b95219f315577a786ea61060252b1fcd8bbf1266003f3f045c5d1fe612dbe87b

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sorillus_Rat__ed__/Sorillus Rat Cracked ~KAWAY~/jre1.8.0_361/Welcome.html
Size 955B
Sample260620-ejtshac14k
SHA256 b95219f315577a786ea61060252b1fcd8bbf1266003f3f045c5d1fe612dbe87b
MD5 b292ae0fb1b4f20a7d0f8791af97db50
SHA1 476fecd1d9b61151a1ff622454c8095e41ca5178
SHA512 1bc45e9453f70abf7625c3a0f6506c22cb3de10ca4005a97df460b14a174c0484e0994af63978151cf5436edaf77519151dd9a0606764e2426707457b13828a7
TLSH
T15D1104EFE9F49B13B76016D321E466E47BB941F55CA3C85A3A1192029040E36C30FBBE
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3996	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264017357632831"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{357E6A9E-7E3F-4670-AA69-F580D256F6DF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 1588	816	msedge.exe	85
PID 816 wrote to memory of 3996	816	msedge.exe	86
PID 816 wrote to memory of 2032	816	msedge.exe	87
PID 816 wrote to memory of 2032	816	msedge.exe	87
PID 816 wrote to memory of 2032	816	msedge.exe	87
PID 816 wrote to memory of 756	816	msedge.exe	88
PID 816 wrote to memory of 756	816	msedge.exe	88
PID 816 wrote to memory of 116	816	msedge.exe	89
PID 816 wrote to memory of 1232	816	msedge.exe	90
PID 816 wrote to memory of 116	816	msedge.exe	89
PID 816 wrote to memory of 116	816	msedge.exe	89
PID 816 wrote to memory of 1232	816	msedge.exe	90
PID 816 wrote to memory of 1232	816	msedge.exe	90
PID 816 wrote to memory of 2108	816	msedge.exe	91
PID 816 wrote to memory of 2980	816	msedge.exe	92
PID 816 wrote to memory of 2108	816	msedge.exe	91
PID 816 wrote to memory of 2108	816	msedge.exe	91
PID 816 wrote to memory of 2980	816	msedge.exe	92
PID 816 wrote to memory of 2980	816	msedge.exe	92
PID 816 wrote to memory of 2212	816	msedge.exe	97
PID 816 wrote to memory of 2212	816	msedge.exe	97
PID 816 wrote to memory of 868	816	msedge.exe	98
PID 816 wrote to memory of 868	816	msedge.exe	98
PID 816 wrote to memory of 1828	816	msedge.exe	100
PID 816 wrote to memory of 1180	816	msedge.exe	114
PID 816 wrote to memory of 4340	816	msedge.exe	115
PID 816 wrote to memory of 1944	816	msedge.exe	116
PID 816 wrote to memory of 2044	816	msedge.exe	117
PID 816 wrote to memory of 2044	816	msedge.exe	117
PID 816 wrote to memory of 1996	816	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Sorillus_Rat__ed__\Sorillus Rat Cracked ~KAWAY~\jre1.8.0_361\Welcome.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa0829c188,0x7ffa0829c194,0x7ffa0829c1a0
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,13393488702524204581,12717619807053382832,524288 --field-trial-handle=2252,i,10803268393763170878,5450378356243319931,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,17704022500426507156,18082226423933456439,262144 --field-trial-handle=2252,i,10803268393763170878,5450378356243319931,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,544082410456302553,972068698363730153,524288 --field-trial-handle=2252,i,10803268393763170878,5450378356243319931,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,2530938052180431984,6092709506892456553,2097152 --field-trial-handle=2252,i,10803268393763170878,5450378356243319931,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,12145403722905847952,16322878291640582200,2097152 --field-trial-handle=2252,i,10803268393763170878,5450378356243319931,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,11530846716869930951,18242685050527360808,2097152 --field-trial-handle=2252,i,10803268393763170878,5450378356243319931,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,7575030025399972026,16674657312245394746,2097152 --field-trial-handle=2252,i,10803268393763170878,5450378356243319931,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,6367018714102675412,3065735083194365160,524288 --field-trial-handle=2252,i,10803268393763170878,5450378356243319931,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,2681952847698829473,18421672517541763816,524288 --field-trial-handle=2252,i,10803268393763170878,5450378356243319931,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,4289634982068960393,10817140336126738855,524288 --field-trial-handle=2252,i,10803268393763170878,5450378356243319931,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,4289634982068960393,10817140336126738855,524288 --field-trial-handle=2252,i,10803268393763170878,5450378356243319931,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,9687845129273685037,7847322352821185390,524288 --field-trial-handle=2252,i,10803268393763170878,5450378356243319931,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,9761225037807448561,12809705299258662473,524288 --field-trial-handle=2252,i,10803268393763170878,5450378356243319931,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,5672612909281872508,14367524012667405138,524288 --field-trial-handle=2252,i,10803268393763170878,5450378356243319931,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2076,i,8458470321472714036,18260521169302375557,524288 --field-trial-handle=2252,i,10803268393763170878,5450378356243319931,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5296,i,9904582364240336162,10819553137239184841,262144 --field-trial-handle=2252,i,10803268393763170878,5450378356243319931,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5a5dc3b02e4831cc599391a877ce9157073786f526ba5e2cb03ca40100748637
MD5 6e7bfa7cb5d9899d04e986aeddbf67cb
SHA1 509ceefacb5cc140bd16757de8cd054d3169482f
SHA512 ff45952ddcb76b0d90d2c391311ebde4532e132f88ed757caf83ff84626204f7612dc9144787c15f4ac6aefe2d0a7df04355970bfaa43e4f46746e148b097880
TLSH
T1F4613D7DC6624492F3B15239E0DF067279360FC9FC675E7611E0EA7436E6B62C05288A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dacb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dacb.TMP
Size 3KB
SHA256 2c7547936614c0f2eebb396c9af1801e662f6b8a44214654de2fdde38911ea49
MD5 49328276687ecf08292f6d3d76d1b96d
SHA1 4a2dc4e9d060d4ed02a044be4645df00361f7900
SHA512 bfc9bb4678d4614b8769035730def3a5960299ae02ec4f7ef9fb4ad4c1c1f6c66daf34cc288545807c0c2c256f6bc2ac463e3af1c1128857cfe53dc56cd27e39
TLSH
T136614C7DC65244E1F3B05238E0DF067279360EC9FC276E7A51E0EA7436E7B62C15288A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 815B
SHA256 aa454f696ac1af8d9d0839630e0fc60f072a690b47b29c812cddcaf41ca0ed33
MD5 bd1de5c62749ff6b87d4579936b99f79
SHA1 0859525c0464bad98cdfc3c104006da24dbdf37e
SHA512 7387633761791169b575c1ee5ec8b5706fd0716a44ebce0fefbc1b341cb4a4c1e080ebc9c7d0f0623fce5e85904c1ae3d6ce23acf02a4763c46befce47f9fb74
TLSH
T1C4018EB3C2D5C56EC90117F06A24AE17CE2D090542287C19C9D8EF5B83F2475E10145F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4d921a4c9a1b6207d723472d509cf373b0696bb6cb0226f02cd50149c8e4f2d4
MD5 907abc114a176fe838a0e70618d8a830
SHA1 d65aeaeab6cfa95223827d9498b8ec5eb492bdc6
SHA512 7e09bffb2c268cc4c14c800918258c90860444efcc2c0bc2bff8d16d9cc8dff9745daf8145953200ac18d0dedcb8c75a762d1c4b7d772415a4fd0c9a2b07e529
SSDEEP 192:sxZcRiyM/jK1Ml8MkN/fes4x9qe2qDIdpd+8HW6+WNGY9IKCBFBIgrJ:sxZc0MN/fes4x8ewvHbGj9
TLSH
T1C942F8126A346977CCDBD209FA45BF53D6F55532A2900E48AAFCCA1C05E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5b3dca113d1d93db9cb88708899a53d543b901e272463c7ec086b4757cd65558
MD5 28b3763eff02ff0a71e60666f667971f
SHA1 d7af875aea49b26894bcdf7810edb5e51fb8c5ed
SHA512 7569f117a5f944f8e2720052ad9a1316cddddf5e91e342ee192a510bd609fa47a37618b6619c65ae05a77bdb4a0c6d5390688078b51087f5e36f240955131c52
SSDEEP 192:sxZcRiyM/jK1Ml8UQlkN/fesrx9qz2qDIdpH+8HW6+WNGY9IkhUFBIg5QJ:sxZc0quN/fesrx8zwZHbGpi
TLSH
T12152F8166A345977CCDBE209FA45BF53D6F55472A2900E48AAFCCA1C01E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bc0d4901f65d91bf5f16b8f6968cfed29263ad93455ae51c0a25ab196fa93b92
MD5 8d30e4a20066f82b087fba6ab8fec17c
SHA1 7aa6024584adc2c6326b201029888bf060afb675
SHA512 607ebe980c44abbbe0f817578a67606fbc8f814c65bb15a66966009ef39203be72903afeedafa0725a61596fc5579f1fda840d64e3384d1952fed188e91c9135
