hxxps://jhbpams[.]jharkhand[.]gov[.]in/autodcr[.]payments/images/efs[.]jpg

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://jhbpams.jharkhand.gov.in/autodcr.payments/images/efs.jpg
Sample260825-e5tpmael6t

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	2236	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2236	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321059231372182"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{2D7A9302-5DEB-4587-A39E-9CFDD208DA1D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 3132	4684	msedge.exe	85
PID 4684 wrote to memory of 3764	4684	msedge.exe	87
PID 4684 wrote to memory of 2236	4684	msedge.exe	88
PID 4684 wrote to memory of 2908	4684	msedge.exe	89
PID 4684 wrote to memory of 3764	4684	msedge.exe	87
PID 4684 wrote to memory of 3764	4684	msedge.exe	87
PID 4684 wrote to memory of 2908	4684	msedge.exe	89
PID 4684 wrote to memory of 1664	4684	msedge.exe	90
PID 4684 wrote to memory of 1664	4684	msedge.exe	90
PID 4684 wrote to memory of 1664	4684	msedge.exe	90
PID 4684 wrote to memory of 2188	4684	msedge.exe	91
PID 4684 wrote to memory of 2188	4684	msedge.exe	91
PID 4684 wrote to memory of 2188	4684	msedge.exe	91
PID 4684 wrote to memory of 4152	4684	msedge.exe	92
PID 4684 wrote to memory of 4152	4684	msedge.exe	92
PID 4684 wrote to memory of 4152	4684	msedge.exe	92
PID 4684 wrote to memory of 4668	4684	msedge.exe	93
PID 4684 wrote to memory of 4668	4684	msedge.exe	93
PID 4684 wrote to memory of 4668	4684	msedge.exe	93
PID 4684 wrote to memory of 2004	4684	msedge.exe	97
PID 4684 wrote to memory of 3496	4684	msedge.exe	98
PID 4684 wrote to memory of 2004	4684	msedge.exe	97
PID 4684 wrote to memory of 3496	4684	msedge.exe	98
PID 4684 wrote to memory of 1316	4684	msedge.exe	100
PID 4684 wrote to memory of 404	4684	msedge.exe	106
PID 4684 wrote to memory of 2868	4684	msedge.exe	107
PID 4684 wrote to memory of 4380	4684	msedge.exe	108
PID 4684 wrote to memory of 1412	4684	msedge.exe	117
PID 4684 wrote to memory of 1412	4684	msedge.exe	117
PID 4684 wrote to memory of 1848	4684	msedge.exe	118
PID 4684 wrote to memory of 1848	4684	msedge.exe	118
PID 4684 wrote to memory of 3996	4684	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://jhbpams.jharkhand.gov.in/autodcr.payments/images/efs.jpg
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffbd8d7c188,0x7ffbd8d7c194,0x7ffbd8d7c1a0
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,4793573715186719196,7870091566347068053,262144 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,17882226123720212569,18054875533001545591,524288 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,108154085694154142,10223198889428814803,524288 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,182324878595821888,7516174706323989936,2097152 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,17660382199513398701,10510677203842753464,2097152 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,2057723367986868140,6412703969336810891,2097152 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,8158800309277892354,18252090502301170330,2097152 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,12667377355950266973,12069826635293670485,524288 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,9901280665567299566,16953395195806035408,524288 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,11185013653046044092,4971531899377580485,524288 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,11185013653046044092,4971531899377580485,524288 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,6974344292872244859,4632634778065305861,524288 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,2107039311028300826,10577908112054432864,524288 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,1936270048632923781,9395779929993791802,524288 