hxxps://bhiyawin826[.]pages[.]dev

Analysis

max time kernel
898s
max time network
735s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
26/08/2026, 17:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bhiyawin826.pages.dev
Sample260826-wjm4dstdmf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
568	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322406446915109"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{7E39BE34-5A06-44A2-B22D-E1AD8CF67B04}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5748	msedge.exe
5748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe
5996	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 5996 wrote to memory of 5016	5996	msedge.exe	84
PID 5996 wrote to memory of 568	5996	msedge.exe	85
PID 5996 wrote to memory of 2064	5996	msedge.exe	86
PID 5996 wrote to memory of 2064	5996	msedge.exe	86
PID 5996 wrote to memory of 2064	5996	msedge.exe	86
PID 5996 wrote to memory of 3624	5996	msedge.exe	87
PID 5996 wrote to memory of 3624	5996	msedge.exe	87
PID 5996 wrote to memory of 884	5996	msedge.exe	88
PID 5996 wrote to memory of 884	5996	msedge.exe	88
PID 5996 wrote to memory of 884	5996	msedge.exe	88
PID 5996 wrote to memory of 1264	5996	msedge.exe	89
PID 5996 wrote to memory of 1264	5996	msedge.exe	89
PID 5996 wrote to memory of 1264	5996	msedge.exe	89
PID 5996 wrote to memory of 5488	5996	msedge.exe	94
PID 5996 wrote to memory of 5488	5996	msedge.exe	94
PID 5996 wrote to memory of 1444	5996	msedge.exe	95
PID 5996 wrote to memory of 1444	5996	msedge.exe	95
PID 5996 wrote to memory of 2224	5996	msedge.exe	97
PID 5996 wrote to memory of 3972	5996	msedge.exe	105
PID 5996 wrote to memory of 4536	5996	msedge.exe	106
PID 5996 wrote to memory of 4532	5996	msedge.exe	107
PID 5996 wrote to memory of 5244	5996	msedge.exe	111
PID 5996 wrote to memory of 5244	5996	msedge.exe	111
PID 5996 wrote to memory of 4308	5996	msedge.exe	112
PID 5996 wrote to memory of 4308	5996	msedge.exe	112
PID 5996 wrote to memory of 5748	5996	msedge.exe	113
PID 5996 wrote to memory of 5844	5996	msedge.exe	114
PID 5996 wrote to memory of 5844	5996	msedge.exe	114
PID 5996 wrote to memory of 5084	5996	msedge.exe	115
PID 5996 wrote to memory of 5084	5996	msedge.exe	115
PID 5996 wrote to memory of 3012	5996	msedge.exe	116
PID 5996 wrote to memory of 3012	5996	msedge.exe	116
PID 5996 wrote to memory of 2056	5996	msedge.exe	117
PID 5996 wrote to memory of 2056	5996	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bhiyawin826.pages.dev
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffdfc5bc188,0x7ffdfc5bc194,0x7ffdfc5bc1a0
