hxxps://shapes[.]inc/inverto87/relationships

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://shapes.inc/inverto87/relationships
Sample260804-pdzrnsag96

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4356	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303192833504162"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{D023B187-EAAF-4460-B99B-7120FEBC5D61}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
628	msedge.exe
628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 3228	4528	msedge.exe	90
PID 4528 wrote to memory of 4356	4528	msedge.exe	92
PID 4528 wrote to memory of 1160	4528	msedge.exe	93
PID 4528 wrote to memory of 1160	4528	msedge.exe	93
PID 4528 wrote to memory of 6556	4528	msedge.exe	94
PID 4528 wrote to memory of 6556	4528	msedge.exe	94
PID 4528 wrote to memory of 6556	4528	msedge.exe	94
PID 4528 wrote to memory of 5416	4528	msedge.exe	96
PID 4528 wrote to memory of 5416	4528	msedge.exe	96
PID 4528 wrote to memory of 5416	4528	msedge.exe	96
PID 4528 wrote to memory of 3328	4528	msedge.exe	95
PID 4528 wrote to memory of 3328	4528	msedge.exe	95
PID 4528 wrote to memory of 3328	4528	msedge.exe	95
PID 4528 wrote to memory of 7028	4528	msedge.exe	97
PID 4528 wrote to memory of 7028	4528	msedge.exe	97
PID 4528 wrote to memory of 1472	4528	msedge.exe	98
PID 4528 wrote to memory of 1472	4528	msedge.exe	98
PID 4528 wrote to memory of 5448	4528	msedge.exe	100
PID 4528 wrote to memory of 3132	4528	msedge.exe	104
PID 4528 wrote to memory of 1744	4528	msedge.exe	105
PID 4528 wrote to memory of 5876	4528	msedge.exe	106
PID 4528 wrote to memory of 4836	4528	msedge.exe	107
PID 4528 wrote to memory of 4836	4528	msedge.exe	107
PID 4528 wrote to memory of 628	4528	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://shapes.inc/inverto87/relationships
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffe2298c188,0x7ffe2298c194,0x7ffe2298c1a0
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,9694431884569659991,8845564577662224930,524288 --field-trial-handle=2744,i,6267387119065661745,17021678605376246197,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,9800411370836802837,1674653219471165169,524288 --field-trial-handle=2744,i,6267387119065661745,17021678605376246197,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:13
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,2699683167158026689,2107298617587666494,262144 --field-trial-handle=2744,i,6267387119065661745,17021678605376246197,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:2
  2⤵
  PID:6556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,11255453430252594923,5245701802150110644,2097152 --field-trial-handle=2744,i,6267387119065661745,17021678605376246197,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,13923018729883809077,12496828649990312371,2097152 --field-trial-handle=2744,i,6267387119065661745,17021678605376246197,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,9550604572231795652,14310064705461792979,524288 --field-trial-handle=2744,i,6267387119065661745,17021678605376246197,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
  2⤵
  PID:7028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,9639039052206847002,12411537934435978615,524288 --field-trial-handle=2744,i,6267387119065661745,17021678605376246197,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,15544131933803049334,3493692445944389202,524288 --field-trial-handle=2744,i,6267387119065661745,17021678605376246197,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,15544131933803049334,3493692445944389202,524288 --field-trial-handle=2744,i,6267387119065661745,17021678605376246197,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,11905305555931488577,5393298115966358637,524288 --field-trial-handle=2744,i,6267387119065661745,17021678605376246197,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,14861553603914812490,12576888875439942098,524288 --field-trial-handle=2744,i,6267387119065661745,17021678605376246197,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,16954898280096268876,9563192692962796647,524288 --field-trial-handle=2744,i,6267387119065661745,17021678605376246197,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,2437494143502589244,5004354578928569031,524288 --field-trial-handle=2744,i,6267387119065661745,17021678605376246197,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6392,i,17025470689048563603,15919631037315676613,262144 --field-trial-handle=2744,i,6267387119065661745,17021678605376246197,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 eb9935de8538aa350f36713f1a8627345db21c807e798c350f26a086505b46fc
MD5 c7e7cd05415551ad411fdd10969bbe4b
SHA1 b512d8c9f1e901486c4233c6da1627a27f380942
SHA512 92ee66e002ef544df5b84b349771e8b73a98ba6dadeb6e333d7792722fcfe111656d8781b0a29c7ed9439deb50bdfa4ce21c1251c083b0ef067daf2d657c72f5
TLSH
T1D6F0F9A5C921BC3B19FC1B1860640A47EB50136B3B41985B7F3C921C4FB073B464681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 916d5c3b38253bae3a987084ab7f635c6aec858c6bd01a468636caaefd69c265
MD5 368394c84602eff70ad61c141901b774
SHA1 9e5e64ff4cf7dc25d5a5d61e965eebc257e33c86
SHA512 ac58fef4901db7b35b3d63ebf07a096a827fcea2f66316e150d78ef306b2d4719b596e10bfc0fb1f30770b712144daa2add0911814bdbc9db449fc6b7ea70cfc
TLSH
T1CB81523B43B21782FF93D8B305D09A58F5F584E181875E2A84426E36981AFD8E5D389F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bd1c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bd1c.TMP
Size 3KB
SHA256 61768f5e38da21bbbf97582959b9133377069034c03e3ef24663b6e6c5e17626
MD5 b1929310b73ff240bc639f9dc0bc4964
SHA1 5c747b0af5959fd9b9ba927e729ba44594ed884f
SHA512 7a67468498a84f9daa95cd0009af082b953f09b78ebef8095f7c489723c6a382daf36855ac45cad6d92061b7ecd77e3b61df8a865d506f6ba47d87b8575f8f74
TLSH
T196615F7B43B21BD0F712DCB345D1A499BAF484E101875A19C9927E3A4846F8CA8D389F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ff9fd67c3be5978544b0fecad41aa3918741ccc454e3e33400dc9d0049e7d021
MD5 7e3711c38df3f4673c479c1b193f0d41
SHA1 0ffdf23f5b0640b34a7073595ed6a6fa2f929afb
SHA512 64a6a0866dc6fabf96de225a08ef8e0f5d42ca1cca964e43bdf1aa20b1a365a96ce4e42dd7bb55e2f8d11ce21290f320fe36a2803f83a6139d494a67856e7676
SSDEEP 96:D1SOWeQKFEesD7aVcaij6rzBhIy890pFyTMryEnxDGwBD:D1RWeQZesD7aVcaij6r1hI590psTMrX7
TLSH
T158C1AEF3D3E89A2EDD1392F0AA146E2BCE5C0914431C38BA89D4AE0B57E1473E141A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 12c83b28f046e4a3cd94a94dcc446b69e942f62a99004faa8cb2cbd117b025ba
MD5 c20acff211e148ab36417593db021c78
SHA1 c7504510892ab0f3ac64ac934b0f1b0177356189
SHA512 6f27c5483075c7211b450eba417eef507c5ed9c42f8fc573c7a78b63f963899062ac0cc7227f9d00f450acf4fd9c481f51f7a02dd363899798fca6f9606ec1e5
SSDEEP 192:sxRuRCyMqZjK1Ml8wbQ/fKsyLNRZyKzoD8pAwz/g6+WNCyR/YcCyCxsGQhGXIgj7:sxRublQ/fKsyLN/y2H/5R/WyCsGQ4j7
TLSH
T16072E71569249D3BCDCBD219FA95BF93D7FD1163A1905E44AAFC9A0C00E6BEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2fa8651317c2c44447906c5c6d2bbd5b3b5df71b6f5a2d77d552686c97efa2d7
MD5 00fb2914a5747ed9b76cc74839ffb088
SHA1 bcf749205834883431f423cec517deece61fe351
SHA512 d104d6918f0eb04093c632da0d9cb685f1e22fe3f25b4d86e47090c74c4d4cee35fb091a9fcffcc49becb3d78ad4486015f4c5b5bebf96d3d2ba5df04148544c
SSDEEP 192:sxRuRCyMqZjK1Ml8UQqbQ/fKsyFNRZyKzoD8pAwz/g6+WNCyR/YcCyLxsGQhGXIr:sxRubqcQ/fKsyFN/y2H/5R/Wy9sGQ4e7
TLSH
