3d9978d34937bd7828fcdb5825e7368de1d0eddc4da8847f3505c6c3ad27b374

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OpalCraftSMP-CurseForge/modlist.html
Size 454B
Sample260908-pkgvfabj7t
SHA256 3d9978d34937bd7828fcdb5825e7368de1d0eddc4da8847f3505c6c3ad27b374
MD5 47f9e6b4fbaacb2b54913f5564032781
SHA1 bfeb28b23cb440f8ac3070d3e194a5e0dd5aebbb
SHA512 2e41aafd1c0ac1abed0a8094e6680d00a6fba785b2508d4fa81c61f137e47775702694308dbeb8dbc7f23ecefa1dad4bfa5033108dba5ddb8e37a9d71df3418c
TLSH
T1BBF082B7DD6F7812672D927CD021760DE02391B78A0D8DF7A5B308437F80182081587A
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6116	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333438048992450"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{79F0C8F3-E9D2-44EF-931F-A1AB5D362280}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe
800	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 3196	800	msedge.exe	88
PID 800 wrote to memory of 5096	800	msedge.exe	90
PID 800 wrote to memory of 6116	800	msedge.exe	91
PID 800 wrote to memory of 5096	800	msedge.exe	90
PID 800 wrote to memory of 5096	800	msedge.exe	90
PID 800 wrote to memory of 1072	800	msedge.exe	92
PID 800 wrote to memory of 1072	800	msedge.exe	92
PID 800 wrote to memory of 3348	800	msedge.exe	95
PID 800 wrote to memory of 3348	800	msedge.exe	95
PID 800 wrote to memory of 4544	800	msedge.exe	94
PID 800 wrote to memory of 3348	800	msedge.exe	95
PID 800 wrote to memory of 4544	800	msedge.exe	94
PID 800 wrote to memory of 4544	800	msedge.exe	94
PID 800 wrote to memory of 408	800	msedge.exe	96
PID 800 wrote to memory of 120	800	msedge.exe	97
PID 800 wrote to memory of 408	800	msedge.exe	96
PID 800 wrote to memory of 408	800	msedge.exe	96
PID 800 wrote to memory of 120	800	msedge.exe	97
PID 800 wrote to memory of 120	800	msedge.exe	97
PID 800 wrote to memory of 4908	800	msedge.exe	99
PID 800 wrote to memory of 4908	800	msedge.exe	99
PID 800 wrote to memory of 2832	800	msedge.exe	100
PID 800 wrote to memory of 2832	800	msedge.exe	100
PID 800 wrote to memory of 4080	800	msedge.exe	102
PID 800 wrote to memory of 4648	800	msedge.exe	106
PID 800 wrote to memory of 4464	800	msedge.exe	107
PID 800 wrote to memory of 5836	800	msedge.exe	108
PID 800 wrote to memory of 1012	800	msedge.exe	109
PID 800 wrote to memory of 1012	800	msedge.exe	109
PID 800 wrote to memory of 4600	800	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\OpalCraftSMP-CurseForge\modlist.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffa8a2fc188,0x7ffa8a2fc194,0x7ffa8a2fc1a0
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,350679803586092259,6856995280732646368,262144 --field-trial-handle=2424,i,9985191886126155151,3878465326573964721,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,11518012862555247483,13478560296390963658,524288 --field-trial-handle=2424,i,9985191886126155151,3878465326573964721,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,15552038646128704867,17340014325173066145,524288 --field-trial-handle=2424,i,9985191886126155151,3878465326573964721,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:13
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3652,i,6241125860744842803,6060850054020053312,2097152 --field-trial-handle=2424,i,9985191886126155151,3878465326573964721,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3656,i,8395641447908124935,13749956942376694551,2097152 --field-trial-handle=2424,i,9985191886126155151,3878465326573964721,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,5549860227888006281,6797028604836974376,2097152 --field-trial-handle=2424,i,9985191886126155151,3878465326573964721,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,11595172417238657808,8645987070109974144,2097152 --field-trial-handle=2424,i,9985191886126155151,3878465326573964721,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:9
  2⤵
