a2d9e98a3b33419fd85d25f5aa874e5e3da1afa2fde610de12d2858d58d1496d

Analysis

max time kernel
900s
max time network
734s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/09/2026, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
poopy-main/poopy-main/packages/lua.5.5.1/build/native/doc/manual.html
Size 384KB
Sample260907-g87f1ayvby
SHA256 a2d9e98a3b33419fd85d25f5aa874e5e3da1afa2fde610de12d2858d58d1496d
MD5 7151b5e0dddaa5be927118abe59db049
SHA1 b0df5995c596ea28962bef47b23c85a4cbc68b85
SHA512 9f5e486c53160b813359849cb648042c78e59fec01cf0998f464d3df1258108f2f88818b0187d762c2f1a3edfec5f3a1ec9ac88dc2d50e6020031a111cc2aa5b
SSDEEP 6144:irSwIQeE11yi6wOUuXmB5A6zvPadX9sngNJiWt6GDfKl1OahX9LcJlTmzULTLmUG:iFM5ySVKZX
TLSH
T17684A61DE6873BB26591A3AD954D38F8FB6F80A8F92612E03C5C871B2765864013F7CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1844	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332362895210919"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{84F64BF3-8CA9-4EF6-8B16-1D6CEBEFC0F6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 3260	4196	msedge.exe	80
PID 4196 wrote to memory of 1844	4196	msedge.exe	81
PID 4196 wrote to memory of 4532	4196	msedge.exe	82
PID 4196 wrote to memory of 4532	4196	msedge.exe	82
PID 4196 wrote to memory of 4532	4196	msedge.exe	82
PID 4196 wrote to memory of 3484	4196	msedge.exe	83
PID 4196 wrote to memory of 3484	4196	msedge.exe	83
PID 4196 wrote to memory of 3476	4196	msedge.exe	85
PID 4196 wrote to memory of 3476	4196	msedge.exe	85
PID 4196 wrote to memory of 3476	4196	msedge.exe	85
PID 4196 wrote to memory of 796	4196	msedge.exe	86
PID 4196 wrote to memory of 796	4196	msedge.exe	86
PID 4196 wrote to memory of 796	4196	msedge.exe	86
PID 4196 wrote to memory of 2932	4196	msedge.exe	88
PID 4196 wrote to memory of 2932	4196	msedge.exe	88
PID 4196 wrote to memory of 2384	4196	msedge.exe	89
PID 4196 wrote to memory of 2384	4196	msedge.exe	89
PID 4196 wrote to memory of 3684	4196	msedge.exe	91
PID 4196 wrote to memory of 1188	4196	msedge.exe	92
PID 3684 wrote to memory of 4468	3684	msedge.exe	93
PID 4196 wrote to memory of 5036	4196	msedge.exe	96
PID 4196 wrote to memory of 2356	4196	msedge.exe	97
PID 4196 wrote to memory of 2572	4196	msedge.exe	98
PID 4196 wrote to memory of 4760	4196	msedge.exe	99
PID 4196 wrote to memory of 4760	4196	msedge.exe	99
PID 4196 wrote to memory of 4924	4196	msedge.exe	101
PID 4196 wrote to memory of 2248	4196	msedge.exe	102
PID 4196 wrote to memory of 2248	4196	msedge.exe	102
PID 4196 wrote to memory of 5384	4196	msedge.exe	103
PID 4196 wrote to memory of 5384	4196	msedge.exe	103
PID 4196 wrote to memory of 772	4196	msedge.exe	104
PID 4196 wrote to memory of 772	4196	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\poopy-main\poopy-main\packages\lua.5.5.1\build\native\doc\manual.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffa11c0c188,0x7ffa11c0c194,0x7ffa11c0c1a0
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1676,i,18116636960768539456,5015762438290956110,524288 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,10964139404801075120,17335903221086286518,262144 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,9884080820088148288,5354000231955194980,524288 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:13
