hxxp://tgcigar[.]com

Analysis

user interaction
yes
max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 22:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://tgcigar.com
Sample260916-1923fsfa34

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5420	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340709252026692"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{F6DBEEDE-2E3F-4FB8-8AF0-90B8D049980D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 4756	1624	msedge.exe	87
PID 1624 wrote to memory of 5420	1624	msedge.exe	89
PID 1624 wrote to memory of 4180	1624	msedge.exe	90
PID 1624 wrote to memory of 4180	1624	msedge.exe	90
PID 1624 wrote to memory of 4180	1624	msedge.exe	90
PID 1624 wrote to memory of 2528	1624	msedge.exe	91
PID 1624 wrote to memory of 2528	1624	msedge.exe	91
PID 1624 wrote to memory of 4688	1624	msedge.exe	92
PID 1624 wrote to memory of 4688	1624	msedge.exe	92
PID 1624 wrote to memory of 4688	1624	msedge.exe	92
PID 1624 wrote to memory of 2928	1624	msedge.exe	93
PID 1624 wrote to memory of 2928	1624	msedge.exe	93
PID 1624 wrote to memory of 2928	1624	msedge.exe	93
PID 1624 wrote to memory of 5320	1624	msedge.exe	94
PID 1624 wrote to memory of 2112	1624	msedge.exe	95
PID 1624 wrote to memory of 5320	1624	msedge.exe	94
PID 1624 wrote to memory of 5320	1624	msedge.exe	94
PID 1624 wrote to memory of 2112	1624	msedge.exe	95
PID 1624 wrote to memory of 2112	1624	msedge.exe	95
PID 1624 wrote to memory of 6000	1624	msedge.exe	96
PID 1624 wrote to memory of 6000	1624	msedge.exe	96
PID 1624 wrote to memory of 6000	1624	msedge.exe	96
PID 1624 wrote to memory of 5652	1624	msedge.exe	98
PID 1624 wrote to memory of 5652	1624	msedge.exe	98
PID 1624 wrote to memory of 2704	1624	msedge.exe	99
PID 1624 wrote to memory of 3332	1624	msedge.exe	100
PID 1624 wrote to memory of 2704	1624	msedge.exe	99
PID 1624 wrote to memory of 3332	1624	msedge.exe	100
PID 1624 wrote to memory of 2888	1624	msedge.exe	102
PID 1624 wrote to memory of 3664	1624	msedge.exe	105
PID 1624 wrote to memory of 3664	1624	msedge.exe	105
PID 1624 wrote to memory of 3664	1624	msedge.exe	105
PID 1624 wrote to memory of 4816	1624	msedge.exe	107
PID 1624 wrote to memory of 5128	1624	msedge.exe	108
PID 1624 wrote to memory of 2036	1624	msedge.exe	109
PID 1624 wrote to memory of 5480	1624	msedge.exe	110
PID 1624 wrote to memory of 5480	1624	msedge.exe	110
PID 1624 wrote to memory of 4652	1624	msedge.exe	112
PID 1624 wrote to memory of 4652	1624	msedge.exe	112
PID 1624 wrote to memory of 3828	1624	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tgcigar.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffd604ac188,0x7ffd604ac194,0x7ffd604ac1a0
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,14660238491548139526,898737902759715130,524288 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,15679645281441120692,17570035022025064944,262144 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:2
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,7358271717466288486,15370745124903925788,524288 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,1241850561925255830,13425517028925502199,2097152 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,4128840923242757865,8294132287802886494,2097152 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,17480010189168110907,17756813204758324490,2097152 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:9
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,13571807344079045109,11085302243101479323,2097152 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5312,i,10570911997551206660,14606445446080644285,2097152 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,5740272214081176869,728870328412383813,524288 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,2991446857755959437,3589974871909103569,524288 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,7090488970157520423,14667633063542288575,524288 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:12