T15872E71569245D7BCCDBD219FA95BF93D3F91173A1905E44AAFC9A0C00E6BEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a4d4b6d728dfc7c536d3d6bcb19fad00638687f76418bbc84d9bf210e4905258
MD5 6f39294cf14ca60e275cfa7cc5358dd1
SHA1 20656405029fa7fa9cb6192130afd97c5fbdfec0
SHA512 c22d3054358983bd8c5a7a39c9e261ba1ef2eb198577010a99472ce441058e643759d9b93918b82c166c1c587eb5437c044cca436c27dbfc7511dad19230e500
SSDEEP 768:Ob4YATWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBbDwzroT4z:Ob4YATWg1NfwBu1jasHwAUz
TLSH
T142C2EB2B244CCB7E4F844A9DAC29AED76DD801CB9B984D5447EB890C03C67FB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d97abd9ac9c8bb1b54f8fb8f5536015cf785ec03c785bb2e49468b02539eb2d2
MD5 d3798ece76ce72db974124095c5b5882
SHA1 81f0538f8e95066fb5e6ad2d43c1291bbfc240a2
SHA512 b9e5d80fd573b1d23a01ab0e4b84ce26ec407a25754615591424e04ef511bb3e41081d40d19200581b8f8b34dd08d46fba03cdbe0734349125b9d153e16e3a56
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9EwtWSI+uxKbOq80B4jQozKONrU3:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRU
TLSH
T142B25151713F4280387EB50C9178986FC6C2B4637519E52F7B6802A65F6BE039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 fefdf5479d5005f9889a9b57644fb5897e2e4b411c0c55f7b71360868aa4bb94
MD5 149933595695691a1f4b737afbfb75dd
SHA1 cc052be991ed168c981bc11a9bb1d4c942e61b44
SHA512 4fc6f3240f75b03294c4f3a1bc8e23b7fa3becaa2118a4db4f1e2e1e6d3dd6c828834dd04ec6396d8f6176f4d4a2bced9ecf8792ab8bfe4205ecfa85fb9c7083
SSDEEP 384:nziFiZcI28NLG8TUNTUlIR9PvuTV7ZEqfbYGO5GMeCZrp3yGBeRs9JKgqijUrvwi:eFQ2QGwgjuBcGO5deCxpyGTjKgqmUrD
TLSH
T1D6D26C32D864DEB7EDEA8FC9A6097647DEE08153C5989AD8E6DC6D0C00DB5DD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7303c6077c57ff97c5bed90bbac0e95019f11f9ffbeeaac725224e5f93c091a3
MD5 558059c0fea18bb3c1f91cf5467a116e
SHA1 1dec543b7a2158a1126367fcbd120d9c00efd957
SHA512 03d1bd54a33d641ac2c8fc691dae4c66ebe51922f2d410a81ab84b202528a602bd74f3848f6a9db44690f689337eafbdb12b51306ad1679848e1fb38a8e78e42
SSDEEP 384:nliFiZcI28NLG8TUNTUlIRNGPvuTV7ZEqfbYGO5GMeCZrp3yGBeRs9JKgqijUrvD:sFQ2QGwguuBcGO5deCxpyGTjKgqmUrD
TLSH
T1ACD26C32D864DEB7ECEA8FC9A60A7647DEE08153C5989AD8E6DC5D0C009B5DD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 647d972e740615e8941c5c4d9d326e683e345901565208aad96c4a047cb9574e
MD5 d9a583919020874e2dac59d3a35c4abb
SHA1 463b9e68c5273633188ad465945928bc8b0251b8
SHA512 db616d136e01bd365b598a8560ce79e87ce3611244c1b9c76be16eb8d4a45c9fb9ea311a3be6e90b70dd42f2c15a90def5f8bf30f0d2a3bb02c0a0abd2ef61b2
SSDEEP 384:nkiF1tNn/s3n9Sn8NgN8TUNTUlIRiPvuTuFREqfbYGO5GMeIL7OObjI9G6w7cd83:/F1j+9SXNwgUucUGO5deW729MH
TLSH
T184C25B36E855CEB7EDE64FD9B74A7A1AEEE05263849859C8EAC85E0C00C71ED0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 25d7c13fb61b23d85ec072159905d9f252b7e5fd30dda22b9b4fdce95753a69a
MD5 fcf8682a127828b58bbabc12a5fb705f
SHA1 c158f10274d57b45a2414ad93bafee017cbe64ba
SHA512 3d1b8d63124db485c6fc90cbae51d7a9b8981dc169c48b1bc2e5d5f25b3c1846fa5ee1a22b95d7fca2a2779c7ee29bad61ad7f0fe39fdebde6908ee19d9573b9
SSDEEP 384:nciFiZcIS8NLG8TUNTUlIR9PvuTVHZEqfbYGO5GMeCZrBTyGBeRs9JKgqijUrvwi:HFQSQGwgjuJcGO5deCxlyGTjKgqmUrD
TLSH
T1C4F2B3F198D39A77E8AE4B87673D6D069AFCC153B5889994B7C81D0CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 4a47850ab7fc1555558a639e1429d8bfb6b51c50f8b8e7651de0230b1ac768e2
MD5 9797cbab525211aca2bee018e1ac5e38
SHA1 e2544375da9d53d423be25a4e5b82f74db1a00bf
SHA512 0121f1203c57642eea989d68850622276b1115d8a11c5533b45807d9933174893fc2cc4f47f4934f4eda55a4f81becc8306f05c1447bc606a5565fed9cda14d8
SSDEEP 384:nliF1tNn/s3n9SI8NLG8TUNTUlIRNGPvuTm7ZEqfbYGO5GMeCZrp3yGk8LEEIzR4:sF1j+9RQGwguuqcGO5deCxpyG9
TLSH
T160B23B32E865DEB7ACEA4FD9B70A7647DEE0526385C899D4E6C92D4C00CB1DD030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download