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,8356076629136508048,9068377534599602502,524288 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,7482120280161805328,13574121008292237474,262144 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,388181324232434250,2033444820116250281,524288 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,12103079788211969634,887829806555173728,2097152 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,998521398978316679,110654689324036482,2097152 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,3911117153568730104,1463988138055704774,524288 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,1883261085021540650,17214014889921541575,524288 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,6886285710632771628,4182142769000039334,524288 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,6886285710632771628,4182142769000039334,524288 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,18262751581495593401,13090802451121637817,524288 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,7017292501121411344,2645679736205196908,524288 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,12107867083840732929,13899032691555815402,524288 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,9121413476885263295,4535183466314949827,524288 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,16266691037921937462,1790342312252145278,524288 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5108,i,9227141433611531938,15195152731951080980,262144 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,3684661282370643280,838030145199838406,524288 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:8
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,7670789443238326856,742652304272456427,524288 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,12806015141403567701,16105261760146316499,524288 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4076,i,10462620695757164320,1120426862629863893,524288 --field-trial-handle=2360,i,18355338783742432179,17027191773279753689,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 524ae55519907b3ab75a388a7d8adb5b3e5bdde0aabefe20ce772a09ea687d5b
MD5 f6eb566f9aba7efdbfb5c795bd65c547
SHA1 0ce2d6e7d9e58cb863af3f628d52cd4dd694f6fa
SHA512 2b08121677adac5c93abf00acc6bfcb28d8a72bca78fdef9052724d4f592d583e28680a2ae9a96d1bb7c0a432f05c206ebc2ec8238e6cabafaf5ae8743b7260b
TLSH
T19CD0C023360D3004E3494231D002C3042311447810078301F330D88C89241C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c2d8f092208668817cd0259bd94946dd6f23573354e4617b30fbe7bc59914d75
MD5 6f3341c5904a5ffed4f1574a22134668
SHA1 ba264cd9b7f07e873c1edb3cdd624d29fbdbc2cf
SHA512 e4bca63a22aaaca469ff551688dae5380ea79a2307dd9b24dacbe06f3941e44ca8a26e587f883bf205c80e067aa6531482c1243d255366813e16de6fa7a7a28f
TLSH
T1EFE026A924DCC29EA600A4CF536C530CC3C0374ED6C8ED4F3704C489B085884A2AA791
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 0103c97d537e440724b029e5d11931d85786a6128c1511e3b66e3907ce1ab313
MD5 70a51630fb86d2c334d38421aaad86fc
SHA1 dd81bf682bb0e211173b24ddb22eb382319fe842
SHA512 0a1fdaacc6134b3f9e06c66ed80a6a4b87bd4a9e951a1dc0857675189c1754ebed45866d74174191be4e703008191c5854be9d23735bced61779a07fe743df62
TLSH
