719fffd9ab8829c73a78ed50047bb85980904ca69de9a0bf1f84d9cd566b6e0e

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sys_buddy-2.3.0/design/project/Sys-Buddy Dashboard.dc.html
Size 62KB
Sample260804-wvcf2abm81
SHA256 719fffd9ab8829c73a78ed50047bb85980904ca69de9a0bf1f84d9cd566b6e0e
MD5 b75328c0ac00c5f3fa7886d23dd200b5
SHA1 5b911f0f2e83a41b3e225ff66e84cdc2bc6e9bd5
SHA512 9cdfa6253ff9d6eff657c336bae26af1137dfabf4b3a6b83fc1569dd62614d6203bec892c408de896196467cd0b452351ce33a9f6bb5c2424d1b03ad37f0074c
SSDEEP 768:MMFr2zRfV/20zItn6c6qjsK0skqxFdEnW7fwATSzZHBLcUzr8wdvvHk5MMIrVagX:MayVs56q3dG/BLcHwdvvHkLNkN4acM
TLSH
T1D453F720E1B2843C6873E157BB09574E3A54E64FC64925C8FB9D21309FCB9B699336EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1896	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303408712769428"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{59DC6EE9-799C-4AF5-A197-0F4BEBEDAE90}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe
6052	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 6052 wrote to memory of 2624	6052	msedge.exe	89
PID 6052 wrote to memory of 5088	6052	msedge.exe	91
PID 6052 wrote to memory of 1896	6052	msedge.exe	92
PID 6052 wrote to memory of 5088	6052	msedge.exe	91
PID 6052 wrote to memory of 5088	6052	msedge.exe	91
PID 6052 wrote to memory of 1052	6052	msedge.exe	93
PID 6052 wrote to memory of 1052	6052	msedge.exe	93
PID 6052 wrote to memory of 3008	6052	msedge.exe	94
PID 6052 wrote to memory of 3008	6052	msedge.exe	94
PID 6052 wrote to memory of 3008	6052	msedge.exe	94
PID 6052 wrote to memory of 5192	6052	msedge.exe	95
PID 6052 wrote to memory of 5192	6052	msedge.exe	95
PID 6052 wrote to memory of 5192	6052	msedge.exe	95
PID 6052 wrote to memory of 2800	6052	msedge.exe	96
PID 6052 wrote to memory of 5328	6052	msedge.exe	97
PID 6052 wrote to memory of 2800	6052	msedge.exe	96
PID 6052 wrote to memory of 2800	6052	msedge.exe	96
PID 6052 wrote to memory of 5328	6052	msedge.exe	97
PID 6052 wrote to memory of 5328	6052	msedge.exe	97
PID 6052 wrote to memory of 1380	6052	msedge.exe	99
PID 6052 wrote to memory of 1380	6052	msedge.exe	99
PID 6052 wrote to memory of 2520	6052	msedge.exe	100
PID 6052 wrote to memory of 2520	6052	msedge.exe	100
PID 6052 wrote to memory of 1872	6052	msedge.exe	102
PID 6052 wrote to memory of 1496	6052	msedge.exe	106
PID 6052 wrote to memory of 3008	6052	msedge.exe	107
PID 6052 wrote to memory of 3964	6052	msedge.exe	108
PID 6052 wrote to memory of 4576	6052	msedge.exe	109
PID 6052 wrote to memory of 4576	6052	msedge.exe	109
PID 6052 wrote to memory of 4916	6052	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sys_buddy-2.3.0\design\project\Sys-Buddy Dashboard.dc.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fffff2dc188,0x7fffff2dc194,0x7fffff2dc1a0
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,12648761280711532904,4491739888565849843,262144 --field-trial-handle=2692,i,15825164749984278871,6564454839673850865,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:2
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2096,i,3346935204563764916,16254431303241153513,524288 --field-trial-handle=2692,i,15825164749984278871,6564454839673850865,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,4666513813600058790,13404029051577880365,524288 --field-trial-handle=2692,i,15825164749984278871,6564454839673850865,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:13
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,14506086460342516040,8550397079603504456,2097152 --field-trial-handle=2692,i,15825164749984278871,6564454839673850865,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3068,i,6530048446370036421,677461014162445325,2097152 --field-trial-handle=2692,i,15825164749984278871,6564454839673850865,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4368,i,3927932643824156348,7246527444689814154,2097152 --field-trial-handle=2692,i,15825164749984278871,6564454839673850865,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,13909973503211046855,3542202745570738885,2097152 --field-trial-handle=2692,i,15825164749984278871,6564454839673850865,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:9