  PID:120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3888,i,1766188548898359386,3706633980701588751,524288 --field-trial-handle=2424,i,9985191886126155151,3878465326573964721,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,10652610372309131122,3711521275245578416,524288 --field-trial-handle=2424,i,9985191886126155151,3878465326573964721,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,14487508366676575363,671644986006532963,524288 --field-trial-handle=2424,i,9985191886126155151,3878465326573964721,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,14487508366676575363,671644986006532963,524288 --field-trial-handle=2424,i,9985191886126155151,3878465326573964721,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,9593139163272739257,14537542597648630621,524288 --field-trial-handle=2424,i,9985191886126155151,3878465326573964721,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,4527417962825952677,17708926191736866323,524288 --field-trial-handle=2424,i,9985191886126155151,3878465326573964721,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,6288145142911808727,15299378342756167020,524288 --field-trial-handle=2424,i,9985191886126155151,3878465326573964721,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,16768776104503486359,13351068768036188741,524288 --field-trial-handle=2424,i,9985191886126155151,3878465326573964721,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,1154974062118467150,4355404465432124883,262144 --field-trial-handle=2424,i,9985191886126155151,3878465326573964721,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

8eb97327-f5d2-490d-b60b-8fdf636c605a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8eb97327-f5d2-490d-b60b-8fdf636c605a.tmp
Size 11KB
SHA256 e3106d15d97c7671e92aedc3cc0b1e71b660bf28b064a35403e22a426f2b1e31
MD5 8f7d8f64c4e0056efea294cb2af028cf
SHA1 21fb604121d3e4e58677fb7d8e864497e071b09f
SHA512 c780f29057e1f76e4743ba82972b88cc6666d47691d4f0c70389cc0f3712c6be029b037566229ef754e7552531e886988b18037e44526a0daa92d0ebcf61206e
SSDEEP 192:sxRURmb6/f/scHYzWprQ5mzoA8p4b/g6+WNIYn8U8hLGXIgDDBJ:sxRUa6/f/scHYzWmW/5ITXynL
TLSH
T1383295166A28A83B8CC7D21DFB55BF53D6F96032B1D56E48A6FC8A1C04E76CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0849e4734c4ddf6d8190ee24ccaa62585793d43b84d4fea90eee255560c5a7ef
MD5 7a02f4d98ab12524fe8dea957b21cb85
SHA1 b5fe6360af020e43a0518dae936f8b17a114610b
SHA512 8081bf83d13e9dca67acd02e660bd1c4e818977d5e80c9544b9a89f7941f1f9ac9139229d2a5cdb2941ada0d2acc3fde941a818f1fca05d069c6f07587397ffe
TLSH
T17461415963210EE3EBE5C9F196E0B48831F78C61450BAB3A4293ADF068AAF7851DC417
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591b7d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591b7d.TMP
Size 3KB
SHA256 6f25d7e0ddd53671b93a52eae977a50a93e505b5a9776894d003b7405fe25111
MD5 ce06cd75ab6eabea8fd1f2e84c6004c3
SHA1 696b2575b6ea903fda39e1f69f4554558c0f22c7
SHA512 19ac4bbd1a094a184b9259d8908f0ebb2ba31accf4ac81a2ee45f6ffabb3c8522634c4161db26513efb99f62cff62fa6d91f803a4911c68713948811bc8f587d
TLSH
T12F61415963210BE3EBE5C9F196E0B48831F78C61450BAF3A4293ADF06CAAF7851DC417
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 12901a54524a0b96898067f9eb9531966b73e63009f7ae5deaff6bab8fddf470
MD5 02d70946346e5607e8aad3d95cb7e0d6
SHA1 61bd5f0ccb92fbab49e4f63f131ccf594603d914
SHA512 5425e6b32f3b85f937f70c25067775f7c9374851ae625c6b8701122bb64ce4dec07bb546bbb85e2be656f7587cd531eb43040e3881d93d9b4279de76067e2fe1
TLSH
T1E931A0F783F4857E8A0196F0AA14AE2FCE1D0511431C7C69C5E4AE2793F3472E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f77ba3c9dd2e943c0eef1c5ef3e5d23999b166cf6bc77812858f76eb9c984f27
MD5 0c39f939d97d2dc7903398570a08c2e1
SHA1 19ee49cddb3b9b86bb3f41c0fd6cab5ea9716060
SHA512 d70c6d9f1c637fe5c0f2694c1dae5b8a7c9c3d698a652ac364e6300d1160746b718133a02ec480d0452a7d2f177ed166ddd8e063d32ccbb2b33167077dde9da8
SSDEEP 192:sxRURmb6/f/scHYzNprQ5mzoA8p4b/g6+WNIYn88ehLGXIgDDXJ:sxRUa6/f/scHYzNmW/5ITPyn5
TLSH
T1A232A7166A28A93B9CC7E31DFB55BF53E2F9603271D56E44A6FC8A1C04E76CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f35dbe7b6e6fbea024050373ea6936b81b7714a7cab04ee4ea33567ce9ff60e8
MD5 c6e5cc470081912c757788cb55d2841b
SHA1 6661ea53ced5b3668886a01cafdbd2badd6f6bc3