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2680,i,2491973228686653145,9486060219548608555,524288 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,8668859236646290474,13871408631029941579,524288 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=772 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6136,i,2625319070421587107,10230421771184489916,262144 --field-trial-handle=2488,i,4820238249288166151,9797358733822588623,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 49f9f40c01701f56a5ad0c163cf88152ec90179ce112177eea043abe8b66a08d
MD5 f0eb323d4ed34e9bf8ec713ded5dbc7e
SHA1 f254c357f05a2565e53647037199712a43b7a783
SHA512 5947bf0fe43e164d06001e9e75c9120f561dc199b47fc0345707c045ba224552190a2306e7e4f4b3665bc86e60e74c948108e52a1518a60c210d9518cd3c166f
TLSH
T1AF41E7F006A35B41DF3116B190F01B01367683EDF9737E18829299BE3A3AF63852647C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 478a441c4a42921fd66ea0c2961ef9170a72860988aba06950d116f14dba3049
MD5 d1ae71b96b420d2a7ada07079440b268
SHA1 c85d7b759f0dba6c28c819288dd6d6f4aea877da
SHA512 5db9263de45d2da54ad6a6348bc8e5afc1b0bf8d44bf2dbc695ca78cf7072c1a2891614d4b658ed30c9ff3c46fb57ed07282e1b01ca56f14335feb27e849b092
TLSH
T1AB11AAF387E5D5AECD1156F09A24AE2BCE1D0616422C3C1989D4FF2793F3479E10199B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 51814322af4698c55734c987ef73b10c9eae03c45d1eaeb374136225450f092c
MD5 a51d5f5043b6cd56851cde29f5c07c72
SHA1 cfc65b3372bd2330cf37620c5f7052273c03192f
SHA512 90eb4b1ffa7034353c952a0668a41d34515cf053de563f7f070d0734cef2d58772a3ca807d71e0071e15fe15f610946a11de0b55dcaaad717a8f8e63975e2250
SSDEEP 192:sxZlRSks/ftXsN7NCf+IdpNMHW6+WNdMj/Y9IAnnjIgrJ:sxZlPs/fls7CnGHbu/+9
TLSH
T1D122C852AE38B9774CC7D619FB19BF53E2F6503191D11E48AAFC851C04E66DD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6b52b4ccf7ed4f72a699d0bd5ba8e535b9ea3d2ad734ac0cf79a77f130d60b60
MD5 3c186d0bea5fbfc3d16a3e48ca2f9470
SHA1 ee436abc85a7e8b90aa48594be5ba7c3103c6fbf
SHA512 d67df3d658b036130bc197c72e4058cc4cca4dbd7865b591ed7768b9881af04188e0016b5fa965509d3952d5fae18900723ade1837bd4bb8dda3538978144cf7
SSDEEP 192:sxZlRSks/ftXs37NCf+IdpNrHW6+WNdlDZY9Io5njIg59J:sxZlPs/flsxCndHbnZON
TLSH
T1F132B852AA3869778CC7D619BB15BF53E2FA503195D11E48AAFC861C05E67CD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 73ddc52079efc0af2e826f643c4ca12c3d47aa070ba4b38f1ca06eb6c4080239
MD5 34e2140c3d9de1cc7708857886349dc2
SHA1 ff756f62d4fa49a3b45e81164af92b7f7a6a59a7
SHA512 a8c29e5ca773ad1ce9fd2cdb6c6417ae1a75cde0a587b1b252d885cc5a122fa69033d798dbf02bfd6091dcaaad357efea6e2b6108629148776d6a1a760491164
SSDEEP 192:sxZlRSks/ftXs37NCf+IdpN6HW6+WNdgufY9I0nnjIg5fJ:sxZlPs/flsxCnoHbPfKL
TLSH
T1FF22B752AE38A9778CC7D219FB19BF53E6F6503191D51E48AAFC851C09E66CD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 363cc16c597596bfc04caee46fe1649f8adf52149ca984152c873c323c774a35
MD5 3c5829a7278b0ac7d86bd8118c19862f
SHA1 a0cc43b2b732847409f544d1684240f48ec55f00
SHA512 ddc8954134a6340ac86952cf98e7ada1866b31dff7fbd9e1bd878ec45b5ad69a81d8326e1ec50de2c80c3bfd117e3fbf4bf493fc4a5b210ae683b960a88874f4
SSDEEP 768:WWyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7proOybqt:WWyvIZwWvu+Q+u1jamFLeR7Cx8
TLSH
T12AC2E92B240CCB7E5F801E9DDD5A6F9B3EA802CB67588D4047FD994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 170208d7f7f669ad60c92c828e906281c7cd5d87ff10994ae2ba04fae08b103c
MD5 24e6e95d43a275910ec14087d656f7e5
SHA1 08ed4817fb7bbf970d2017bb86cfe480936b3952
SHA512 6763b5cb53a55aa887f8bb100040b6a8397e9c9026582137fdc42931bc7d9833b5f8bf7b6e0ab5f5cb77b4f7bbc9ae4b53461963ea86893a8bec5f24c8b2a67b
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDaAYKhy+iVoZFf7Xkn76P59kKBB53ktlFaD:mTXjiVoZFf7Xe76B9hB53ulFafL
TLSH
