hxxps://b2bi[.]rocketsoftware[.]com/inbox

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://b2bi.rocketsoftware.com/inbox
Sample260627-bb4e7agy7p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3432	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269955560412196"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{7608B81F-0B15-426C-9D50-8584F3C26039}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5624	msedge.exe
5624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 4988	1748	msedge.exe	84
PID 1748 wrote to memory of 3432	1748	msedge.exe	85
PID 1748 wrote to memory of 4372	1748	msedge.exe	86
PID 1748 wrote to memory of 4372	1748	msedge.exe	86
PID 1748 wrote to memory of 4372	1748	msedge.exe	86
PID 1748 wrote to memory of 3904	1748	msedge.exe	87
PID 1748 wrote to memory of 3904	1748	msedge.exe	87
PID 1748 wrote to memory of 732	1748	msedge.exe	88
PID 1748 wrote to memory of 732	1748	msedge.exe	88
PID 1748 wrote to memory of 732	1748	msedge.exe	88
PID 1748 wrote to memory of 1200	1748	msedge.exe	89
PID 1748 wrote to memory of 1200	1748	msedge.exe	89
PID 1748 wrote to memory of 1200	1748	msedge.exe	89
PID 1748 wrote to memory of 4148	1748	msedge.exe	91
PID 1748 wrote to memory of 4148	1748	msedge.exe	91
PID 1748 wrote to memory of 4148	1748	msedge.exe	91
PID 1748 wrote to memory of 1956	1748	msedge.exe	92
PID 1748 wrote to memory of 1956	1748	msedge.exe	92
PID 1748 wrote to memory of 1956	1748	msedge.exe	92
PID 1748 wrote to memory of 3012	1748	msedge.exe	98
PID 1748 wrote to memory of 1508	1748	msedge.exe	99
PID 1748 wrote to memory of 3012	1748	msedge.exe	98
PID 1748 wrote to memory of 1508	1748	msedge.exe	99
PID 1748 wrote to memory of 2820	1748	msedge.exe	101
PID 1748 wrote to memory of 1920	1748	msedge.exe	106
PID 1748 wrote to memory of 1920	1748	msedge.exe	106
PID 1748 wrote to memory of 1920	1748	msedge.exe	106
PID 1748 wrote to memory of 5624	1748	msedge.exe	120
PID 1748 wrote to memory of 5632	1748	msedge.exe	121
PID 1748 wrote to memory of 5640	1748	msedge.exe	122
PID 1748 wrote to memory of 5252	1748	msedge.exe	125
PID 1748 wrote to memory of 5252	1748	msedge.exe	125
PID 1748 wrote to memory of 5624	1748	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://b2bi.rocketsoftware.com/inbox
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffb546dc188,0x7ffb546dc194,0x7ffb546dc1a0
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,12268288579734111520,13975016376075180478,524288 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,13584408706138841939,14352672457204842794,262144 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,12436790020446993068,16381740102509242080,524288 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,11573161848258855275,11489027555762570202,2097152 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,4783488191840669991,6665870802093535454,2097152 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,13113371532573541566,8818617417684365617,2097152 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,11830620394962025555,14914261863284650818,2097152 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,9181615976864333886,3293193306375447874,524288 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,5643423422462025093,15845431703630680643,524288 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,6000570290013548642,1941286505503687477,524288 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,6000570290013548642,1941286505503687477,524288 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6196,i,12929704849507554018,8807437000503037556,2097152 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,13554792984423016,9260430260140238381,524288 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,4009242025658781737,17708281756722388744,524288 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,3171129716441617891,10779774000853587949,524288 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,3093746400855945177,9504864815425557840,524288 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4468,i,5182762238810553148,12125250071220302716,262144 --field-trial-handle=2324,i,11784474545092325545,14933462159165270479,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 375KB
SHA256 431a3251deb71c9c6d19db7ece22c26583f9d8fdba96fdfbb6a5b27d4214e31f
MD5 a3e719f84f525e2c6689b3f6ac73c402
SHA1 e3e93bf2c5aa88529ea3c1e524d2350245e91515
SHA512 0816380a9e625ce2e34fef598104a90a2724096b4d627bbe790c58008eeb3c50c732aa24500caa54fdc46c7f63216533adfb46d119a74aff4ed421b9f381ddbc
SSDEEP 6144:bk02i6NJqyLQCeqg5Vici0bU4rCHA9Q9lkOmEeWxF9Mh+kLNYr7tHLh:bMNJqybeqYvxCHAmXmEevbK3Bd
