c74466c710afc3a967374bb8f00b1558a7c5516184ba9f3580feb01575ed5609

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6331-betaling-the-isle-pc-spel-steam.html
Size 503KB
Sample260905-13877azyht
SHA256 c74466c710afc3a967374bb8f00b1558a7c5516184ba9f3580feb01575ed5609
MD5 6d9377ebbefa2e32548b8ff83cb4a42d
SHA1 23912797eb58d4dd10ccf9c0627e470206f6b8d1
SHA512 3077208368751fde7dee0f4b07e4f33c2c53e4eff1d01104a5cb96fdc0668d8da7473b2d80d7aa57cbf97f58990089d9e18f30e8186ec15983d7d14ee31234a1
SSDEEP 1536:uTWWA5B9jX98zK+gbKdR0o+RpYnXH9Y/C7TwMMEFVVPi11nsfu8nJBcppT1AsCV1:uTWWA5BB8aGjvVhrnjbnTVbOUbumP4/k
TLSH
T17FB4F540A6F688F602EF00E46DB2A61ABEF04217F1444C49F6AD8FF51F76C4AD56746C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1300	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134331199173822429"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{6CC9C4D4-4D01-436B-BB35-DE671FA517D1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid
4
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 6080	4636	msedge.exe	89
PID 4636 wrote to memory of 5264	4636	msedge.exe	91
PID 4636 wrote to memory of 1300	4636	msedge.exe	92
PID 4636 wrote to memory of 5264	4636	msedge.exe	91
PID 4636 wrote to memory of 5264	4636	msedge.exe	91
PID 4636 wrote to memory of 1680	4636	msedge.exe	94
PID 4636 wrote to memory of 1680	4636	msedge.exe	94
PID 4636 wrote to memory of 4900	4636	msedge.exe	95
PID 4636 wrote to memory of 4900	4636	msedge.exe	95
PID 4636 wrote to memory of 4900	4636	msedge.exe	95
PID 4636 wrote to memory of 2924	4636	msedge.exe	96
PID 4636 wrote to memory of 2924	4636	msedge.exe	96
PID 4636 wrote to memory of 2924	4636	msedge.exe	96
PID 4636 wrote to memory of 2372	4636	msedge.exe	97
PID 4636 wrote to memory of 1260	4636	msedge.exe	98
PID 4636 wrote to memory of 2372	4636	msedge.exe	97
PID 4636 wrote to memory of 2372	4636	msedge.exe	97
PID 4636 wrote to memory of 1260	4636	msedge.exe	98
PID 4636 wrote to memory of 1260	4636	msedge.exe	98
PID 4636 wrote to memory of 5072	4636	msedge.exe	100
PID 4636 wrote to memory of 5072	4636	msedge.exe	100
PID 4636 wrote to memory of 1764	4636	msedge.exe	101
PID 4636 wrote to memory of 1764	4636	msedge.exe	101
PID 4636 wrote to memory of 1512	4636	msedge.exe	103
PID 4636 wrote to memory of 4224	4636	msedge.exe	107
PID 4636 wrote to memory of 4960	4636	msedge.exe	108
PID 4636 wrote to memory of 1776	4636	msedge.exe	109
PID 4636 wrote to memory of 1932	4636	msedge.exe	110
PID 4636 wrote to memory of 1932	4636	msedge.exe	110
PID 4636 wrote to memory of 4732	4636	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\6331-betaling-the-isle-pc-spel-steam.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffa484ec188,0x7ffa484ec194,0x7ffa484ec1a0
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,730162113527024241,4909301566645845240,262144 --field-trial-handle=2592,i,12149897861530476941,11279760946737150289,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:2