T152E0206E43AEC1949F419EC7A35CB3184190734D968DDC6D322C79441C100D6D35E398
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 181fd56867d060977e7b46d88c0930a35bec5e2f386410c5b67ead43633b02b5
MD5 24ca054fba6274e32283cde2821ef5d2
SHA1 e59ad7b34a1349d235abfa522c9284954d5375a1
SHA512 15c081a0e1709cdb460a8badad9199ac73f7c2945284f0eb5f8313e3c5a592c5e65ff92ddf1ffd6570c96c694a5222c3e42ba7c3173730093bc749e14377627d
TLSH
T139E026EA04CCC2BE9B40648B9368534CC281370BD6C8B99E572C8CC4F881080A2A36D0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 69353afc7f289759be14fd811c9bb8d7de3160fc69370822a75c5521a900fd50
MD5 840424daaf209f3402eef91d18c1ca7c
SHA1 dd01118fbad901ad2b4ae34e8edfd129a1376423
SHA512 dd5f6de130500cb054f600297f4ce8de05d1722d1c104dce77e2d5076af86395d33fdeebd5ca3dd084e66a3aeae72168feafece1b24c29d21ef4a89281c54d3b
TLSH
T143D05B5AF9EC9E9ED7E44ABE57F5F8000A4802A2541B9B631034BEC134956F41F69034
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8b6e41e2e5429be066b42961bcdd97ea6008357dd66cc6017b1d18f9714db7e4
MD5 6786dd05ea2b4fcccde114e9ae0d0c53
SHA1 3a511312993f9e82d6faee41b08d458d81408633
SHA512 98a5c9517a1bf1a10852d2b034c56b8ac5e2f4472e14601646f5110c76ce584b7c7344a391530a41ac15a6c3258be225daa61de860364f4483ac0935b5f0494e
TLSH
T1FAE0E5D5CD61AC3728FD0B1894540B82E71013672E41595A363C56088FB0B36558A96C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7235fbc52c5e14487c60d23ac210953286fc19625e268a8773b24cb582b1c590
MD5 8c0aafcc2416289513a79b8c4872d9a0
SHA1 68cd2683b8ff6018b03fe4d10012256c35b349d8
SHA512 73fb8c16d8739e7f3ae0734bc1fe198f4ca56fb5d41956d5c58f6e9682410eaa04c45e07136802fd4b6bbbbd7a1a3d45252041cb8ff3fc0c17ba7d66812b4841
TLSH
T1AE41DEF783F4856EDA1196F0EA14BE2FCF1D0514832C3D9A85E0AE5797E2031E045B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 412b41b5b7d5be577b20ef8ce46d87f78e15df8c2149d560c3c549216657d332
MD5 a62ad00479035efe6dafef5e6acb394f
SHA1 1ea0d83ae839b3d3f7ed7046cdca321161f2c940
SHA512 02add27cfe53fec87e07d80cc6a0077a8b8893510765d5a91cf1988bb0322ad0f476de69c5eb2e668e0b84613dbde3739611a022d3892b5259ed55e659daf8eb
TLSH
T19741CCF783F4856ECA019AF0EA14AE2FCF1E0514432C3C5A85E0AE5797E2432E045A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a50c1c199c4fb17564148d479202734d356dd8619a991471d2a08101a3a926a2
MD5 28d4142c84d417ecba18418fb8b97523
SHA1 b1eeaa09950c2dc3e126311e4e43bee30c58b092
SHA512 93c780054b6bc663d0d11bcb6b8f87e9ae0bd28392b95b433144e1164b32dd119ce3f9906247f3090461354260c59ad404c35ff238251fe01085cea6d61d8308
SSDEEP 192:sxZVRriyMqZjK1Ml8UQEk9W/f+stI48Z5z/Azodp7CHW6+WNi6g/YQ4fjckQoIgg:sxZVzqf9W/f+stI4C5rjuHbw/2ckJng
TLSH
T14B62F7166A789E778CDBD219F9557F93D6F9052391814E44AAFC8A0C04E7ADC320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 04d9b35b85aeb4a3ea036c54b429046c76288dd804831ac5ef71ed5e8b546183
MD5 6ca6753401ef15e6e3b331e38664e2c3
SHA1 76c0857eaad22267e82aea8a31f554cfe1e80e4a
SHA512 b169626c70ffe5b340a8e5fae9e59f20136328cb0f54c6e6ecf2b9b5438fccff0c6b814d9289ae7a42594bab22703fb02a9f1518ae7a7777bfdde9446d26bcde