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,10005541206568863784,15383727553666729011,524288 --field-trial-handle=2692,i,15825164749984278871,6564454839673850865,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,10493718104313124526,7914462120266344113,524288 --field-trial-handle=2692,i,15825164749984278871,6564454839673850865,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,2995843642307886129,1814722165573348570,524288 --field-trial-handle=2692,i,15825164749984278871,6564454839673850865,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,2995843642307886129,1814722165573348570,524288 --field-trial-handle=2692,i,15825164749984278871,6564454839673850865,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,7459460048150921406,13392541815797209914,524288 --field-trial-handle=2692,i,15825164749984278871,6564454839673850865,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1360,i,3348542708054463765,16515010638871315720,524288 --field-trial-handle=2692,i,15825164749984278871,6564454839673850865,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1368,i,7967374896850997899,16146322566081131609,524288 --field-trial-handle=2692,i,15825164749984278871,6564454839673850865,262144 --variations-seed-version --mojo-platform-channel-handle=1364 /prefetch:14
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,2868451451927166425,3239256455460343948,524288 --field-trial-handle=2692,i,15825164749984278871,6564454839673850865,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5424,i,7827156825206520938,13293091475917702336,262144 --field-trial-handle=2692,i,15825164749984278871,6564454839673850865,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8ec36895d743d8e4469cc4f9fbf5cc2744d7a861e9b00c3cc5f4f838cadf1e58
MD5 224ef95b48e31f3ce2071ce3884b1727
SHA1 5c2f2f234d1245f707e38b5f8ec27ef3c2f1ae87
SHA512 78b3882d4aa7bdab3c0e1346f7d91e9a7edac4c0e2f447391fe1b02593e29f4f00c57203eab0a2a67e397accdee3ce445bd3d6acbf415badb0600f50a37abcc2
TLSH
T1B6D0A7747A9962A2D12C417941705A01653586A27ADB9247A451580D8970182A1DAEEB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 295e734108487c3a18e06c659b9888f652a871abe3385e2c00783cd7efce9ac4
MD5 6e9c1fcd79d8bd0fd294862e2427d78b
SHA1 40931369ce3e16650d4ea54d240d061ea5b539df
SHA512 df2cd4753ed66b0e9291c77207cd7afc60a015910bdcccfc2f05cdc34da3009ef8e2c3deb88d0846d51aaabec85744f2429456da4b4250ab94232de0b4d2c4b0
TLSH
T1D451DA13036945E3CBA249F3B7F1F54833F5989BD2CF9E10A442DE759A86F06A0C015B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b2db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b2db.TMP
Size 2KB
SHA256 822dc74f62ab50f404ee42e1a1810917bdd09e97e7b81297c1f1dc3d22d46ba0
MD5 39ae43f095b743143424c71b3c84fd75
SHA1 f6fc53d3ae53572d5824d605639e5ecbce5dd239
SHA512 45f4024cda8ce9ed2c29055b7b42926a1042ead41aa5639f749a17ccd0b38c3a184a1d4f2d308cd420e66af8688a5eaab1fde7344ca90195c763a176c60c020d
TLSH
T18F51DA13036945E3CBA249F3B7F5F58833F4A89BD2CF9E009442DE759A86F06A0C016B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

cbdb2351-4ebf-4dfa-839f-580d4a078329.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cbdb2351-4ebf-4dfa-839f-580d4a078329.tmp
Size 3KB
SHA256 ef76ae25c297e0718822b9add2fcc9c3691c3712b9ebb20a941ebc05b7f9a1f3
MD5 b82b85faadcf6f56a7d0fbb975d023a4
SHA1 e47aa00bcdea5f216375ee38fe30a81c7c53bfca
SHA512 587119dd2c44e05c7b23b46d722aab5a14d7d6be3392fed3b45b7a34b523350071deef38f996d37358bd3af1df20554c952113917ebd0cff4ec873cd21776696
TLSH
T1ED61AEF7C7E8867D890156F0AB187E2BCE1D0915422C3C5AC8E4AE5FA3F2471D14169F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e5de06eb2e53730fe4568b655a0bd69da63321e6f1ccce30e1cf383356ab8b60
MD5 7054c5ada3d1cd95a39de3e99a867966
SHA1 073312885c4ad0a7b9c568fef01b37953b34d62e
SHA512 317f60fee771669ad40f218e61afec7a2d1087c7996aa05381b65ecb3c7ea89eda8b375f95b6e69bc70921dec8af8f75591ba5ad9a02890d237b9e510060760a
