d906cea49e188e0edf0b7b716ddf488d0747e1e20858dc9b222018ecb004dcd7

Analysis

max time kernel
148s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Upload Patcher - Kay x Kaz (Cracked By Xyzwon)/Index.html
Size 55KB
Sample260816-m4h6hawdng
SHA256 d906cea49e188e0edf0b7b716ddf488d0747e1e20858dc9b222018ecb004dcd7
MD5 aec49c332d42d0b2a7dec3ec739d6e80
SHA1 2d9791335156e135bdc9474fa9503771d7c4d2db
SHA512 1edb3338e0186b3d4ca278f78d197f5ee4d2b10c70de20e49fd79d5b7318056db37f1fb1226b802684c13f3dfc5fa326029fd720a97e8d392b40ab1b2ab60ce5
SSDEEP 1536:xsytqE8iFO4UzzfgJgdgv5IwWSyP7Rx3e8wIOabHNzAf5tmmtIWR2Do1bequJHOQ:Q/TRPwIrbHKf/mmtIW2Do1beqkO5Wiwr
TLSH
T17543FAB321120835C9B76765B652C38CBB78C0039E07431879ED9966CBB9E42D57EFD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
940	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313517850692809"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{911CB2AF-F850-46ED-A46C-6A451752F718}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 3276	4912	msedge.exe	89
PID 4912 wrote to memory of 940	4912	msedge.exe	92
PID 4912 wrote to memory of 5996	4912	msedge.exe	93
PID 4912 wrote to memory of 5996	4912	msedge.exe	93
PID 4912 wrote to memory of 5068	4912	msedge.exe	91
PID 4912 wrote to memory of 5068	4912	msedge.exe	91
PID 4912 wrote to memory of 5068	4912	msedge.exe	91
PID 4912 wrote to memory of 4668	4912	msedge.exe	94
PID 4912 wrote to memory of 4668	4912	msedge.exe	94
PID 4912 wrote to memory of 5848	4912	msedge.exe	95
PID 4912 wrote to memory of 4668	4912	msedge.exe	94
PID 4912 wrote to memory of 5848	4912	msedge.exe	95
PID 4912 wrote to memory of 5848	4912	msedge.exe	95
PID 4912 wrote to memory of 3528	4912	msedge.exe	96
PID 4912 wrote to memory of 3528	4912	msedge.exe	96
PID 4912 wrote to memory of 3528	4912	msedge.exe	96
PID 4912 wrote to memory of 2368	4912	msedge.exe	97
PID 4912 wrote to memory of 2368	4912	msedge.exe	97
PID 4912 wrote to memory of 2368	4912	msedge.exe	97
PID 4912 wrote to memory of 3840	4912	msedge.exe	99
PID 4912 wrote to memory of 3036	4912	msedge.exe	100
PID 4912 wrote to memory of 3840	4912	msedge.exe	99
PID 4912 wrote to memory of 3036	4912	msedge.exe	100
PID 4912 wrote to memory of 5716	4912	msedge.exe	102
PID 4912 wrote to memory of 1140	4912	msedge.exe	107
PID 4912 wrote to memory of 2456	4912	msedge.exe	108
PID 4912 wrote to memory of 1080	4912	msedge.exe	109
PID 4912 wrote to memory of 5656	4912	msedge.exe	110
PID 4912 wrote to memory of 5656	4912	msedge.exe	110
PID 4912 wrote to memory of 3140	4912	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Upload Patcher - Kay x Kaz (Cracked By Xyzwon)\Index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x168,0x7ffea611c188,0x7ffea611c194,0x7ffea611c1a0
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,6788801915744652080,637726133971277563,262144 --field-trial-handle=2796,i,7465119185702637638,167209164182915373,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,5841827961387908307,623039996074247284,524288 --field-trial-handle=2796,i,7465119185702637638,167209164182915373,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:11
  2⤵
  - System Time Discovery
