hxxps://server[.]lovegroswestfide[.]site

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://server.lovegroswestfide.site
Sample260928-ppmlgsty7n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4228	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{8A6E3073-C505-4310-91ED-51A932F2A447}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 4992	540	msedge.exe	84
PID 540 wrote to memory of 4228	540	msedge.exe	85
PID 540 wrote to memory of 3816	540	msedge.exe	86
PID 540 wrote to memory of 3832	540	msedge.exe	87
PID 540 wrote to memory of 3816	540	msedge.exe	86
PID 540 wrote to memory of 3816	540	msedge.exe	86
PID 540 wrote to memory of 3832	540	msedge.exe	87
PID 540 wrote to memory of 1780	540	msedge.exe	89
PID 540 wrote to memory of 3024	540	msedge.exe	90
PID 540 wrote to memory of 1780	540	msedge.exe	89
PID 540 wrote to memory of 1780	540	msedge.exe	89
PID 540 wrote to memory of 3024	540	msedge.exe	90
PID 540 wrote to memory of 3024	540	msedge.exe	90
PID 540 wrote to memory of 3232	540	msedge.exe	91
PID 540 wrote to memory of 2320	540	msedge.exe	92
PID 540 wrote to memory of 3232	540	msedge.exe	91
PID 540 wrote to memory of 3232	540	msedge.exe	91
PID 540 wrote to memory of 2320	540	msedge.exe	92
PID 540 wrote to memory of 2320	540	msedge.exe	92
PID 540 wrote to memory of 1904	540	msedge.exe	98
PID 540 wrote to memory of 4836	540	msedge.exe	99
PID 540 wrote to memory of 1904	540	msedge.exe	98
PID 540 wrote to memory of 4836	540	msedge.exe	99
PID 540 wrote to memory of 1464	540	msedge.exe	103
PID 540 wrote to memory of 3364	540	msedge.exe	111
PID 540 wrote to memory of 2304	540	msedge.exe	112
PID 540 wrote to memory of 4640	540	msedge.exe	113
PID 540 wrote to memory of 32	540	msedge.exe	122
PID 540 wrote to memory of 32	540	msedge.exe	122
PID 540 wrote to memory of 2972	540	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://server.lovegroswestfide.site
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffd07c8c188,0x7ffd07c8c194,0x7ffd07c8c1a0
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,12474161364277354564,15990383288646738542,524288 --field-trial-handle=2312,i,13786235063967859920,11389807675833222821,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,1024918952834315796,15288105598823742764,262144 --field-trial-handle=2312,i,13786235063967859920,11389807675833222821,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,14150110461156008270,1265892179473537087,524288 --field-trial-handle=2312,i,13786235063967859920,11389807675833222821,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,10046196394200699391,16156827964470473783,2097152 --field-trial-handle=2312,i,13786235063967859920,11389807675833222821,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,4596006730601873926,8115288233092575632,2097152 --field-trial-handle=2312,i,13786235063967859920,11389807675833222821,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,13846688727355366484,8787881803329164296,2097152 --field-trial-handle=2312,i,13786235063967859920,11389807675833222821,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,3738193328870007019,15896996226037625187,2097152 --field-trial-handle=2312,i,13786235063967859920,11389807675833222821,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,7802550781656628202,11790094147304281754,524288 --field-trial-handle=2312,i,13786235063967859920,11389807675833222821,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,3236754747076118536,9376546703610478980,524288 --field-trial-handle=2312,i,13786235063967859920,11389807675833222821,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,232474493689473722,8410821754194060345,524288 --field-trial-handle=2312,i,13786235063967859920,11389807675833222821,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,232474493689473722,8410821754194060345,524288 --field-trial-handle=2312,i,13786235063967859920,11389807675833222821,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,15049698582699116808,11655523442601374349,524288 --field-trial-handle=2312,i,13786235063967859920,11389807675833222821,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,7498691243996754380,16672420160856287216,524288 --field-trial-handle=2312,i,13786235063967859920,11389807675833222821,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,1439175893456964514,17699550726841998904,524288 --field-trial-handle=2312,i,13786235063967859920,11389807675833222821,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,7999622502377728834,9610594271483176275,524288 --field-trial-handle=2312,i,13786235063967859920,11389807675833222821,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6164,i,18050046653067485072,6325621436616134908,262144 --field-trial-handle=2312,i,13786235063967859920,11389807675833222821,262144 --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

920b7582-8b59-4863-b047-957f607f7f87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\920b7582-8b59-4863-b047-957f607f7f87.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 76a262586063d5731da67c87c1ea721d798981e725a03bd8e6542dec6fa2387f
MD5 e3ae032fa5a30637b41b8a737d40c88d
SHA1 3f9eae34b4625e5307cd4f78bd2f00251f994d07
SHA512 4d689edc520ee3051382539ce22160063a23fc74d2265e9b2f6bd17f0a6473c121073976cf1a8beb2d1f56cd91b3c299bb806bdc6386cab070956ae6dd808fa4
TLSH
T104619182A74303ADFBAB607191C928CF3D31554A458B2F2AC6E4D635B8CF344AB1806F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593927.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593927.TMP
Size 3KB
SHA256 0720e14d237dbb07046f2993d645121159fdc323d0da25a1a56acfa1c3f809fa
MD5 f8c94f371b722104b6b58565fa96087b
SHA1 f05ddfe0158d3074c4118e1f9403cdf702b940e7
SHA512 8e2fd12985359199ed4af572e6477a6698e7911e99c9614e2324e4972300f16a1c619c781eef6eb0c49fe2dc28e3242aed720e77894731c83e15cff2c31186de
TLSH
T16E619282A74343ADFB6B603191D528CF3D31554A418B2F2AC5E4D235B8CF354AB1806F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 37b80f16b612500572760cc8d66e7fffba88fd0680945a98ca39a08a9b388c73
MD5 5edcfe100d5feb86dfe454bd4f7b848c
SHA1 81adfaca459656fd645e8fef834d79b699204db1
SHA512 d3cde32a3e48c6f546492be3ef18926551b950842b3d319b19aeb8119e35ad37213023ddaf9cbc6bd02017b1ea7885e4c46e47f9cf5955ce77a90311a47f2803
