hxxp://pakistanpressfoundation[.]org

Analysis

user interaction
yes
max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://pakistanpressfoundation.org
Sample260804-ptnpcaep8v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4416	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303206565964885"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{B584BD51-B93D-411B-82B8-DAA4CE26F5FD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3620	notepad.exe
3620	notepad.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 5108	1288	msedge.exe	89
PID 1288 wrote to memory of 1032	1288	msedge.exe	90
PID 1288 wrote to memory of 4416	1288	msedge.exe	91
PID 1288 wrote to memory of 1032	1288	msedge.exe	90
PID 1288 wrote to memory of 1032	1288	msedge.exe	90
PID 1288 wrote to memory of 1524	1288	msedge.exe	92
PID 1288 wrote to memory of 1524	1288	msedge.exe	92
PID 1288 wrote to memory of 5940	1288	msedge.exe	94
PID 1288 wrote to memory of 5940	1288	msedge.exe	94
PID 1288 wrote to memory of 5940	1288	msedge.exe	94
PID 1288 wrote to memory of 5816	1288	msedge.exe	95
PID 1288 wrote to memory of 5816	1288	msedge.exe	95
PID 1288 wrote to memory of 5816	1288	msedge.exe	95
PID 1288 wrote to memory of 52	1288	msedge.exe	96
PID 1288 wrote to memory of 412	1288	msedge.exe	97
PID 1288 wrote to memory of 52	1288	msedge.exe	96
PID 1288 wrote to memory of 52	1288	msedge.exe	96
PID 1288 wrote to memory of 412	1288	msedge.exe	97
PID 1288 wrote to memory of 412	1288	msedge.exe	97
PID 1288 wrote to memory of 1152	1288	msedge.exe	99
PID 1288 wrote to memory of 1152	1288	msedge.exe	99
PID 1288 wrote to memory of 1152	1288	msedge.exe	99
PID 1288 wrote to memory of 1404	1288	msedge.exe	100
PID 1288 wrote to memory of 2156	1288	msedge.exe	101
PID 1288 wrote to memory of 1404	1288	msedge.exe	100
PID 1288 wrote to memory of 2156	1288	msedge.exe	101
PID 1288 wrote to memory of 5436	1288	msedge.exe	103
PID 1288 wrote to memory of 4384	1288	msedge.exe	107
PID 1288 wrote to memory of 4308	1288	msedge.exe	108
PID 1288 wrote to memory of 1756	1288	msedge.exe	109
PID 1288 wrote to memory of 1004	1288	msedge.exe	111
PID 1288 wrote to memory of 1004	1288	msedge.exe	111
PID 1288 wrote to memory of 2580	1288	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://pakistanpressfoundation.org
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x290,0x7ffef9e1c188,0x7ffef9e1c194,0x7ffef9e1c1a0
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,9104166195667745232,5359531079519661920,262144 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:2
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,358921554102127986,9821389176726333741,524288 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,6427993096542077715,9050849532680834106,524288 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:13
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,9845381139487551538,14773544583507821343,2097152 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3656,i,17380869325012545056,5301753866708780542,2097152 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,4632796827314458674,10567392787895218897,2097152 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:52
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,9267693883497098742,17272044898713703896,2097152 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3792,i,10451905702632131015,6791628815737396857,2097152 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,11116927537397901775,3957277275439908995,524288 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,3514750633920475473,8364560308875370961,524288 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,7192229806654567300,4535203233527478228,524288 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,7192229806654567300,4535203233527478228,524288 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,3197947581001127328,4454241365180940853,524288 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,6802277308486437641,10302800756981845868,524288 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,10218175533888512864,12435236926132288048,524288 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,8427226658715430447,7749568365144021161,524288 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:14