SSDEEP 768:SPcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNBroAg6T:SPcv21wWvu+Z+u1jaeFLeRN6Aj
TLSH
T1C4D20A2B280CCB7E4F841E9CED2AAF8A6DD801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dd77130b9bb47bab4c9582b4adac05fd961800e3784f563ed0b11e3b47b383f4
MD5 e606f90432899624333beb254f0814a7
SHA1 5359c9b14abfde2c3c8eca1e0df8a8f485f816fc
SHA512 de1a4d55d4556b7122a140a1518ffcf5515f19d0da2e3b586c92d776a849fc5254fca2c59f851e98e3d9d1d4d865a208d70a99591c1b60992f58dc9f3943301d
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDauoKf6yauIKXKIz:mT3/X3
TLSH
T141913E06313A12A3787E6808A39786364E4139A77819F46F7BFC50A14F2BE125EFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e89fa1f-d211-44df-8391-d686058c7bbd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3e89fa1f-d211-44df-8391-d686058c7bbd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3656c7b2dd2688d7b75c7046e8b4c24ffe56ddb6124a48e65504bfc3c8d1ed46
MD5 07b172deb0556c35aacb873d37ca0764
SHA1 cd91f1aec2621951ec16ce5cd9f58247d50eb2e7
SHA512 e1183086a9fd209d6135e569dcb718b9a9a6c2c82135145ad907f9adb23bc22c468862bfdb59e30eb8875c282e2b32852420cbf9844389bafae221d29566f725
SSDEEP 384:/tNn/s3n9SfsNdQxDDNzixibue+COdPeTJrLnITGT0IZx9H:/j+9UPdF2cThLni+0AvH
TLSH
T156928D325934AC6B4E966086F00B36175FB454B7E2C63F8596ECAF1C02DF6AC1306D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 83495660d29d2f188ba6a05727f79b2493492bf0fb793c2c8ebdc8793c8b8e61
MD5 00c4683ee7db982f11ada5fcbdc8a447
SHA1 440598f055ab48b3279dbe4a294f5ab35f2a2f77
SHA512 b0a7f635b5f574c8f1ac6247e654aee235c84aefd2f9fff2149456b728d594e337d043849d923e5d647e7b16223e754e81b1cb10947cfe2a9ce27897ce3372d9
SSDEEP 384:xiF1tNn/s3n9SXzsNn8TUNTUlIlzxDDNzixibue+COdPeTJrmnITGT0IZx9H:YF1j+9Miwg9dF2cThmni+0AvH
TLSH
T114A27B335924DD7B9EA66A85F40A32178FB450B3D5C23A95E7DC9E1C02DB2EC130AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 98f92e9b4ca2cadaf27b4b3f8abf2eba99e432dc4b0316a27d7830fc087083de
MD5 23e9c0e173b0fe6bf744a36bb57b9a4c
SHA1 b8b49592c031a5e3d222a4b0eeb84d434db12177
SHA512 2f3e3e35d8f3916de1d21b4216ef81a9abed98899becd6171ba380ce2e6804ab07b150ab8fa271f9f3dd5b0b60aaae78f6fd652fa33919d4cee06fb987b0a5b1
SSDEEP 192:JONVm6v+YLNQmiUymfZh+CGU+Fdes9ovtusZEU6:JONI6vz/DZh+COdPeFGU6
TLSH
T17E02FA356D382C6B9FF26E45F48737175FA82177E9922F84D9E81F1C01D765C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f982a822b8da35088bd065596ebad037ac6e6749573d805848b82a3894711cad
MD5 3a56f7614db54e64cb1d08d4e3877bbc
SHA1 062e83d459e4858aba6d93128684bf39dc6a3b75
SHA512 8c549725c0ce0ba79744d3bc9e06ce2b36bf59978011f22d9fb77954854dcec0f7d3a4ba317172e40821575b0be156367410c5e74f937adb75f428f2d57db854
SSDEEP 384:FtNn/s3n9SfsNdzxDDNzixibue+COdPeTJrLnITGT0IZx9H:Fj+9UadF2cThLni+0AvH
TLSH
T132928D326934AC6B4ED66086F00B36175FB454B7E2C63F8596ECAF1C02DF6AC1306D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9f00ae077c9c8f8e8089b79e4f3aa21f18f1bed9ac874ad0344dcd5598cb1086
MD5 d4e39eb50081deabe4b5b7ab052a9ce7
SHA1 298b4817997bc7cdda9825d6bf9f6faa856f221c
SHA512 0330cd825f026200409dd8d0f97c069598b5d47476160263a7f1a6a4d2ab3736de390f125c4faa4bbf96db909cd71658852a53ce2f547c0d218a549f0ac528ac
SSDEEP 192:9ONsh6v+YLnQmiUyAfOh+CGU+Fdes9oveDSJryCH6qPU6:9ONQ6vzdzOh+COdPeTJrbnU6
TLSH
T1CC123B3168786C6B5ED2B581F48335175FA49127EB8B3F80D5EC6F1C02DF69C230681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb760ab1-d638-470a-be17-01e528945c05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bb760ab1-d638-470a-be17-01e528945c05.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bb5c2970b2f4ba515fc498aa7e6430ba615f85896445b63da3a7574a26305c42
MD5 945240752e6a3c3f43aa07aed8c7cf99
SHA1 46680148a3cc72ebb2f63ccac4a1ba843d881a13
SHA512 88a8ce383e337627aea2cf77b8b8dd58354bb18ae17db00a0372f8be2e71c9d158817164a5543cb0c3588c39a4445e7ede293736bb281c41e3d07a6da78cabaf
TLSH
T113411A5CAAFA1154B3776F4A9BF6A96E447EB8372E0AD59D00110E4F0A32B04C971B37
MD5 SHA1 SHA512 TLSH

Submit Download