SSDEEP 192:sxZVRriyMqZjK1Ml8Mk9W/f+s4IN8Z5z/Azodp7CHW6+WNi6g/YQ7fBckQoIgj8J:sxZVzM9W/f+s4INC5rjuHbw/nckJjg
TLSH
T1E462E7166A389E7B8CDBD209FA557F53D7F9052391854E449AFC8A0C04E7BDC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ddd93c640e662c502f8eb86638cc1df77a2298622f6e99b3321005e81ad97b67
MD5 05935d2041921213c2915352f66cfcb9
SHA1 da1777fe0ccc73476b61fb62b7ddeaded5a5d048
SHA512 12857425d3c7e0616dd87b28b12e481e52fac401d62cf2d444b3a35b85e2bfac067ef4244c51b9b84be70447d5a8135ce2be134629431716442650f79874268c
SSDEEP 768:cFADqXGWviq5i8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfRLl5bKp7roK/X:cFADqXGWviq5iu1jaSRLDmpIK/X
TLSH
T16DD20B2F684CCB7E4F841E5CEC266F8B6DD802CB6A984D5447EA844C02C77EE512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\625b44cc-886c-4ae5-a674-8f5063fbbe30\index-dir\the-real-index
Size 1KB
SHA256 62b6b9a875fa45b3e387acd36528c2dbbce4079486e2adedc1eb098339c9f9f8
MD5 c09974ee6dec3911e9a6f2974fa18b14
SHA1 c8e09020942fc6888242c20114c735b9355dd17d
SHA512 7be697648e3343802908eb66358d507d6163c941627a6f7308b00ff977a76865e7cdbd3a0c6cd4b8a935725eda64e684a1287308cb5d88e5a72fd97147f56ccc
TLSH
T1C23195098D90CD5FE8A444B115B6A878333488EC1712F6538C3C6135BE1B72A190B2EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d0c76.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\625b44cc-886c-4ae5-a674-8f5063fbbe30\index-dir\the-real-index~RFe5d0c76.TMP
Size 1KB
SHA256 3b5955a00a3cea22b0a56006d66f591852823cd79d82b41f99316710bd2eb371
MD5 4a74980a79ce0e87903a9dc6a48aabb6
SHA1 95eb7f7ebb459df181d9a34ec7a8335b7bbbe0eb
SHA512 7bad79c19f6a4bb6248d6d7ffe94e9f308eb67464f82cd15f4dc79a6b4d420ef17416923044b8a93138fa25f3448dc215fceeb759d355b3cbddab7d14e36328e
TLSH
T11C31AA4A4DC08D0AE8C440770EE3A8B8733598405711B783547C1134BD617BE1E4E0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ba9f8d1a017af309ca3ea25c5018f6a0f9bdfbb710d126198ef8f43ee5d22a15
MD5 31a75a2f979584eb9ea064fbb3fdd09a
SHA1 e063e1151ba094e968fe724bf0caf248ba2cea30
SHA512 0bc404ee3ee07e4e50f198c416f4acc145dddf77135d6ed4513dc3992a93b00bc77b7a42164cf0392ff735d307c15bd8869dd80024ed137bf196e957c0ac3fe5
TLSH
T106E0D87A2DE61D14EDAB93D51432557A41423554C484ED4F305AE28B24E13562886C75
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 e501a16e87631c4ca7c6ec2cb736616335e49dc397ce642d12c9ff56db95e157
MD5 d16516e2852e054321fe4d2d701f8318
SHA1 5175fe8a75f59fb8e25f5ff3c7e8505c20554e9c
SHA512 51a6a05babe72ab69d85a87df345e7fc31bc93bb88a556f92e630b69697e17c734a77e63bd7cc4167f2f39db8c3e5bc6246eecca4210da49bf16425db2a54f07
SSDEEP 96:KY5mKicqtEYKJ6SOhCKiYZ7yKoAS+/yKosjfmKoYuqugKnKA1OKOACqIgK9KeJ2z:cVSnNDxZ9l3iZ3QxVl/1hVPM3HS
TLSH
T132A26916713A065238BD6D4CB3A68A3B4F4271633418E5AF7FB810760E2AE125DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 db3a867cd4a2596ed511f34f5c0fa6fb27c517df27ad3c0611a1bb52c2eada53
MD5 b8f6fddca93fbedf73edb04c33c91ea9