TLSH
T14921CDB3C7E496AECE0166F0AA14AE2BCE2D0606431C7C5989D8EF27D3F3475E00159B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7cc6c9aaef5cf9475936e1f712222b471c33e9e0283bcd7b11eb8f45c1f1bbe2
MD5 44917819e07a860230cabc076aa0946f
SHA1 4e0566c54a5e92eee51b8e73a81426dcf908a9a3
SHA512 e1672abd0103358e89e60e9acb4c968ae27cf370b7b5da919e9dc0b77273ac755747ee2c0a5836901fd4461b50e91069e394c7263c139eb458e7bc36e4ae18f5
SSDEEP 192:sxZBRNWH/fIs9PqIdp02HW6+WNuX8/YaFvbIgrJ:sxZBqH/fIs9PjLHbB/19
TLSH
T19C22C8526E28A97B8CC7D20DBB15BF53E6F9503291D51E48EAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 73322c13bede78d41f828ac95bc58abb6c8bcbfd254f7569b5ded7e155a61d38
MD5 445bb2dc07d59505b7103d5adf80b7ad
SHA1 e296af7c89b07a8bae71a39a56fd3ced540c7989
SHA512 590a64365d04bf64a8e369b2875143afe092733d2da54a9d0fe0c03cf54cc1bc06a073a7102c943ac072a5ae3cb3f9c9303e4bf73083628af481cc2efe62b5ad
SSDEEP 192:sxZBRNWH/fIsJPqIdp22HW6+WNuX8/Yaf8vbIg5hJ:sxZBqH/fIsJPjFHbB/G5
TLSH
T1E122C8526E286A7B8CCBD20DBB15BF53E7F9503291951E48A7FC861C05E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8a871b97c42b95512162b315f816ab8f67ef645bc8b0299118c92a27adddf061
MD5 d000cf99ae434917b8cf29c9cb12fb46
SHA1 7e6e8fbeae2209a1a90f0dc8c4b951605ec6b0cd
SHA512 69df085ba527760238d723209ce6d21f73517540df619a7d050b34febf686fc0f8e0bbd45926fcfb2525d7852e0a891415b42b33160aa31eb6a3c669bbf2aa67
SSDEEP 192:sxZBRNWH/fIsJPqIdp02HW6+WNuX8/YalnvbIg5hJ:sxZBqH/fIsJPjLHbB/Z5
TLSH
T1FF22C8526E286A7B8CCBD20DBB15BF53E7F9503291951E48A6FC861C05E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 131852de6f1ae3c1b4df6ccd2493c0ed9978ad52ac83c116c44cf84d72a9f8df
MD5 8f838220c259c682119fd0927e2e9fc6
SHA1 19db18f4ea81861e70a221b33d3a9832d9bf440d
SHA512 9b7278e81ddd92f8e176725812fec855612bc14730d15bc64a7e5f137d38b6a13eb62a8deb69e697df98a5d1436c62f446810d584ffe82d84fa2cc9cc36e88ab
SSDEEP 192:sxZBRNWH/fIs3PqIdp02HW6+WNuX8/YaFvbIg5TJ:sxZBqH/fIs3PjLHbB/1H
TLSH
T10D22C8526E28AA7B8CCBD20DBB15BF53D7F9103291D51E48A6FC861C05E7ADD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c2616ecaf0cd857b54721d237d427b86586071cd8a3fd300006d79eb7c736c27
MD5 10160688de5137cd69c17bfa678421f6
SHA1 f4330e0b670260050c3ca7fd13bcd31b298ef570
SHA512 e443c45820fd5160ac41e33e28aff0094da61477deb908a075997079cbfe7a52f34707b29182fe34450c90675be140c71a5dc8fe0ae5639ae973a9e2d852221b
SSDEEP 768:UpyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3LroCZMz:UpyQRbrWvvlpZu1jaXKLf334CZMz
TLSH
T188C2E92B640CCB7E4FC01E9DDC6A6F976EA802D766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 babce44438120ab27a9c6a8e2b7f72fca5d927a79e2f450cc66d5277c2817341
MD5 b0f93a45e09ec6ce62fafe27766d926e
SHA1 d5472ea9df7137722801064f58693137a842f17e
SHA512 b45d7fb5f10ad9d5d36a4fb2942c4148ca3c279973a69f8cd005023013bf7c016d27be80a2c8910d5296a88d2ebc2d70f7c74863d1fef67dbb74370d0929aa76
SSDEEP 48:K0b7b+b/bbblbdbdb+bbNbgblISb7b+K9bL1bJb+xbTbuYbIbZbrbfyLNsh9P7/C:KsAAK9aCK+wKvaoN2K+QKqEgKJ
TLSH
T146A1231276BB0350397E656881708B6F668132733454FF2B7BAC44629E6BE084DFDDCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59b963.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b963.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b70aa274a22c961729583a949c3fe8af4aebccef24f42914367ff99f02afbca4