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=820,i,7878555413139319298,7344806379942383380,262144 --field-trial-handle=2628,i,3593042070283018775,18085961333769227696,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2652

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 aa0d78ec9cd90e7c6714bdce5235de1fc6b7c3088a6cd8f6e6d2c1cebea7d661
MD5 63134f635628c0af90baed8399868c70
SHA1 0a02b0ee6e4253e3534f292530612cd9f5f16106
SHA512 3c98f5f62643131db7887f04a33b0ca1c1c00b00c63332d61c392e6bf04039e1f5ce53adff3458c5b96f00e8454a916a07ab2c53d268c7a0bedbef781bef81f0
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
TLSH
T123B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c5ea47e6e39e62dfa4e9aa055f7bc8813bad17ec624a43e126d269ccfcb3312b
MD5 ee723a694ca351fddb2ebc84dd6a9900
SHA1 5035c3e0e7160037a8e13d79e77869c87c6fa70c
SHA512 6342b4d64e97e1fc22608b70419f6a911ee5fa79a42722bb1314e0183b757f27158906be97585bc599e1fdc7b37c5c2b01b6b9ddc8749d74721dbf795e7082d5
TLSH
T13E51CB5B23A764C2CF691CB282D258493EB8A6A961A72F6F158028758A4F3D49334B30
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595327.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595327.TMP
Size 1KB
SHA256 b650b8b00a0e1fbb2cfa349f626ea3ed57120869895f0ae84105349881be8230
MD5 ea3e6406e493a3ba8b5f3b3148f7a2b4
SHA1 d691ab67f9e2680f374e2de2b0f81eb5d7a49f9a
SHA512 c08e798f201c7eea621a30e278cfaeacb33e599806ede995f25e5d5fadb331cf33a30d34706384d53020038866aa4fa372c81c59e483005e176a9cfdf9a05ed1
TLSH
T14941A96F036B59C7CB795CB180D294897F3CC4A941CB6E2E464021B98F8B3D89234B30
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ee2b9cad47cf62656b4a5bf764d4bf7195726c85936ae31c92faac8d81e1efbb
MD5 1482a48bc938f2af6613d19125798dac
SHA1 e32a5ac1aad0c688ad2de6c3233f25cbbecfb7d7
SHA512 03238c8e26eca13cf4494eb4245041d177c85af22b9742ee7ede64e9c1ec81ffacb5e6bbefdd104274a94d2c0dc011423906cb40a0d28cb947a6d6186397c427
SSDEEP 96:DQOZPZ3Zs+ZfZYa91WiNjhmzHZmzZehZCZEZMZimZ11ZiGwQ:Dr1l/VGa91WiNjhmTwzYEiOjdkGT
TLSH
T1DEB1EFB7C2E9892EC91225F0EB143D2BCE1D0A1583783E598CE5AF4BA3D2471A34494F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1d944ec093917246cd4800b85c505df6fc90fdaae61bf907c56893af57743878
MD5 659b93391f50f2682aa68fb1454410e9
SHA1 237df57aef2b0f293d302d7f00970b356a3debb7
SHA512 24e5cccf1363b3ef21efea1612973cfff37f8951cc7e1a4c38247826c365a0c58ee0c6be4c2e407d46f27c68e9e0f402e5a3d58eef740e75b4ccdab8370d0e23
SSDEEP 192:sxRNRbyM/jK1Ml8wbK/fssqShDde5lSvzoD8plh/g6+WNlCw/YCQhO/GsIgDtJ:sxRNVlK/fssqShc5lgL/5f/JN7
TLSH
T1B362E805AA285D7BCCDBD209FA417F93D6F91573A2905E04AAFC9A1C00E6BDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8ef0ecf0929106b5381e80ceab83a6c9875b88498b997ce85e4693c1fbcdd9b8
MD5 acb5d66c39b5fd43c816cdf92a95cdeb
SHA1 c09f5cac751de994d275d3605e1f74142922d8f3
SHA512 62228304b6ef0ca065bab524e569583782037e0b8d6b00e9137f374b09ce7e88706f005dde31f8191a588268468699abde429184580a21e6c68c25b5bc24657c
SSDEEP 192:sxRNRbyM/jK1Ml8UQhbK/fssqSBDde5lSvzoD8pzh/g6+WNl6JXYC6PhO/GsIgD1:sxRNVqJK/fssqSBc5lgl/5yXQANp
TLSH
T18762E815AA285D7BCCDBD20DF9517F93D6F91533A2901E04AAFC9A1C01E6BDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2a6db2e30ab05775732b976d5817af3b1fee81d63bc162f00855bed777ad846d
MD5 f3b666788c316792487a64c4971ad3bd
SHA1 3700946ef883f9a84095b4113a2f2a5b9ca85a84
SHA512 88ce3a48ce1505a4f68f617b0f84a003f1e23cc2e7fafb139eea5217fea553e9bb9fd3106f86933db8fa5603bee9d7436796dae72701c50e78050d3bd489046f
SSDEEP 192:sxR2RbyM/jK1Ml8wbK/fssJShDde5lSvzoD8plh/g6+WNlCw/YCQhO/GsIgIJ:sxR2VlK/fssJShc5lgL/5f/JNs
TLSH