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,11250474814616344919,15757507701619527764,524288 --field-trial-handle=2592,i,12149897861530476941,11279760946737150289,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,15283427654286547120,8324048907164993223,524288 --field-trial-handle=2592,i,12149897861530476941,11279760946737150289,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:13
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,15187605366435993429,4848257239255151866,2097152 --field-trial-handle=2592,i,12149897861530476941,11279760946737150289,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,12003777214640736990,8854728060526535286,2097152 --field-trial-handle=2592,i,12149897861530476941,11279760946737150289,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,8371445238702384509,10455309918750812880,2097152 --field-trial-handle=2592,i,12149897861530476941,11279760946737150289,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,15459944523577303233,12455654020038329585,2097152 --field-trial-handle=2592,i,12149897861530476941,11279760946737150289,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:9
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,9547270382097220359,15543073043868754427,524288 --field-trial-handle=2592,i,12149897861530476941,11279760946737150289,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,6477699122441840624,25099322306538569,524288 --field-trial-handle=2592,i,12149897861530476941,11279760946737150289,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,2953843131039409420,12468775330586482659,524288 --field-trial-handle=2592,i,12149897861530476941,11279760946737150289,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,2953843131039409420,12468775330586482659,524288 --field-trial-handle=2592,i,12149897861530476941,11279760946737150289,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,12032006339608590424,9932704718368400444,524288 --field-trial-handle=2592,i,12149897861530476941,11279760946737150289,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,12408266831966645942,17338142964133021034,524288 --field-trial-handle=2592,i,12149897861530476941,11279760946737150289,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,9299381098285153463,8928783813728757821,524288 --field-trial-handle=2592,i,12149897861530476941,11279760946737150289,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,9247931464833055288,16517123723395202491,524288 --field-trial-handle=2592,i,12149897861530476941,11279760946737150289,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5492,i,15752948999465482920,15570940647826565768,262144 --field-trial-handle=2592,i,12149897861530476941,11279760946737150289,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f90a147e2565ce34780e3418cd22390eb8ffc262dbcfa3a293d5046ff6d3be3c
MD5 6c769a58cd0d1852d678bdf15bcd512d
SHA1 6d98dc7fe2f4344d0be4b2783a45e0e0ee210ef1
SHA512 89756abaeac37f50ea0d12af701489769798eb1c205745149cc32c2805df3dd45660d1a1cfc1d9c93c8df37e42ac5f44f7e785ba9f43773189e5bd0b876b4c4d
TLSH
T1FB4172125BB2CAD6DBA644F697D367A9F2F5C4090E27AE31C25CAD306582FE771C001B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 93b3dd57830a319bc49fd560c98523f31a4761da7097055364517f74c9dff771