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,10527398795066308835,6333595350933337897,524288 --field-trial-handle=2796,i,7465119185702637638,167209164182915373,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:13
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,15868219764852962769,3464380759732015213,2097152 --field-trial-handle=2796,i,7465119185702637638,167209164182915373,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,14595168477499598614,3064727068792597915,2097152 --field-trial-handle=2796,i,7465119185702637638,167209164182915373,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,8432217152991364503,15117171308542745455,2097152 --field-trial-handle=2796,i,7465119185702637638,167209164182915373,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,13487048354405157642,15569320979021856426,2097152 --field-trial-handle=2796,i,7465119185702637638,167209164182915373,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:9
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,1853273179901936572,9690077882177180678,524288 --field-trial-handle=2796,i,7465119185702637638,167209164182915373,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,8331365989342059759,16556925503512815422,524288 --field-trial-handle=2796,i,7465119185702637638,167209164182915373,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,8416156698211977700,6795095311014886681,524288 --field-trial-handle=2796,i,7465119185702637638,167209164182915373,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,8416156698211977700,6795095311014886681,524288 --field-trial-handle=2796,i,7465119185702637638,167209164182915373,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,6994683031774777869,4568290386849330906,524288 --field-trial-handle=2796,i,7465119185702637638,167209164182915373,262144 --variations-seed-version --mojo-platform-channel-handle=1256 /prefetch:14
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,17396001472906597980,6467662431071324245,524288 --field-trial-handle=2796,i,7465119185702637638,167209164182915373,262144 --variations-seed-version --mojo-platform-channel-handle=1264 /prefetch:14
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,13560135528104040832,7775571197151994921,524288 --field-trial-handle=2796,i,7465119185702637638,167209164182915373,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,3351604771296481160,11112394017769902015,524288 --field-trial-handle=2796,i,7465119185702637638,167209164182915373,262144 --variations-seed-version --mojo-platform-channel-handle=1260 /prefetch:14
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6356,i,2240844392706638908,10668099968670819303,262144 --field-trial-handle=2796,i,7465119185702637638,167209164182915373,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c36444a90e694c345f077520bf9284777bfa7a3ce8c6a8e5f08faf754e95a263
MD5 839fbdfb4fec02b238b67b6c54fafac5
SHA1 58e04af5cd3736d95bb22cfc1b23858e53249a10
SHA512 fbb113e2e6eae271f10e49bcfa66b48efe742b5ec47c84d34e01332111914045555731587ac090a9c2bfdf0906acca920b05e103a5073056abd6b353e0dc129c
TLSH
T1365152A8CB2F0ED2D370D2B15CED45EDB27E4896C6076B1593F122B49B1230F2391861