SSDEEP 192:sxRkRqbh/f7sS85M3AtfzoA8p4D/g6+WNIYZFLKnGYIgDlJ:sxRk2h/f7sr5MZS/5ISCz
TLSH
T14032D7166A28A93B4CC7D21DBB55BF53D2FD6032A0D12E58B6FC961C14EB7CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 73e31c3050d4ef32f6a976f54fc46d15c4e690b1da35e36a255edef674d7a6fc
MD5 c326e78957befa0c817d2f3a28ebc7b0
SHA1 2c03cb01ef6830044ec170300d2ea85f2fb18ce0
SHA512 9f359b4bf86a6108b715a18abbeccf1487dd37f8b13c10a38559ed7a4b729016735152d22688367ceda0c7110ffd2752143a3ab5d608582aa0590fd2e4bdb8ff
SSDEEP 192:sxRHRqbh/f7sr85M3AtfzoA8p4D/g6+WNIYZFLKnGYIgIJ:sxRH2h/f7sQ5MZS/5ISCs
TLSH
T17632E8156A28A93B4CC7E20DBB55BF53D2FD6132A0D12E48BAFC961C14E77CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0c345dad9902ece629111eea137e37f87cc7603786184c7e80baba7d72b32462
MD5 4fbe4d64f49510b6291a914c6a36d29d
SHA1 1aa05a33cc257c3ba2093439b02c7d22a0cec908
SHA512 83aa23492f46b6817a1abd8c60e4fda955eb10fb40ae799dbe81e6d67b126da6691392316d3a63543c65280d2f56f15087060d0aaf1fc9dc1983e36826cdf78a
SSDEEP 192:sxRkRqbh/f7sS85M3AtfzoA8p4D/g6+WNIYZFLDnGYIgDrJ:sxRk2h/f7sr5MZS/5ISNx
TLSH
T1FA32D8167928A93B4CC7E24DBB55BF53D2F96032A0D12E58B6FC961C14E77CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 46a43fcb1e83581d3796f3cc97625410761af038dd4dd9d2bea5033deeb16588
MD5 332fd7a1656db80ccfa63de75956c5ca
SHA1 3c24ef4a1dae2104a0c1409221be3a33668a539e
SHA512 35e135db613089b6549b64d4ab6f90fa6ad4a574ef19922d2861db03c8fc96a6ca2765ddbf45b2b1d12f7796c402fcb901f5a352afa9fbdfa090576fb6683f89
SSDEEP 384:KAX0EdqfCtgNbFfVNKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVui9LZRGyrocmr:K80EdwWgNhfVN8F1+UoAYDCx9Tuqh0Vn
TLSH
T1E5B2C93B640DCB7E5F800AADAC196FD77D9802C7A6988D4047FE994C02C77EA911A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0f800bab96663706e81c8fc969ed0e7aecb63265d4674338e627f847ec564f44
MD5 f2d66a64a0089d594c2fbaafcd974fa5
SHA1 e263d1b7c09f182951fd41347a507c65fa09e918
SHA512 f3c623297543ed7db9977d63295a88e6f8a167dc1992ecaeb348fd7ea2a214b24712753a3c6f7c37fa2d660df24d1da892c84ec7ca10c9d9e0cb3e6a73072d0f
SSDEEP 768:8rv+4UNbdm3liQI+LeSFOU1qPX4fouOToPvB2thtA9VAg3/:8bsbk3lIsnnwthtty/
TLSH
T1EB03AE72B8A88923DEE5D294720B76437FF4411396C00BD49ADD6B9D068B6EE170FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7e9b60078309e69afd8f4e2b610b46bb13a4ab0ed6575458dd6e5a0ff416acbc
MD5 8bf8a9b51d5c6df3c25f0b5dce7970de
SHA1 12702ba45a0e956523dcbd7f4d17932cb1b0a6dd
SHA512 02155fcb1b6e41a9e2762fcdf0903ca312cf731215c59f99cf8329f51afecbe3a5de72382b4141c446610ebe213157b2d90fe8eae247c5a35adeb2094daa6114
SSDEEP 768:XJ3BiyI+LeSFOU1qPX4fouOToPvB2thtA9VAg3ojKgqmUFR:XJ3BisnnwthttyfgRUFR
TLSH
T16AF2BE71A8A88923DDE9E3D5720A76526FF08113D2D01FD46AEC6B4D0647A9E470FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3e454b46449bdc7e3a56d90ed1838980bdb59c252f4e4a1cd35812ed7b1192f8
MD5 2018beb54cef99c9efa249525e423c8e
SHA1 4938e4d7e71351f873e19a524029783785bd2c20
SHA512 74bb383a6916395e2809ef7e08fad06c742f19b13fcdc48bcaa784190e20c63a3adb452578b5ab67aa20f213c41bb090f2e18c0a259f62c8ce11bff463198101
SSDEEP 768:grv+4UNbdH3Fg+LeSFOU1rX4fouOToPvB2thtA9VAwGeVH1SlX:gbsbh3xsnnwthtt7EH1Y
TLSH
T13403BF32A8A88A33DDE6D398720B72532FF4512396900FD499DD1B4D069B9DE470BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3e594d7-72d4-440d-8d8b-a83d3d7dd705.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a3e594d7-72d4-440d-8d8b-a83d3d7dd705.tmp
Size 35KB
SHA256 d37102a97161dcbaf72a36aec9d63729d9ec0f1e6e851aec7ce9cdefc73e8087
MD5 06483ff9fbadf662458c82c796823620
SHA1 56f3ce7122a9b895008d7b8f9085d09f8331dae9
SHA512 2bbd754a17d8f87df9cadf352c1403f3384b1bf8b4396cff41784a7f38e606531f2672accc1083a2f2b570a4e359672d50e31fd467bb2bca431ef7a3156ae28c
SSDEEP 768:dM3BiyI+LeSFOU1qbX4fouOToPvB2thtA9VAg3ojKgqmUFR:dM3BgsnnwthttyfgRUFR
TLSH
T12AF2BFB1A8A88923DDE5E3D5730A76526FF08113D2C05FD45AEC6B4D0647A9E470FC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19cb30b8-83c2-43b3-a68e-2c6739de6777.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\19cb30b8-83c2-43b3-a68e-2c6739de6777.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download