcaa5c6c540
SSDEEP 384:n5iFmCcmyWCB38NJ8TUNTUlIRcPm3ek32nn9XiE4JfbgG2DT+b1Za6ep9ty/7IgO:QFlcpB3ywgKKekmUkG2DCr6pt
TLSH
T1DCC23A32EC64CDBBACEB4F89E30A7643DEE041A3968C5AD4EAC91D1D009B1DD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 a0e0a8b5428f44b672f6ec50b2223663e5b3f79fab4223f19cd6980e389a303a
MD5 7d657a6af8049bf7cbd28ef241f669a5
SHA1 01395ebc8827cffa1e08535fd6d04903c8656fe0
SHA512 9631c7b971d57c01b46db5c89b57414466ccde0759a3fcb2b6bb67b46579a12aee529dfb17acc685feae44e2f96e22ec83f673f6907076a41a025b7d0e27634b
SSDEEP 384:nviFtZcI238NJ8TUNTUlIRAPm3ek32nn9XbE4JfbgG2DT+b1Za6ppBeRs9JKgqiq:6F123ywguKekmZkG2DCrVpTjKgqmU6s
TLSH
T108F2C5F198D78977E8AE4B87A37D2D029AFCC153B5885994B7C91C0DCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5c48b2b818791ea98511ea912259f211ccff9f6b724ead8506e7520cb1c0fc7f
MD5 26d38cb6f8da2cbd63b9c369995952ab
SHA1 ee5a7955a5760928e47235bfb06940c2be464842
SHA512 bd84822ff57415a4bc88ba5805b6503623808088e3246102b923a7af72edcda53988ad042a1ee72faa3cb1aa8b3560da441df29fabe67a48d9f9876bb7c8e0f5
SSDEEP 384:n8iFtZcIf38NJ8TUNTUlIRAPm3ek32nn9XiE4JfbgG2DT+b1Za6epBeRs9JKgqiq:nF1f3ywguKekmUkG2DCr6pTjKgqmU6s
TLSH
T165D25932D824CABBECEA4FC9E74A3647DEE04153DA8C9AD4E5DD6D1D008B19D530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5984-328-0x0000023E42A30000-0x0000023E43A30000-memory.dmp

Download