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b26e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b26e.TMP
Size 2KB
SHA256 0b570cab45fc626640fb1d0111f790dfa40b8f6952f9de4f319b0879451fb20f
MD5 c39a33c7d7fdc7168240b0d8f46ca13a
SHA1 e0647db7458037bd91a549940103f3c40169687d
SHA512 d1eff1071dccae0b9c58c20fd599f3be5d64a2c20e0e345106e0fca2986e7cd7f8ccc5ab21e75b26fd9853ffe634de0d93b6acb681a6cd3d474a0fe99a67d8cb
TLSH
T1E75152A8CB2F0ED2D374D2B15CED46EDB67E88D6C6076B1593F122B49B1230F2391461
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 68e2dc17f2ba2572a437564ec0bddf342a555b000e60c951d01047079a7ecfb3
MD5 479c66cfb6b68ec3abd94be06b8fc3e9
SHA1 88a30c84984bc79bad255fce7e0eaf59679a4528
SHA512 41b7c8af758919957a3320af4ef5e34f4788f77c92d860f133eadf5f51fe9525c74d8c1149bf720ffef0052acf264efb3db385e45b4538954b000396e50332e4
TLSH
T10731A0F783B4957E8A1196F0AA14AE1FCF2C0511435C7C6AC9E4AE2793F3472E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 90cce89f9fa1aca222452fc234e6492314b4d4ef4109ebc236507d4095ffeb92
MD5 cb678e92553dd143769b3ea08530ac4a
SHA1 e4effa68eab23c6221476fcdb12944f21634e521
SHA512 ae64c4085fbfbdc9d61ebb58759778cce0f78f4859d37611c02d4317ea7693b226c14cc0496bb3726e96c729e00a8f7b163ce145e7084cb6851929f725ab50e8
SSDEEP 192:sxRLRXbY/fxsqn9X/09zoA8p4r/g6+WNIYZ7Pqzs6GZLIgDYJ:sxRLlY/fxsqn9XswO/5IQbg
TLSH
T12732CA166968A93B9CC7E21DFB55BF53E3F96032A1D01E48BAFC961C04E76CD120790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4e971103802779d5c3680776b2c51c52fe84194bb6380404cda713d6cb17744a
MD5 f70ce31516132b0e9401d903402a328d
SHA1 74567bd75474fb5087b318da9454db158010117b
SHA512 90811800c235873b4aadce99e52a6002fffc9e6542316b04a766ab6c4ac46653e1e72925ff84574512f1c2a9582be9731ad42b2c2329ce51c26ec49d27c6aa58
SSDEEP 192:sxRQRXbY/fxsan9X/09zoA8p4r/g6+WNIYZ7Pqzs6GZLIgIJ:sxRQlY/fxsan9XswO/5IQbs
TLSH
T17032DB166D28993B9CC7E21DFB55BF53E2F92032A1D01E48BAFC961C04E7ACD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 eef922ca6cb46639b8a08f7b2806dd58a7839478c0524cf7bd3f03031fe84d30
MD5 eb0c87936d771c7d18ebbfd5c169969c
SHA1 50b38b8365a31cbed5e674d06612ef199103fe72
SHA512 764c14bfe0bfe5d7c03b8ef5921114340ce12cee4c1f5da613b83faceaaa9cf6f32297c7a76e2da0722a2184d48924cfd4a7845e3a578144c3af214d00d1036d
SSDEEP 192:sxRLRXbY/fxsqn9y/09zoA8p4r/g6+WNIYZ7Pp1s6GZLIgDqJ:sxRLlY/fxsqn9yswO/5IPbq
TLSH
T1B142C9166928993B9CC7E21DFB55BF53E2F96032A1D01E48BBFC961C04E7ACD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 7ceff8a27e57c64d8a0acff5a3225170634220f87fa56b3f1fd09a5d279840c9
MD5 8dfbad849072d2bf3741fbb7588eb53e
SHA1 11737ee6fd2c66ba92811f48bcdc2a525eb76a02
SHA512 6ed2dea0f836be44277c8c85dd81bc23bcf044838a389837087cd9fba38a85cc62c5f991be707a6938e83aaa922fa6baab68561845d8c9e3178e6067c4a82d4f
SSDEEP 384:kyr2SGXfCtgdDFf/bKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA89VXR6RroOp9:ky2SGvWgd5f/b8F1+UoAYDCx9Tuqh0Vj
TLSH
T17AB2DA2B604DCB7F9F801A9DAC196FD67D9802C797988D4047FE990C03C77EE912A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 abb3716d073251661fe51577f997bede3fbeb3d39608c401662871f97eb0aa32
MD5 d6efdc030cc93f5d82a230d0dd9f25ee
SHA1 8d3534e583c7c2db269566ac444e0d9ef99e51f7