T13662E905AA285D7BCCDBD20DFA517F93D6F91573A2905E04AAFC9A1C00E6BDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6e7a880367af856d77d953fb703caa768256bb2178aad74b05410587bde0844f
MD5 0d3cc49c46a376b09c24d3f84799e764
SHA1 5374af4efc842eca5ad79b03b7e9b960f9ff5173
SHA512 1879c82ffb9e92c335e8c526b33397c743ec60187b916bfb0c272298d08ea7769ea8fed9beb44c560888ff852843303b031c3954317a2272976614fbdd617dc4
SSDEEP 768:j/8vrQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCQqqtrovn:j/8vrQWgQ+fB+u1ja3VqGv
TLSH
T183C2EC2B640CC77E4F844EADEC29BED66DD801CF9B588D5447EA890C03C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 25b2fb6d8e1f5fc2a2f6f6f02ec62449f33b2109537533117a122d91c66f7a1d
MD5 bd801a8ae2ad47f6b77d2fda6819ba2d
SHA1 f9b123e1bc8393ca6f3f70b192442d0bf7217dbf
SHA512 9313cc0ab0ab4c5a7cac91b3bab16da1f97894e5db661b494a5f3ebf20da3d27df1ed017126c8614bb0bf308422a7f4343e47d2b16a9eaa5bbbd880855aeead9
TLSH
T1FCA0025066721651D188C2F0324211483A60CF76857116E594A0017EC8601447347054
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0ec1df806e0156a49753f6ac353d7679fca9a194c1431d490f38bfae9f05fa06
MD5 6402f072ceaa14061ccc03b706560e9f
SHA1 d6cf696679d0835cce25c0b145cd009ab2d3ba91
SHA512 9b27ae5802a9da0ed784d99f3f531438353a458d36e5266930d43f221789526f1a21a6b588964d753b2ade6ab1ab54c919771baca9588917072ac0075d93750d
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOH0VAE+imkWivPgMkK4BgGkckEP+k5HxOfn:CbEBVj5JAdSp9/EgTK7j6dJOH0VAE+it
TLSH
T1CD910101323F02C5793EA54C8078896FCAC2B1673415E52B7BA846665F67E439DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 82e3d453d3a6cdd0f1ae8a07be6a0147a2b63d91d515b4234e38e6889a40a55e
MD5 9db767f1cd670394e5465ad92dbff5f0
SHA1 be1d2d70e2afe0b775990dad8048745131af6d3e
SHA512 43b9b1f53d8371515032ce9bb34aad91382130f647f6a2d05ed8b871a470d617c9cd68021f19392f2effd0b1f5a0db0af6b8ff4ed1b97d5abc27fa30a3380ec5
SSDEEP 768:vrv+4UNbd83UMmUL8NLgp8+p3bd66j+4BRv86aLIWTR:vbsbq3UdzL+8+p3Z6n4ypR
TLSH
T13A03AE72E868D933CCF2C684B2863A437FF8515396C01EE4D9D97B4D459B1AE230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 dc1183de55b1bf9493665e3e1d0b3e0ba95f235dae07741ff76d4bd8097c9003
MD5 4060cc2af1f3ef6aff31f84b69dfd73d
SHA1 ccfd5825460c13e3ed229fe2a592085ab77ed7db
SHA512 25a477aa942f67fdf684bfa144ed6c8c08ee7bb75b2576e575d8f1d370eeb7987d463718c7288c28f7ec354f9829c04ce0dd8ef45f2bf31ca88e944d49ab3926
SSDEEP 768:3c3pMUUL8NLgp8+p3bd66j+4BRv86aLIWTa:3c3ptzL+8+p3Z6n4ypa
TLSH
T165E29E72ECA49D37DCF5C684B28637436FF8916392C41EA494DD7B0D05972AE170B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 96d4e206ac75ac4dacc49e55ad7ef0d9858b75d70f0ee52223dae5821da503ee
MD5 1f13ac9eddcaaae0b3af4bcd7fe96f85
SHA1 1e318013b1cb9efab4506f244ba7253a3e5a8848
SHA512 c03fa60fdb74a24aba18cf334c16b61aefa58045312b7848974ed19ce696c8ad8ffb647a177d6f7d41731b0fa0b4e8c652f7bce7adc136e07587c6db9ca16c32
SSDEEP 768:0FdW3wwgIMTUL8Nyp8+p3bd66j+4BRv86aLIWTa:4W3bSzM8+p3Z6n4ypa
TLSH
T13B035BF298D78536DCAD8B47A37D2E025EFDC163B5805990B7C86A0DCC5617FD30A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5756fcd3468b97f718b2605aa545171cf31d81fdc1087cccd865e198087e7080
MD5 476bf12970886cec9fb5fe254e313847
SHA1 e30d99e8ff2f3a1d53e9d58aae157bb6b5c16a91
SHA512 325d513e1cb577ce0f9dea8198dcaa6347eba512534d1c5918e9f6f48ac036e0769b40ceb90a3a4b8ac20e37c08bdf2a08b41b0c5e94e2bf7f6aa92ac0563e21
SSDEEP 768:Irv+4UNbdD3lc8LNp8+p3bd66j+4BRv86aLIiR2bwCl1:Ibsbp3PL8+p3Z6n4y70ww
TLSH
T1F703BE72E9A899339CF6C648B2467B437FF851A396C10AD0D4DD3B4E419A19E230BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 21604c714a41c77a95093acfc49d34a1f260a8aad5142d5abd83579abae4e2ad
MD5 c2b8a37569b9c2db7b527083173685a4
SHA1 d393c4af6335fc4acbd531b3557526ab0ce95296
SHA512 a4fa10b194fa3ec9c3a225a7953c623450372a35de5acdfeeda97b23c1dbe2bd9206020ca4bbe5182712aa5ec176ce409d75a2b73bfa490d35fb4c41c1f4f64c
SSDEEP 768:7rv+4UNbd83UMUUL8NLgp8+p3bd66j+4BRv86aLIWTR:7bsbq3UtzL+8+p3Z6n4ypR
TLSH
T1F003AE72E8689933CCF2C684B2863A437FF8515396C01EE4D9DD7B5D459B1AE230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download