MD5 9ba079a1f5060adf8fdd5a9d246ce730
SHA1 5bfc4b6122133a28ea4623db4b084e155933a40e
SHA512 f1c4312f832c990461be2e7a046184add60c5cb52e8338adaa0e6e5acc7732eb65684273c8d44a5fa38d01ff006f4dc9b51ee8dab05610bcf7240dc41a39d2d6
TLSH
T173519DF783E4867ED91196F09A18AE1BCE2C0116432C7C6689E4AE1B63F3472E04179F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 dc50ea76734d43b708d6b37b3e1edb5b56409111f2460025987b2d2089e79fac
MD5 d516ba0987e2b743726bc45564a7c11d
SHA1 ae5fb231f7bf650c5a58f18b00e814f9b0c312cd
SHA512 5ddcc46257e48b008501c0143bdade69421dc6fb9b8980c95c845da1f8793fec765917797ebe7762487d7d213e501edac5330105c4c3b8d45759cc24af251098
SSDEEP 192:sxRoRp7bE/fysK4wGLzoA8p4p/g6+WNIYo5ajYAGyIgIJ:sxRoDE/fysK4pqI/5IMBs
TLSH
T18832B7156A28AD3B8CC7E21DBB65BF53E2F9103261D42E48F6FC961C04EB6DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e581524bada70a051d7abe71a564e1d1f3681f8bce81b30f8f4772e1ebc708ac
MD5 1db381e1e57ba1f174dd2d7b91b4929f
SHA1 868801d626a4e90c02de648a79dc70cd557b15da
SHA512 ebc56f43360a5f3a737bc72e57aef30851f15fa1da2c6f9aab1a1f709f0d9744d6abbd94756e47a039c6d87bdb074c4a5155ea0a264ea48461fcf1cab3a1ddc9
SSDEEP 192:sxRrRp7bE/fysGrrwG1zoA8p4p/g6+WNIYo7sjYAGyIgDVJ:sxRrDE/fysGrrpYI/5IsB7
TLSH
T1E642B615A928AD3BDCC7E219BB65BF53E2F9103261D42E48A7FC961C01EB6DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3e0e532a6dbaa5639283fbf733816a89a8cd794c3baad582ea3ffe18f22370d4
MD5 4116358a9db0c952d6ff7089b2023894
SHA1 542a4df686dc5159c12e8655254bf369fe8cbe35
SHA512 fadade6ff2bae0afa9e98375774ee9e7b40d32f659c264b8b42c10d0bdd27b83c25be7b52e42587e0e7bec6d2364fc537ae50ad379ff367027999162e74200ac
SSDEEP 192:sxRrRp7bE/fysGr4wGLzoA8p4p/g6+WNIYo5ajYAGyIgDTJ:sxRrDE/fysGr4pqI/5IMBR
TLSH
T1BE32B815A968AD3B8CC7D21DBB65BF53E2F9103261D42E48F6FC961C04EB6DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 74bfc81fd18107fce60d379dbb838df97d85313f1bccf46f5b0c2dfa0f913a39
MD5 06ef9c5cbbed219738841d1b93e30424
SHA1 fe64b47e3bf31a0307e1d2a6dbdf5723a759b3a1
SHA512 480813b518eff23f5ac50de88caac28fc36b68d143f2567c7e8919acbc16fd7c6a4e7b284e9910509104171f6695c503b43b153f280099b41b677837b81ea701
SSDEEP 384:jzK6H0dfCtgsqFf02KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRXqro98q:j26H0RWgs2f028F1+UoAYDCx9Tuqh0VI
TLSH
T1DFB2DC2B640DCBBE9F800A9DDC196FDB6D9802C797588D4047FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7ebf63f31935d0cf415b231546a7d1c98652ef87e3f84d30d540bb1c82775e84
MD5 9bc43b374aa180948c021a51cfe91a6c
SHA1 9b4bc0492508f8973a22fb9ae80c41d9d091baeb
SHA512 dd8debb03bd160b4dfe522fa22da539a22ebc981d0b214b612399b176ef002f298ce1f8dc7ddbace6f44385f30f26b20afabdb22a6f7de1a199ee3672ca09e19
SSDEEP 96:KREEEFEwE0EOEyE2EUWESE/EfgE8EUK4ERgE2EUcE0E0E/EuEUEJHGbqGAoouWYE:C3gFB31lERe1JDggH2vHG5FaHGbqGAou
TLSH
T11F911514707A028038BE654980F5991F86C179D33455EA3F3BA947EA0F6BE275EFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

6dfd5fa5-54e3-4a83-a913-ea6fa5bdc10d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6dfd5fa5-54e3-4a83-a913-ea6fa5bdc10d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f4d7e3070f3dc405f087ff356aaa0b77a4d154df5fd0277925ff965aa879d8e2