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,16623656386701840283,10488188066868383919,2097152 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,16020026491251203506,2801918475408854164,2097152 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,2609421649396925675,6920235937307882775,524288 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,808868264715571557,3496044665013691099,524288 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,3850084454096402691,11608646335418308657,524288 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,6754385342276433442,4866563359638983568,524288 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,3850084454096402691,11608646335418308657,524288 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,18307312048391772057,8842024834403459904,524288 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,14911610208768286010,12407730984534080817,524288 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,18366582699650459778,11458356339368398624,524288 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,11540559613741824997,4515047975499948091,524288 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5924,i,14612859892289031167,874781959962147449,262144 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,4860155597332937349,12814448827217228283,524288 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,12735715780856764977,1125839526826451295,524288 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:14
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,15743935390523728045,16416865341533463322,524288 --field-trial-handle=2072,i,7964190374487883904,5913793834861087153,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
  2⤵
  PID:772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

842dbaeb-0ffd-4b0e-87ee-ff814cbfd2cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\842dbaeb-0ffd-4b0e-87ee-ff814cbfd2cb.tmp
Size 14KB
SHA256 eef7cec2d9d933bac152dacb73c122ed04efb2fe6d9b5630360b7bc4d7c83dfc
MD5 4a786e5f5e0598796d2fce14ec98a6fc
SHA1 905a7725ec7941ab44b3139d35da03c2ac2ee16d
SHA512 9dbd962e2f175005e10f2cab1136582f25a182179880f87ba7ab2aea375e7cf1989cbdf4976b3a86bbf681f39038dc681789d4152ace24446e30ab35785f33da
SSDEEP 192:sxZKRqyMqZjK1Ml8MFK/fFsiuiKQ7PM0AzodpEJ/W6+WNGY0ZYQl+kIgjJTJ:sxZKbdK/fFsbiV7U0jc/bG5vTjJF
TLSH
T1F96209156A785937CCDBD309FA457F93D2F91573A2901E44AAFC8B1C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f8e1181cd289abfd85e41b83a7a3750dc2b8c01689eeb98b3290bb6f7b9bcf36
MD5 867f71ba2af70ec4f29533318d8bfade
SHA1 8e8c08807995d5d8c460dbc8728bf1e1f776d273
SHA512 b664eed6d2276198a3411d89de4a29dcadceb62f6bce2e7d185891dd9a2d97eaa53ea9ac973bded08798db3e76568a22c81436b6a71ff9702b65af497cfea51d
TLSH
T1A6E0204405CCD25D5604654747685B0CC3C43B1E97CC9F7527058DC871050C2F7F29E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6124ddb2c4475ca6805a80ba46c89e7131f03a56a1d22b027765367bc7bf19c6
MD5 37657aa23e24e1e3dfa11df7d51f90db
SHA1 1e7df2aa2ada8ff48ba39ec5b2899d10d3979a5c
SHA512 55b8d6d998a79998386f1cb7a1128e1e575d951d9abf13e71f387fb40c3afd0cfd2609cdcce0b85e214a92850a98dc4f314e37781cb0ed6b760f58557032145a
TLSH
T13FE026C408CEC31E9778654B4A684B0CD2C03B0AD7CDAA6A37008E88B0024CAE6E7DE0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 12c8dc70763800299b69079861d1c627b3bc947c2532f6e3a2acf400b3144525
MD5 6d418d938c5108fb60b45cd68a712b45
SHA1 f00b2563db89b8f6cf03a7a62dd12b50a8cf360d
SHA512 d67876f13bfeb7f57b17ad1526e593ed08b4929038dad8094ebdb9bf08ae91c44eb40b5755142034839da53d7210dc20990fa12a135605f4a7675464dca5a631
TLSH
T1A6E02BA5D8629C2B09FD071968501A45D74553373E41594F373C820D8FF463E459AD1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 944ece332a32e6a57329c30e2827317e2e540a553647ea1210b9d3dc24be00f3
MD5 96aec1daa61d7e95747c0b1db724368e
SHA1 aa04b54c30e7829e07db1460ef5bb35891a22776
SHA512 4c2c5673f88aa100847ea639d4a839c0224f49c1e857bc25dc0f8c2284e4bf690a2caaed1d5ed8da4ae29702cca0304189d9e1ddf7c91f68cf34f1e88f8c39f3