SHA1 1d82387338ddaba18c03fedcd0df1c752ee052e0
SHA512 bf5927345ee7e860e3dc631540139d22a300c1c00d038e65b6d16547786cee63686d9838bcf247475da6f8651181ad6fde29acf9609dd96ac764c33e4fe0c112
SSDEEP 384:nJiF9CcmyWCs3sNd8TUNTUlImkrJjp3CifbZoD9VKUs8yEKvkfhkP+lFYS/QOF7w:gFccps3Qwgd3obbyVkfhkoFYS/QJ
TLSH
T1FFC25B35DC98CAABECE74FD5E64A7543CEE44167858C9AD0DAD82D0D00DB2ED530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 438691ad2145501c377340cf826b5e65aae0b5e2b3817bd9565cd0a692faf020
MD5 2b13617373f8c18c118e2d960b5962cf
SHA1 1562d30d5cb3a435520bd3d314853a57a3365eca
SHA512 9bff6918b4f4fab96d0945ccf63237b69b8eacd7214c9bdb97a8f321510c7da7ed27d7cdb456fa6e951e44f884d7235877bd1abb0d84b4dc36cabf772b8288cf
SSDEEP 384:nbiFiZcI63sNh8TUNTUlI4klJbtd2CifbZoD9VKUs8yEKv5f+HBbsl4oF7IgAo7:2FQ63AwgXUobbyV5fg9d8
TLSH
T10EC25C72DC98DDBBECE65BD5A74A3603CEF44163958C9AD4E9C86D1C009B1ED130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 30423ac2b594ceaa4cb185daa0b9b1de47f6b3dd65654e4b7efc776988ea8294
MD5 eaac17c8b63f2e1b7c98e235fa7084ad
SHA1 372504482affbe14d4a319def3adea4cee4cb93f
SHA512 86c44bc01e63eebf885ce4e0fcea9685ea7770e7a8796a9371da6e46464e195798a7c057ba13eb4cc0d5b00bf8e77d1f73e4e3a65ecb2f46d83c25f02afd9d45
SSDEEP 384:n/iFiZcI63sNh8TUNTUlI4klJLtd2CifbZoD9VKUs8yEKv5f+HBbsl4oF7IgAo7:KFQ63AwgnUobbyV5fg9d8
TLSH
T1A6C25C72DC98DEBBECE65BD5A74A3603CEF44163958C9AD4E9C86D1C009B1ED130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 341a8649f562c3095b24261109b95637409258a4afc1a67c74922e422f0da27c
MD5 990fcbd274a6b0a363fb195a63ff7b67
SHA1 9281977fa2d076b6dd04fc1b7448dc6d135c1f0a
SHA512 30b2fd608c4198e07f550820b4f494fda831057dd93a08ee6308d77309a1ffc6f84fecf2e3132cecd2b93fe7615657dcc0b2bacf895c577fc9918f44b99b97c1
SSDEEP 384:n4iF9CcmyWCs3sNa8TUNTUlImkrJ15JCifbZoD9VKUs8yEs7KhkP+lFYS/QOF7I5:DFccps37wgTlobbyj7KhkoFYS/QJ
TLSH
T1A9B25B35EC98CABBEDE64FDAA64E7A43DEE4016785985AD0DAC81D0D00DB1DD130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 53231135003f96b7738ec70f27fdd759cdc8cdc344d4368d78d1b9abe3d3e2b8
MD5 4b8737f47261ac1f91e8a1969f09587a
SHA1 1e1ced99cdbb40c11061726350a45a54e1664d9f
SHA512 539faa08b52ef8951f743dc4a1f551a17b47591b8a97e50888aeca849b0b2e660c9f783b62bbd35ef235322b5d807bf7c88b0901828e78ab841841e44d38e134
SSDEEP 384:njiFiZcIy3sNh8TUNTUlI4klJb3d2CifbZoD9VKUs8yEKIf+HBbsl4oF7IgAo7:OFQy3AwgFUobbyufg9d8
TLSH
T164E2C4F188D79977E8AE4B87A77E2D0289FCC15375885A90B7C85D0CCC961BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9e94c3bb8397f37f46a2f48a1450903bfced28d5a2a37c6e3fc72dff4d7b1db1
MD5 755cd324d81e8017e4cd083a8ba1e065
SHA1 98d43aebddaba4a06d76274f1da41865bab44930
SHA512 97520f152e8edcc302e8281569a41ca87af6954e9687457f03dec7ad55876ce63d37038902e6a5da766a14b16e890822b29020345a5c55d351f1fedeb5141b27
TLSH
T1E341185CA6E91148B3B77F5A9BF6B8AE547BB9372E06849E10110E4F0622A40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2224-189-0x000002573ACE0000-0x000002573BCE0000-memory.dmp

Download