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,3137681645579974599,9495160641291233222,524288 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,3137681645579974599,9495160641291233222,524288 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4856,i,17123103921134918628,16416484434092014518,2097152 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,8586507977351663242,2271226329140740075,524288 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,14532604635259322436,1686410574509673410,524288 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,5115239308829650482,7264024782446860953,524288 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,332742670414467810,10248282675376911918,524288 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,987669666315352262,6011864458325111934,524288 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5448,i,14670762346168043643,17367842524236128214,262144 --field-trial-handle=2632,i,15307028963577111022,17112282590783358304,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 276628d00ee706f777b0c4775de5cf9722cadff5d7dbe4860d15c8fb62ed4918
MD5 7f753d3c6b1ccc54c34db5ddaed79eea
SHA1 da5a9fa3b1b15346e68dd60408dc999a514bb1e0
SHA512 5b5857641bf2f8d5f1fa44dd487c48317b1c53953d866bf3b880bff64579f945a8920c21ca6809c39bcb9bcb7334038610079eea82806a504a9d54eaefe64746
TLSH
T11BE026D656E8C32EB680B54B426C4B8C92C1770AABCC6A9A5700CC867001640BAC3AA8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ae5e08c43b60db163d317ba14bd384f6c6ad299ccc8c14eaa33161411234b018
MD5 e3aae58ac9372020ca95d67008ecfdcb
SHA1 6c1985ec264309f3a17212005e7753f2a55e3ec2
SHA512 a2ca849e317e54161f3fb6a1ba428d7dd692c164ad5a031eb8042d0604f8f5e839c0e10685165bdd16670b36c55083761375fec2ee4a2fc7e32c0538cdb81144
SSDEEP 96:pfoYWA4c4Ffn9lm/BsS5jEOjf5qg1JxSEfl1szTNkecmoyV5vSa32BhZJrPuFRIs:pQYWv8zBre/RNh
TLSH
T1E281CB614F968016FB8C237799C62C873F36646F7D478F0323D6D934641E3B8AAA44B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59c3c3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c3c3.TMP
Size 3KB
SHA256 6e7257a2f438caa5c2bca87f0f0c992c98d29e675d65f17d649b9161febc41d3
MD5 b0092aeb955f1e2e880728716e48aacb
SHA1 a951ac2579a2f9a29d0368250dcafc4cfd776b75
SHA512 b5e4a6ea4143b981f552158c84dd600e02f0bec5c6f4fbfd3baa99a8093050744923db4064af0145e463668d82501d2a806c96de788b7ee5ac0c3e91cc1d4d98
TLSH
T1B56186654F669019F7D8037395C12C873F3665BE7E43CF0223EAD6785802339B6440B4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 a193c0d44d29e5ee6cd7468e4e2c454c583e5ffce9bcf513f550325b4078e4d3
MD5 196cb20c8945c4ebe6c278733a6c94a5
SHA1 d12618bd158f2844307697ef00bd8745031594b0
SHA512 c488978dcf2f78754b2e05bcbb9d168da9f7eaa9ed8f4a0b4c815aedb5f89c59455d9bff42643089092816a59b8016f8f47058836e801fdd00cd7c4c9245d0f1
SSDEEP 96:DUOu+yEu+Ku+qu+tu+i9aXFru+Urzzu+qu+Wvu+3Uu+4u+p9Gu+8u+Iuu+Zku+ru:DfSEqKNC9aXFrMnKWEYrGcou5kL99IzJ
TLSH
T1E3C169F3C3F8872DD90252F4B6142E2BCE6909A483683D67C8D5AF0B97E18B1D24165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1ecac028b28086ef4e88c6ae63b7c7c52be00e9fe19a02494c814e91865fd74c
MD5 72957cd496e4fd3000d434b195ff3f32
SHA1 7ec4b18654cc7eb518502ce896027018aeb02374
SHA512 e81449872528d246d4877380aee299406b02f745716e5d05f08835edf9b050b48f2073cba6cf8a91da30946d25de5132cced654acbc37cd42622640d0e4877ae
SSDEEP 192:sxRNR4bf/fqs5dizoA8pMF/g6+WN8CUwXYo1BGL0IgDzJ:sxRN0f/fqsLvs/51Xe4h
TLSH
T1C332C715AE28A93B8CCBE20DBB55BF53E2F9503260D11F58A6FC8A1C11E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 800281385b1bba5fc4a06b7779108f518c5b0afd5d62a52b950190fe770bf9cf
MD5 1640cd4c537517c9041fb1835a0bad63
SHA1 ddd7cece84c0ccf9f001f3007c294b4e85cb7412
SHA512 7b3e17ffa0ee26087e78345d484fca633bf58348364cf5e74042b493057171d96e34c4e982f4ac29007c6177e4c4a8a92f4a7f4474127d88555d924c5066ceca
SSDEEP 192:sxRmR4bf/fqsldizoA8pMF/g6+WN8CLaX4/YosBGL0IgIJ:sxRm0f/fqsXvs/58X4/h4s