TLSH
T1B631A0F783F4866ECA1196F0AA18BE2FCE1D0511432C7D9A85E4AE1BD3E3471E141B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 eccc44f415c7246ba40877f3a451de0c42ec2e66a7cc382fc5ada54f0dd1f341
MD5 63fd85d45f777e7e7941db1545f5aba8
SHA1 adfd12044fac92e3d0aa6cbba924e2a9c7aa6d95
SHA512 62bf380abffc4c712022b8c02abb1ce9a621f52868c1af6e1e2c490b6a194c25f7c0563ef3a857322c15a5a792b47afff087ceaf22840922996f7e89ca42e362
TLSH
T1D031AFF783F4856E8A0196F0EA18BE2FCE1D0511432C7D9A85E4AE1793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 35275fb34f2fe14081bdc885b827051f4971acfc681261516d2718ff4f6fe1ef
MD5 48f8326940faa4b395953749f55ed0b6
SHA1 2d4d57f4b715834e5eb1598f6a61f00e8522d5ad
SHA512 7d3b6b38c8cadff062835274fca5f06d21ba91041aa3df2f0f718bf13719faa9cfa7beb9cd5f6f2f7cf9ed55a50ea0d431b1f6592d2f953f0188d5e3f79036b8
TLSH
T139C0126181B9E5F6107599F95D88A8C1B7BAD435014198B0DD95837C60940FB5B12129
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 173a441673ece6026e4fec1e27446bcc91d681b4217552238f6c19151fd74ff2
MD5 3eacfc190d3e2eca0ea39f93d010d911
SHA1 de4f1ed329da1d5130c365bca64ae8807a3bdfe0
SHA512 53a8fc3bff56063d195533db1b1708548e8ee26c16b6733c81f15c89c70c23e904117ad5ab23ef2ec3c12bca2aedc31a999b3dd440f6e3ad1fea8f32def9f1f8
SSDEEP 192:sxZKRqyMqZjK1Ml8UQyFK/fFsbuAKQ7PM0AzodpEJ/W6+WNGY0Z5On+kIg5dKJTJ:sxZKbq4K/fFsiAV7U0jc/bG5QTSJF
TLSH
T1EE6208156A78593BCCDBD219FA857F93D2F91573A1900E44A9FCCA1C00E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 0dc0fb9144ea796d9550509428b3774afe788a480b5de36b3fa44af52d7ad8a4
MD5 a9d7f872b5a853cda67e2f78e6f01514
SHA1 526b636c3658443e2952d90146568b34eafec42f
SHA512 e79b80e2dced729501c6fb3ca5ae9fecfce52ca7fadb9733663d0de7e5160816f55a9f8fe090a8e73008512467c3e05f910f9f57513e1feb06c1bc78d61fa041
SSDEEP 768:XwZh38Dv2aFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV309Ll/lv0bzkro1o:XwZh38Dv2aFWRm6GQFmu1jaK09LplMbC
TLSH
T119E21B3B280CC77E4F844E9DEC266F966ED802CB66684D5447FA894C03CA7EF511B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e3261215-22b7-406b-8278-602ec1f49ca7\index-dir\the-real-index
Size 72B
SHA256 b20890b6a69fde0e209315919d1ce31bcfb614f180336acfce76cd36bd26c09a
MD5 f7108d7352af4da2f40e29a975bdbf9d
SHA1 943b2e6df0c129879d2e2e1667372a398b675c5b
SHA512 cadc756124a6a78650ef5f3ba826366b9aa2fffaba0a0be38e9092428f4f840fbab2700aa8d01f666cd08105209d86f26489484fe2db1dec1af75568f0b77102
TLSH
T199A002546941095BE6480271694235602700492A4290667246E00B44BA6748B8351811
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d25bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e3261215-22b7-406b-8278-602ec1f49ca7\index-dir\the-real-index~RFe5d25bb.TMP
Size 72B
SHA256 ab110f24ae43e2d336fd653bbc513470932bd984481295c9623356e9ad53bf8e
MD5 e2508a24dddd75d89c50fc0a99c25aa1
SHA1 ad2f05f7963d560d2a9cbfd199a4e975c8c5a5ee
SHA512 661dc5664a406ef6da41136b139860892f90c7b43c9d547c0adbd49e932b7c7396163cbeab177139131032df49c8af950b35ace56a16b82e8b1f84b37ce95080
TLSH
T1FEA002D857453149E22203745942D2746702897940F5563246E107449CE68464732811
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 64722d8de178833bff46f3f419b314121688ebc92588a26beb4a1f1b7aabee0c
MD5 52d920d5a918e796c1ea3827273cdb0c
SHA1 720257443eb9408d72efa325ba9d3259b5b3813e
SHA512 239f99617d4c49bdf7dffc0e6bd60761eab49127d9174ab236e75345fa1df866c264321a3af4abb52a670e1a1966eab1481ab8a8e66ac31bb2489af2b42266a6
TLSH
T162F027B76DE63D25FE6BC7E1103105B5041579A6C910AC6F102EF29690A1B692899CB2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ad78e572034768bb8b69dcaacdc1fa49131fbd83a61ab26517dade21e2b64ba3