SHA512 3a40ff8e2fd8c4c06fb40e987ef21e5ced580bfd9e09793a3664fbedde7501a5ad620c9b24449f56a57bad10a4143072a1932734996b132c5cad29b1cc5d8281
SSDEEP 192:sxRbRmb6/f/sbYzWprQ5mzoA8p4b/g6+WNIYn8U8hLGXIgIJ:sxRba6/f/sbYzWmW/5ITXys
TLSH
T1D03296166A28A83B8CC7D21DFB55BF53D6F96032B1D56E48A6FC8A1C04E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 33ec890bca53a053455c8743efeb663c90dfe2f72c23ee7614550dd05e2039c9
MD5 418cf895cd94e8bc5c95939643d98516
SHA1 43fdea23dc00ab2aaea97734b8f7d669e3e16df7
SHA512 1139f277c7c3d79e647e9a9a954d9f45b9d89fb2ea6552809a420b29237acc18c8cd9a48c25fe88704aeb23def18c1e3142fc74cd3c50e5bb7181cebd656b78b
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRP9rohMd:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0VE
TLSH
T19DB2EC3B604DCB7E5F800AADEC19AFDB7D5802C79A988D4447FE990C02C77EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 faea3212be281e0b48e5e8384ddc2c19a50e11f4e7d02371dcd6d7843ddfa3a7
MD5 8b19579443d0578f836435ec6b42ee5b
SHA1 09ee59fc341339a8e33c1c3b309d68a937c86e23
SHA512 3639a2dc276654c06b3e6b18c54df7b75c7d1005a5c490a59b720032818e8a129818cc9b3e490f7eafda1f474a090fa8aa8aa5b3dc8dc1591dc38cdd6654d686
SSDEEP 768:Jrv+4UNbdZ37rFJZDZIO033+Nzc4ReyIsPsZD184peC:Jbsbf37rFrtc44bsEZWHC
TLSH
T1D403BF32B8689D63ACEA9286F50776437EF8615B82C81E94C6DD2F4C064B1ED171FD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 86c158aeb43b96d2934fa02d0c4cfb3fc1276005ccea36bb2e7d398206162872
MD5 422d38bca93a6d366dde6af2a782b1db
SHA1 a58e058b244f08080fff62f962a3eea81a1524c0
SHA512 f167cc9f581728119e72146dc61f24a82316aa0984c810f0ae21680ae4d34c9eb5b1d2c28c257139c4df2a526aabeffe0e45ffb5f38f22f3f0ae47b2734ffde2
SSDEEP 768:ev30FFZDZIO033qNzc4ReyIsPsZD184pes6:ev30Fttc44bsEZWHs6
TLSH
T1CBF2BF31BC659CA7ACEAA386B6073203BEF4A117D2C86D9485DD6F0C054769D035FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5b2525bc88b4b0eb94c79027a066179b69982fcd281ed2870efed2759c980007
MD5 8e0d43feb306fc9d239048139fc7d27e
SHA1 705115605345c9a6a11d58f6ed038afcd0239a7d
SHA512 b4dfa26a433eaf982385d152026c02498859dea16c985e5ddaf2e2387554b3030fcc12434f0655e60625922504c79d7c13214819b3427090ebb6412af76344b8
SSDEEP 768:8y30FFZDZIO033aNzc4ReyIsPsZD184pes6:8y30F5tc44bsEZWHs6
TLSH
T154F2BF31AC659CA7ACEAA386B6073203BEF4A117D2CC6D9485ED6F0C05476AD075FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f769e33fe2332ddc14066b32a369f282f246e4f74457670131d09fbd8c2c37f4
MD5 1771baa53bec528778b2a834ab028d99
SHA1 cfd1be2b9b0eecd0a07952c51b11b5f123e15cae
SHA512 9cac5a963f319f4d9c276978d41d215b4ece043289439effafac6508aa4d18f08118a258009958fc14703164bfe9c6efbb69e4915b57c15e4c46eeb62dc656f9
SSDEEP 768:5rv+4UNbds3YvDZIO033xNzc4ReyIs2sZeVH1S5D:5bsbS3rtc44bs3ZEH1Y
TLSH
T1A903CF32A9688937ACE69786B54775033EF8A11BC2C81ED4C5DE2F4C0A4B5DD035F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ab34d9ef9028905d69f7d0f6eb38515f1fa9048cfb07f3eb68bcb07ee386e304
MD5 6a97c2903c3eff92ca698b517f41f570
SHA1 826cfbb6b7a33e3a2b91029f3a1f20888bd592e7
SHA512 133506eeb71828da5bec77955ed41f7c06cd0276be7eaa9ec72723e22896de453cdb8149a5a2ae5800fa1e4d034e109ac19044ca4a98a8b8557e7cc9acba7522
SSDEEP 768:6rv+4UNbds3DHDZIO03SNzc4ReyIsXveVH1S5D:6bsbS3Ftc44bsfEH1Y
TLSH
T10303CE32A878D977ACE6A786B10775533EF8612B82C81ED0C5DE6F0C464B1DD135B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a85e83db-6186-47ae-9b28-cb548c27f2b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a85e83db-6186-47ae-9b28-cb548c27f2b7.tmp
Size 33KB
SHA256 015d6e46174fb35816027d60497b7dabd71f73e51ae5431bc7c4c9defc945749
MD5 516d1d549dbc98e2a41fd7270f4350f8
SHA1 707d2f6c1bf1e3259295f9a2b80762a3dd18d6cd
SHA512 fb518936b94fb5a3dd2c6499be863230d5828acca59a06a1a24b91bad3e459482d6c26b989f769871b78d8dcdaa98a5c3fff25c55276521ee058c31d1ba05183
SSDEEP 768:/y3RFFZDZIO033aNzc4ReyIsPsZD184pes6:/y3RF5tc44bsEZWHs6
TLSH
T1BDF2BF31BC659CA7ACEA9386B60732437EF4A117D2C86D9485DD6F0C05472AD075FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5872d476-14dc-4f3d-b75e-4ca52405623b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5872d476-14dc-4f3d-b75e-4ca52405623b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download