SHA512 07f2e958cf19c2179d0e846879ef0037c5ac1d0da527115ca1a06faf27cb21d52218a8df71f84f7dfcdfff56e19a432bce9739b86ac616171d552e70527cd0fe
SSDEEP 96:Knob8YmCO8myBn0w8K8p0u8YIYh2IhhsfocSmCAmeVT0UAK8V0aAYEUl6f3mKAQM:6ob8YmCOVyB0wUp0uVIYh2IhhsfocSmc
TLSH
T178911C55757A52422CBE295CA1A9CA27968270737018A43F3BEC08B15FABF010DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

edf2a793-3bbe-4bbc-9955-0d9c7051d527.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\edf2a793-3bbe-4bbc-9955-0d9c7051d527.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 4900e7639dea9c7e692bc47a79761d149b51b938d3627bfcab09ad347c840fb0
MD5 cffacfac5cebea47f2349117a3290a2b
SHA1 ae0efab913630f2a012dcaae6649d5cbac4bc9fb
SHA512 41d79b644e35a39a90eb2f18c877b95c920167f87aaf4865a6eb690c712b6dd206642806af91b723f7ba26a61ae6e940271b8ef04b2550cca460c6755cbf6078
SSDEEP 384:nZcIc38NLsm9mivbGRpd+dfYbRAvpSYWmkA1QiZh6vPqQMQYeJfjWca4G2KCQ9Ze:Pc3OGwqTtAam6aQMGdjWca4Ghf9Zof
TLSH
T139E2AE315C7499739CA7A296F62B3643FEF0526389C85E80D8DD6B0D039758E230BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 a172d7b75894094c3002e4868e0ae447db49ccb54935b548646d64ec73517f8d
MD5 4792c74ace8c2bdb106aa84d05134242
SHA1 21b894fec432d0048c11de5e0685fbdadb7040fb
SHA512 f066c416f609e955c1651751aea81537aeedd03606c282cf84e83c2292dc49af8365f128d7895acbb9ea621ef54ca6e4fd7819556122270b38d490e42b5f58a9
SSDEEP 384:VZcIc38NLVm9mivfARpd+dfYbRAvpSuWmkA1QiZh6vPqQMQYeJfjWca4G2KCQ9Ze:tc3b8wqTXAam6aQMGdjWca4Ghf9Zof
TLSH
T1D4E2AE316C7499739CA7A296B62B3643FEF0916385C85E80D8DDAB0D03D758E230BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 dfa1153738c08d721792ba344b232789ea34c3dedb6968abf87a658666550e1b
MD5 f63fc97fdc63c06978d4b32208a2e37c
SHA1 ed474a4db9c0a3019b8cbf04895a3a03e9c30e68
SHA512 73634058d860069d4218f70c945887fd1f2763901375322d88105e6085db4a4fd5c8ff85fcc0c357d7fa9451c1bbd0b38f95218382413a0610ae2241c16ed2fc
SSDEEP 768:RFQH3uwgK8wqkAam6aQMGdjWca4Ghf9Zof:gH3BtmaME6pZe
TLSH
T16DE29F325CA4C577ACB7AB95F62E3643EEF051A3C8D89E90D5DD6A0D02974CD230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 39f07c73046e20328a3b530b8f3aba0e23d2a95fcdd9b0f5374ecaf832e4f80f
MD5 7bff6c0050bf2f5df0b48e78f0a75d22
SHA1 75bd7d696225b5662b481eb5b72fef5c352bd175
SHA512 ce98d5dc8f7e17383c2ae9ac2f4cc5b1358c901e57a1a6b7cce5fd776d53d665d99f39d8b9302bee88e6cafc7ae34c6ef28716c44df40e5cd11c4f5c575c5fa6
SSDEEP 768:/rv+4UNbdq3dwqGAAam6aQMGdjWca4GhfBXPeU/:/bsbc3iKmaME6pfH
TLSH
T18AF2BE31A8689973DDB79A99F21B6B43BEF021A385D40E80C9D95B0D43974CE3307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 070d1b9f75b787bab4adc260d12235130caae4e7baf30a3e58931fc45082a3e3
MD5 f41d2cc862250933cd51b968ad2f17f4
SHA1 4708904f6e1443070c51c95eafcc10210033eea3
SHA512 5861ce2b79b3c0d0a61e0a5429a7502ff5c372c73ff1f10135255b833315e0616e8bba019a6d1958ea2ffddc18c68f0e7eeb40444ffec10a1741adacc5dc3639
SSDEEP 768:mrv+4UNbdq3FKqT0Aam6aQMGdjWca4GhfwZPeU/:mbsbc3NWmaME6piH
TLSH
T14CF2AF31A868D5739CB79695F21B7643BEB451A389C80E90D8CD6B0D439B4CE330BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25ce92ec-881b-4908-be10-490de66ae11b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\25ce92ec-881b-4908-be10-490de66ae11b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download