MD5 68220ee460c3e70bfb05df014f6fb6ef
SHA1 b320d6fab97af36cc66f2375c3f206bb2fab8384
SHA512 fa927213f432de54baa94118adb9f4130fa2f5951de1f02f13eb720d93b8b5bbfe01c762162a14ec1963ef91ff1e13a2dc657da134cd9927435756f530ae8730
SSDEEP 384:UZcIhsNLRy2X/bkp5u8iGlsYctgOIwZOydNoy:ShuDOkGlPcXsC5
TLSH
T193827C7258B86CBB68EBE510F58737139FB8406797C86F80D4EC672D01EA6E8130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 13f669477585008d61d53c54c4d5fb4b3cbeba746d65f9c02f584b19b4a9fccb
MD5 efe77e335d8584656f750f00930bdfe6
SHA1 6e69e465a13e2fffe2f9b9b8f9f2dc088208974c
SHA512 ac533c6dc35de46f54edf233f27d8a2b74731800a64296f0b64808a347d61420a5392b6c0744738859a538820429f03e8c1614c1625101a1021ef3ab2d0691cf
SSDEEP 384:UiFiZcI1zsNV8TUNTUlIlMy2X/6kp5u8iGlsfctgOIwZOydNoy:vFQNIwg2yOkGlmcXsC5
TLSH
T1F1C21AF248D7587AE9AE9743A77E2E024E7CC067B6849A80B7D8561CCD961BFC307811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9b1e0f3c324e7abddf0dba97f72f1981afb6fd025437b2c4ad550c6f33670609
MD5 fd5fcc238eafea4b356dfa06c151eb0e
SHA1 50fbb239ff09710859b4b2cd56e52788e992e9e0
SHA512 2655eee5c1c0e2581b917e4f11f73dc393286c3856a3306c558cf456d9a654d22116c3a0a2a793eb36f4b48e4f10884a8f7902a8a94643b6016ad0163011ab48
SSDEEP 192:SONs6iDCQmiUyD5Hq5u88PGquhMSq7VmU6:SONs6/AHq5u8iGlC4U6
TLSH
T16F02F9386C387CBB9DE3AD15B5877B279FA4013BE6941F84DAE8162C01E769C1703936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0554c318862d1dccf57e6fcae984f33f5e54c450f62a5c8e6790b687fd33c809
MD5 8aec74e01abd86b93a1f58c7a834cb98
SHA1 2d452a442d888f1be4a3d6c91a5686a9698e5e84
SHA512 3534216f28880ad332399cafcc633a26acf8844db2928b0ac070abc40a55caf929358a2c0b5ee071427bfd0b29adbc20657f71f74980539ddf95afeec45bd66e
SSDEEP 384:pZcIhsNLMy2X/bkp5u8iGlsYctgOIwZOydNoy:hhzDOkGlPcXsC5
TLSH
T10B827B7218B86CBB68EBE510F58736139FB8406797C85F80D4ECA72D01EA6E8130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 902a907a0d8221f49bc36a13469dc6d605541ee539478008e2f57a2654251388
MD5 1967e65c7fc71441cf4b511c591bcdee
SHA1 bec64a612137fe7ec42270ec556e2a0e7636a7b5
SHA512 cc9137fe61d7832bccbf2f5c4db3caf6c91b1e7d695c05a913a2a43d19fc7d65901cc8bf796de8a96a72ee9d93390a5a7bab9c96966ad374fad928d8bfe4738b
SSDEEP 192:SONO6iDbQmiUypk5kq5u88PGquh63MguZ9qBU6:SONO6Q3kq5u8iGlsIcU6
TLSH
T15B122B316878BC7B6DD3A950F4873A139EA44137EB896F84D5DC262C01EF6AC130B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f736603-2882-48d4-919e-0c20387eea78.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6f736603-2882-48d4-919e-0c20387eea78.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ac61809911231556ecbf928d145c2672e529d904228d6c245b623c5a16839ac5
MD5 0d28a8ca956c942e63546f6744a4a7e6
SHA1 ebf744b17621aab66207f4153c87e02153c731a3
SHA512 e13485446b72e61b5f61f16e16c164be6a99ed1551954454ef035aee54bccde91069b969356eefab144028c26e0e257f70d038def26fc7a9b558701865172e8b
TLSH
T1C1411558AAE91048B3B7AE569FF7A86E547FB8772E4AD55D00010E4F0A73B41C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download