TLSH
T12C32A6156E68A93B8CCBD20DFB65BF53D2F91432A0D51E18E6FC8A1C15E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bc59719f6a65c875bf42c589712a07f60055a124cff646a8b2c951a040e612ba
MD5 e80a008933d652e561b458d39d3d6e6a
SHA1 5f3cf49f2e6e35bea2270592cadfe88a06340b8a
SHA512 8d341bfa02663405c3d1d20144c8bd090d7a792bfb5a53e50063d42848e6ebcf290c34a03f05daa8c5c20c4637eef6a6281492967573c8fa0170dcac1cadc622
SSDEEP 192:sxRNR4bf/fqs/dizoA8pMF/g6+WN8CUwXYoBBGL0IgDdJ:sxRN0f/fqsFvs/51XS4j
TLSH
T19932B715AE68A93B8CCBD20DFB65BF53D2F91432A0D11F58A6FC8A1C15E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 35eb49e7f4263657699ae9aacfc767de2df42b4795da15f07f8587663c456d14
MD5 b799ec88d60a41c4cacd436d16e2bd7d
SHA1 efaf4bf68339b00a013151396b92d347f06cfb06
SHA512 344cc452da5c5650e84285f010b3a7e5766cead09a1f9ed194fcd3ff42798f10897f6889f1cf2fb04c5bba0965df9298006e9fce127617b1cb45167606a9d32e
SSDEEP 384:pFZwWWPfCtg/NFfBpKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVt5931RUFron7o:p/wWWnWg/XfBp8F1+UoAYDCx9Tuqh0VP
TLSH
T1AAB2EB2B704DCB7F4FC04A9D9C196FDB6D9802C796588D4047FAD94C02C77EAA21A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59fc77.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59fc77.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 adfb78da1d0352ba7c4fd7fc808245828a01531570bac32a3863e977b950322a
MD5 f58831c97d3042e3d65183d58e10adc1
SHA1 5b75127e772234988a48a52daad6359b84b2a77b
SHA512 52b535cd4210f2e3ca20583d80c9d230fe1536b91a003bdd234426feaa68e0b91e758e117cc5a200634129d312c085fa2909bc0496ac0699a2b116b572c70380
SSDEEP 768:+t3fHCOafIF/9OA9at01j0iq00+IaizMguwc1:+t3fyNCHq00NaUMgq1
TLSH
T163F2AF71BCA09D77ACE6E385B30637429FF44613C2CD5A9089ED2A0D015B69E170BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7da64681f9ee79f14ef0bfd58032ee9b421f6d45396499e59ca1042cd1f971e8
MD5 afa655f3a2456aadb85b1aa95297cf5f
SHA1 c016e474ef03aa391565273707794f11ebe73d26
SHA512 3bed528cd80d670933771688d74433f43fc46b3b57bad88804122d43259020f6a77cc94c8fa98f8f5c4727293ea849eff433b334d6ed5959b90afcde098663f0
SSDEEP 768:KFQK3kwg00COafIl/9OA9at01j0iq00+IaizMguwc1:xK3pBVCHq00NaUMgq1
TLSH
T1F9136CF2A8D38977E8AE9783A33D2E019EBCC153F5899550B7D9190DCC465BFC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 fe6806563a210492d0ed49291037276114f8f0e094d822e2bfb558c0503b2b32
MD5 20b898cce3b55b567875ddcac6785f5c
SHA1 b45d0c3648836cc6b4afe902c6a0a21cc218ab07
SHA512 86953590c554c095317f7a164c303f431e6b06aff14b2827e8476be55ff50524248ad2a375ec51c4e9838bea332cb230d2a6293c1a1b36a5f2b855ce7c9eac6c
SSDEEP 768:wt3GHCOafIF/9OA9at01j0iq00+IaizMguwc1:wt3GyNCHq00NaUMgq1
TLSH
T1C3F2AF71FCA09D77ACE6A385B30637429FF44653C6CD5A9089ED2A0D014B6AE170BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 2d8d56e9352cf67b3b7c13afd6149c8cd4690bb34092f8c6e7aec4f5758f9e4f
MD5 12d149336b708b48bf29e69180edd361
SHA1 949aebbff8cfe421770454b4b63a2dc9a2590a68
SHA512 a2a8ccbd467d314663ffc1d36581d3428d8f2decd1447ca47228d7dcb540e33cb995a8314b9e632b94b2e669f3684ccf101d6167ed90ecaa09d731723f0d51b7
SSDEEP 768:X/UxvxjgC+H3NcFOafI/9OA9at01j0iq00+Ia2jSHxRz:KZj3+H3NIRCHq00NaQSTz
TLSH
T1E903C031ECA59D779CF3B384730A63979FF44663C6C96AA04AED2A0D01876AD1307867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 cda1f4644e7cae1da315aeda199936ebdc348e4d22ec85f8acf39d22a6833065
MD5 8f56ca755716a48db3c74a1b315c8424
SHA1 81ec748544fe6a78217e6e88cbafa408882269bf
SHA512 e51687b5b38e9ae9c326c6408e5817bdd4b5c9056098d9ecc9a764624927226aca5a256f30c89c85f4d6a152bc40a6e5985ef6d1dfbe2b426f02174911a0251f
SSDEEP 768:A/UxvxjgC+o3GyCOafIh/9OA9at01j0iq00+IaizCL:tZj3+o3GDbCHq00NaUCL
TLSH
T16903BF31FCA5AD33ACF2B284730A2387DFF45523C6C95A9449EE2A0E05476AD570B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ede659d5-f6c8-45d0-a219-de9ada519c99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ede659d5-f6c8-45d0-a219-de9ada519c99.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download