MD5 3f64d72803c6575af1d962fdd0da7b39
SHA1 2bb893c67ce3d3056187dc02299660cfa10b29c0
SHA512 b32fdaf75f0687ee1825091c99197c790ebef530f71e07ef8b1280ef057436de6a1cacbeb273f5ad3841859532eae3ebf55b7903bf46d55df5259e67c803a719
SSDEEP 768:zrv+4UNbdz3dx/TBOWCuttJONXyer1IRCzniwOeVH1SK7:zbsbV3TFSIqnCEH1l
TLSH
T1EA03BF32E0A89E338DE2A3D6B14776037FB86017D6840B90DDDA2F5E069B59E130F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 da18c7d8258afc44e144ff8f6b1a7d1940c93efebb3a1fb21ed8aec15d3f826f
MD5 f299329bc5afd72b5ae7f293730c268b
SHA1 ef128d13ee82190da3b63c366d82dae4b9c134cd
SHA512 380bd34bd559d046fcd44e71c5ebb363d7b9ed98dd8a792d57b0b20d7c4e79f73a7f57b8d261c980c257f95e18dadd65d844e49b0fc158ca5a9a7c0fa70781c6
SSDEEP 768:nrv+4UNbdB3VwVpj/TBOWCuttDONXyer1IRCzni9Oqe:nbsbz3qX/SIqn1qe
TLSH
T15A03BF31E4689E238DE2A3D6B00777437FB8501795C44790EADB2F5E068B9AE130F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bda3c70671413d47a7c8ceb22029ca19ef84781e1d4afe666b58dcd9efffc552
MD5 febdbfd1264cbc3ec0008ba3185ebfc0
SHA1 a7402272e28f0ccd69237c2629633505e535d97d
SHA512 ba5040a51a176e68c9b85a002de83273cbb800040f45fdca5d6e5573c59c96713f69bfe739c8e80c9e29d76461117b9f43c3d08a16b77f9f4f8724382e75ad87
SSDEEP 768:hrv+4UNbdz38z/TBOWCutsONXyer1IRCzniB5eVH1SK7:hbsbV3EySIqneEH1l
TLSH
T1B803CF36E4989E338DE2A3C6B14773037FB86057D6840790EDDA2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 255fe32dfb03b0d2122b8a2cc069233d23659fdab37514ee55da1d2d55b2b805
MD5 bc91627061820a5b428bc74ab3b29eff
SHA1 232bd7ba06c4cc5de3eb2b64ccdb486f2a2b380f
SHA512 1a9614731c1509e8945c5f1d6395f168a9d713e66969a24719bf70fc49dcdf881c3b84fe663f59c26535f158c17504387ac8ce34b1c8cc6c4854212f897b95df
SSDEEP 768:sFZ3IzhV3MwgKwVJj/TBOWCuttUONXyer1IRCzni9OzPwsBu/:S3IT3k7ISIqn1RBu/
TLSH
T19AF29E72D494DE27DDA2A7C2B20A3343FFB55167D8849A60EBDF6F0E068759D130B806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 901f7fe9470a16173067b7a89257802c64f01fa6bcb0d0b13fc09bd6a81c0188
MD5 505d2caeed92fc906b40a8e7e5fa93f8
SHA1 268a177a4d2347dfc41ac923fbdb603532251f32
SHA512 6ded2a72b0ea8214db2527d2b79a1087ae49b3fe89cc09b9459adcbd67b03f7584d16d1837d63bd887fa143282f1e28ba51240151f7fd25fd46cf2394354e357
SSDEEP 768:k3IzhZ3MwVJj/TBOWCuttDONXyer1IRCzni9OzPwsBu/:k3IP377/SIqn1RBu/
TLSH
T13CF2AE72E4A19E238DA2A2D2B1073783BFB45117D9C45B50EAEF6F1E06C759E130F406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 63168aed932cc692ac59b10f449ad5b7abb471f81bb5ddd3d87abc36b11b6cc5
MD5 050346c9520774c9b8e5af805c0b13bc
SHA1 b7830bc4760fcb5c1356b15686fef93fe3042176
SHA512 080f608b349f763d2429cf297ead48c5a7d145893d9cd37d285a2e81b7a83f888ed48b1cc3d49c993d4a1867cafbeb89a7cb8d08206f83bd7dfffd2a0d1565c5
SSDEEP 768:t3IzhZ3JwVJj/TBOWCuttDONXyer1IRCzni9OzPwsBu/:t3IP3e7/SIqn1RBu/
TLSH
T144F2AE72E4A19E238DA2A2D2B1073783BFB4511BD9C45B54DAEF6F1E06C799E130F406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f5610d9-afbd-4d93-b8a2-d6531a0c8b49.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1f5610d9-afbd-4d93-b8a2-d6531a0c8b49.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download