MD5 bd8c6f44cf1e21bd60872e234586f6b1
SHA1 df9bfb187baab236f2593114779a7a59f506c429
SHA512 84f01a8a3ea58646541e702c587a7781cdb6784def142af9dae3edb472200857234bf1e5f3852b772a03252cb74a33122c909a563c9cd387fc1316d088c1a61a
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjlh9/X:ctGj+BCNC5qFVpKxhFX
TLSH
T103B2461632BA02023C7E791D879597371A42B2B33058E93B7BE854B64E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 250c0608dc2a9af7c8b7ba30133de47b701ee1528f470ed6a3c8c8f64b27f309
MD5 4b06311cfb1a5b8ecf3fbbbe91f15256
SHA1 122d138bdd73eff84e28259c1810727aeb175ff4
SHA512 fb3fcd157bfe0be4b64c330d002c0aa345370e2d03e18611b792f120b776c793cad53fc0488721a471095ef8b642c2454cc349dfc7f2cb04ef59e16f8684213f
SSDEEP 384:nOiFvZcIu38Nu8TUNTUlIR+Krk6HK41ifbMorrmViv5in+SZGy+j3OJy3v8Pty/C:lFnu3JwgibUo+Mv5i+WNMeJy30hz
TLSH
T158C23A32EC94CABBACE68BC5A74A3647DEF44163D68C9AC4D5D91D1D008B1ED070BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 51e6fc02ff59ccf4683e2e6cb61c3a8ae9094ffc19f29346de5ede31fa91b5f6
MD5 61702aa4718611f41c301975149ae967
SHA1 d9b812cbedd89116a2f317a60fc32bea7e3f7730
SHA512 eb3db78e615ff51f51854361b07aa3be1b2d34428e6b9528411b34e1392f1d5935e1f63f26d15a93fa9866df79f7754b6e37751a72433789a24220311c2d9edc
SSDEEP 384:nMiF9CcmyWCs38NS8TUNTUlIxBrk6LIZV1ifbMorrmViv5in+SZGy+j3rRyHvuTu:3Fccps3Zwg4XZjo+Mv5i+WNM7RyPuTQB
TLSH
T1A0B23A36EC98CAABECD74FD9E74E3547DEE04263C68C9AD4D9C91D0D009B1AD170B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 62e39e8dcb8d304a38d06cedb85cb27789c718a5033683a05e33127c3f065672
MD5 71ba1c3eeacdae28d96eda38473e1526
SHA1 f73b7931e6a3040d8b5b339dedfdc2ea68a95b9b
SHA512 f00af02655c2112fc3e2f1d0c3c628890a3b9877fc8828d116007797ea472ebdc58728efa5eb741f141b165f3edf647d772e439fcb570cf914ee37f77eb81099
SSDEEP 384:nTiFUCcmyWCa38Nu8TUNTUlIRXrk6HK41ifbMorrmViv5in+SZGy+j3Cdy3v8Pt0:+Ffcpa3JwgKbUo+Mv5i+WNMSdy302
TLSH
T194C23A32EC98CEABACD64BD9E74A3643DEE04163868C9AD4D5DD1D1D008B1DD570BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a647cfff003f085b8a55799755bd0a80c57e164b32e1ce7570ba720d0aa4af7e
MD5 3c9bc679c543472e43ab9cd1ac14f319
SHA1 1b1bee895cf3062f6716a1d5810f479cca003e59
SHA512 da0948d19a6ffae783248485ef128712c5d7f908ff952640143618e23a8a0e062d838d8656838ac7857d85be8cbb44849c6381dcd61fb720f40131303b0d838c
SSDEEP 384:nTiF9CcmyWCt38Nu8TUNTUlIRLrk6cK41ifbMorrmViv5in+SZGy+j3rdy3v8Pt0:+Fccpt3JwgKaUo+Mv5i+WNM7dy302
TLSH
T16EB24A32EC98CEABACD64BD9E74A3643DEE04163C68C9AD4D9DD1D1D008B1ED570B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 cd65184702da91d8403629b12e632874a10a849760617752a16548a5ef48a8c6
MD5 c3fcdc11d7ac2491e2ea177c401b1313
SHA1 258789c847aa1e6622e840823191ffedee512b58
SHA512 9bf8b91645040b18397f35ff607e3ec03c9f1e18f0c50dacc13faecb10fd529c254562d78a75f2cf30e1509ae707203228eb550bca7ac8e776fa2494f7644b24
SSDEEP 384:nMiFvZcI038Nu8TUNTUlIR+Krk6HK41ifbMorrmViv5in+SZGy+j3Cdy3v8Pty/C:3Fn03JwgibUo+Mv5i+WNMSdy30hz
TLSH
T1B1C23A32EC94CABBACE68BD5A74A7647DEF04163D68C9AC4D5DD1D1D008B1ED070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 58b84f24e7c9821c79afe9d9f50e0ab444c2ca17b0d7b8c6da753030a0a150ad
MD5 233136fbeacb4152a679484fc90fd067
SHA1 5bcc1c666b579914c09d8228dd8c3e7b7adc55ef
SHA512 3935806a8f47a9c8bed34f817d228eea511420049c64c6380d2d61e7b9257e47cab10d8e9b94f4fba6e6a304fc60a84d32e40dfbc8ed4e90360db5b1e1d9ca85
SSDEEP 384:nIiF9CcmyWCs38Nt8TUNTUlIxBrk6ovnF1ifbMorrmViv5inbS5HvuTQwty/7IgF:TFccps3mwg4znTo+Mv5ibS5PuTQB
TLSH
T105B24A36EC98DAABEDE74FD9E74E7643DEE01163869C9AD4DAD80C0D008719D170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1188-182-0x0000023D8E670000-0x0000023D8F670000-memory.dmp

Download