T1FB91F006B13A02D339BF695DA3A299368E4131637A14E97F7FB900A18B27E111DFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e2b9598-fd36-408e-8748-ba722e614d99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0e2b9598-fd36-408e-8748-ba722e614d99.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5b6353f1c2d056dbe07f20a406b90e81286dba18b22b6c854f5cde6fbe4d14c6
MD5 5baa0fe9ad53bce6f9060e83fe46a0db
SHA1 0ddc302461007e70ed4ca181e447d1b85ad2f857
SHA512 509878461764d36b183978279e9ccc283cc091337741ef9e944bdff8cbec54397dcd0a713c6ccd01ef02b550a75211c883067ef24cdd5ca4ddf1f9353bcee955
SSDEEP 384:KZcIhsN7VGQZT3A6QziXn81e+CndHeReGbivvNo8:ohi3AV68kfElbitb
TLSH
T1DF827C319C382C7B6EA6D641F5863A075FB8C163D6C97F80D4ECEF1D01DA6E8130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4e9fcb3f64fdb4d89c4f4d6f45b812aac15fdee28999a95ed46128b4a61f6dd7
MD5 80016ac2576bf8612c98153d8012f95b
SHA1 d1938e60c62151bcac54e4edbd92de5c42991ffc
SHA512 6820f6fcd12e0cac341afc951fcbd0ef07d6ce6d2def3c1506c6214f81af4000caa4b54485e6d969d77ada63e4c70628873fe2ab68c852831ed62ef8a58bda19
SSDEEP 384:niFiZcIQsNF8TUNTUlIlWGQZT3A6QziXnB1e+CndHeRe9bivvNo8:iFQQowg63AV6BkfEYbitb
TLSH
T1DAC229F248E7587AD9AD8B43E77D2D035EBDC063B5856A40B3D89A1CCD9A1BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 22191ff52edea72d1d2439550da734880958d57b4a952cd52beaac63fefa6a38
MD5 d4ea1ec089e5fc3e9b60224d028c895b
SHA1 85586e6b82bc945fd6178cc5b7da3d3d2388be53
SHA512 c5c9736668434f6e31c564e50b1c5b07e898f5938eff26da8a3466a0f46922af97e6e0e93879a5db25abe7b026f30eb74b61c0b3cf825b8f058bab7440462ee5
SSDEEP 384:UZcIhsN7WGQZT3A6QziXns1e+CndHeReGbivvNo8:Shv3AV6skfElbitb
TLSH
T195827C719C382C7B6EE6E641F5863A075FB8C163D6C96F80D5ECDF1D01DA6AC130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bda080b4e472f1988e32450770665afeb80710a9ce0ce2c1086c775c44914462
MD5 3b95c11f498986dcc7866d7b281d4d98
SHA1 5d71b6e0159cf8ca067ead69a8ce10e08d3be6b8
SHA512 a72858718a263937d3b124c17f7aa6597daa1d06add642ff836107dbd4188c2d71c1856ab385ace6fe458c34fcb9d0510f736fab132e857caad6adefe0a800be
SSDEEP 192:nONm6v+YLOQmiUypCFHh+CGp+Fdes9omOQNuCHzqsU6:nONm6vzGs8Hh+CndHeRevbU6
TLSH
T155120935A8786C6B5FE26941F48735135EA99277EAC63F80E5EC6F0C01DF6AC130A426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 155565f16358fb6fc70d2cba5031defa3c539018dc15f417685246e51634172b
MD5 594294d01eea20d1f00d38ca5059e6d2
SHA1 25325ac54713a5506afe11504723527119fd34c2
SHA512 a3d49b7cf3228e349c5bd2e72afea3a8130baf9751b699316cd49698becadf52cf8237bd539f1f9efa66f6d728255f2d92e2e734fca07b1fc650803df8298fe6
SSDEEP 192:JONii6v+YLNQmiUyWFZh+CGp+Fdes9odusYPU6:JONii6vz/NZh+CndHe9SU6
TLSH
T1D702F935AD382C6B9FF2AE45F5873A135FA8117BE9922F80D9E81E1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b9095a258e80fafc2592e4bbed7a1ffb446b8f0b65ff4fa6b17d5cdc758c2841
MD5 d8bdee97e49860e55326584ac91af16b
SHA1 765c6448cccc46658be551fc9767bb15f061bb44
SHA512 ee8475d2f3a95342ae066e2e930968ab1b2487d09136d586f70d897968e736e867ed2ed4d0b2f337af61c114972617c58fe4f0c7fa19f0dee2f75d807e639286
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58e654.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e654.TMP
Size 392B
SHA256 e2ca0fb0751828ae64345e1db962306a61f5296254624d0caace39344fda1a7a
MD5 047d59f53e87c50ee54cc6f72c84b719
SHA1 8b3ed47e1ee9a143367475f093cebdca9d25e396
SHA512 7777765873dc84a6985cf2b568ea4a931b001529b3f5c6c19ae508183b0dc7363cfc767d9c70ba5fa69d056e711a1d77403ee35cb10f310daf5b567d7eb73b86
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bd5c55b1d87903183731f3c0a76f8a7649ceabdb5c11750cfd48995d78ae9917
MD5 f8a9a7c2c178d1d74f3fb406fa94e0ce
SHA1 b75422c9fc43ac686bd0fd26c2b590af3f306ae1
SHA512 7631fd863afc29b8d08f64b46d3b592beafde08b95bf367d5f00400fce3310c29e70e8160074131303987052af5f73dbf02f9c44ab544acffa8194db278dfd1a
TLSH
T11141FC69B6EA1108B3766E5A9BF7686F447FBD372E07D55D00110E4F0A32B40C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download