TLSH
T1A4842368F4BFE4A2AE8449215E5E0D746F487EB21740540AFB7DE2BB2415C493B6F203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d6b6fb268d11cf936933a15bd6f737a2ca943835415174eb5f59557fb57f0cf5
MD5 663c3a566a08da9a6767fe8e37b91fc4
SHA1 4763d2e02281b26cf8c1f3d2558be627415e8402
SHA512 cde6f1e616190296aeee96eb7d682cc73e1f43c7f3fed16db06df5f2bc42925078c5aa3bf48d0b8e1fcc0f97eec65e49fad156b6e5fa30204a35cddc677e8201
TLSH
T15A6193340D0084A9D760CAF196F0E64F7B70FAF2F973CEEA65436432660273583E9298
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594ee1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594ee1.TMP
Size 2KB
SHA256 45e3a8db06df4f06fd23308bef42103e8896221201d346166bc052c75c78538a
MD5 22a1cdc361f97d821cd08c808e5c1cda
SHA1 de29174eef0510c5dbe9516a24b97d41df133e53
SHA512 d8d7f608fec22b9a1bba3d5201c966346b8fed24b0eac2472e56c332c1191471610393a13dea986e4e54d4b416de3acd96e6b64e1d62dcdf1d85fe1921729080
TLSH
T19151A3380D018865E760CAF1A6F0E64F7B70FAF6F873DEEA545354366A1273183D6298
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9ca5b63e2f90f9e137f60dd263133c8940febf5b95ff71041df738a3083b4ad2
MD5 a891860af2efa9b185e2b1c95589753a
SHA1 9ad5e753f072b7072a306f4ce37a972cb1c7462f
SHA512 7b1d2cfd4d1bfaa6a96a2b3e63449bba3ce5f58f7dbfc017a09d8e9f2a7bb429863114934ce29774481f0fec67ca4134501a0d010530e8a77ce2ccd1802e97bd
TLSH
T11D51ABF7C3E4816D895112F0AB696E1BCF5E0526436C3DDAC5E8BF9AA7F2031D20194E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e0cb23b64536eb84c5c8314f359e88d22535d825dfe1569e772d8e8c4fada465
MD5 2ce5c16cc3dda2c539800da44b7fc50b
SHA1 a522bc2cc481f8d3deda882f107759cea2639347
SHA512 7b5a78b103883f277b7c98f67483b9e199f5ce3ffcd57eeb0a4c36bcf9361457d233d0543f03658431f0e1127895a9138f4750724365d349386398a48dae41c2
SSDEEP 192:sxZER3yM/jK1Ml8Mkq/fAsIHVTusIdp53HW6+WNDom/Y9IE63+IIgrJ:sxZE1Mq/fAsIHVT2pHbD/Df9
TLSH
T10642F712AA349977CCCBD309FA41BB53D6F91572A2940E44A9FCCA0C05E6EED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ff449010e71ba9da348fdfeb53ba5d18393ea7807d7f23d40f1e478171243aee
MD5 fcf8161071dc4e7e19a0eafd6659bb94
SHA1 d5069802f28dcf660994872c45484ba5327189b2
SHA512 d5e6fa4c1c20e60f81854fc92140ca2765aa8014b1bef9756ebe5b4b188ca320ef87fa9c9b4b1760451b21fbf4c94f56cb4427e238636b824c117a429d3728af
SSDEEP 192:sxZER3yM/jK1Ml8UQxkq/fAscHPTusIdpj3HW6+WNDZOXY9IJYUZ3+IIg50J:sxZE1qCq/fAscHPT2THb4XBVfW
TLSH
T1FE52E8126A345977CCDBD609FA41BF53E6F55472A2940E44A9FCCA0C01E6EED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 dcdb554da0d8b5c508fc15fc3bd1d6e34e7b98f9078aa3957dea9713241bcc0e
MD5 179df31c5385e120c1af899ee8fd27da
SHA1 4a715dee820cefc3445c0aa4849c721eb27304d1
SHA512 62119566e71c533996b1fa44289a2d8c3ab7cb8851256af133fe5acc1889bdc331be26645cb74f342077d572fb850f765c2b4e536fede2f9800df45a7037c7ed
SSDEEP 768:Bmcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWN6roNg6L:Bmcv21wWvu+Z+u1jaeFLeRNxNb
TLSH
T125D21B2B280CCB7E0F841E9CED2AAF9A6DD801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 8f52d0554d2e7bf1d03be81f857e4f959608935a8937f4500bb42ef12556f963
MD5 48f6bfc86460fdedb886cf26511323c8
SHA1 818225143aab06e8df755cbdfe067807ad085bdb
SHA512 f66a34c7b6657fbdbd36f080f737616f0ab6d32661d60a5eda86ce096bbad45732636eb81016b0b45abbfbeb8c6fb8daebb1e820aa52f796f3049d792dd6ef44
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDygha+IOKb5azq/WbKni/kbTgYbyqomJCKP:mTdBJVnU
TLSH
T15EB1F43633371252397D6948A29587374E8132A33814A4AF7BFD00A64EB7E216DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

444d5c96-f297-476d-8577-a3316f821865.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\444d5c96-f297-476d-8577-a3316f821865.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a98436385136cf4cc4862bdb07b8ca3ab206c479e738a66856656871434fa9bd
MD5 92b0a005e627a6da5aa3afd58f456e69
SHA1 30c17984ea09e5239a2784901d2eed5068e16bef
SHA512 b3712e7fa2bc76599b519c40e443a4cac3f2de76d3d756b4d2b7e0171c85487aab506cf802578c93ffc579c7680fefd31b08dab965c4615d2e26030845cd4e6d
SSDEEP 384:8BtNn/s3n9SfsN1U5tIziYwKe+CLOztNBYmn15wbAjEH:yj+9UFUKNTOztNBYmn12bfH
TLSH
T19D926D366D381C671EE39989F54B362B5FA880B7E6C53E80C5DC5F0C02DE798232AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 81d16e16e70d67efd1835408e2ae524f6bf81b2cfa478af73a0d06f171369f20
MD5 57ccc0ef97fc27161f67ac810ad77aad
SHA1 11f7c68be9eaef4dc7dd5d1c8af9a9f56ac05569
SHA512 2d3c5c312d066b48a9992f347eee501984673a3be78b21ddad201ca787a935df3c6f42678ab223267bb4575f849a5ac48495e299c733ae769941a61405e86cfc
SSDEEP 384:iLiF1tNn/s3n9S4zsNm8TUNTUlIl4tIziYaKe+CLOztgBYmn15wbAjEH:ZF1j+93TwgyU4NTOztgBYmn12bfH
TLSH
T1E0C219F258E74836D9AE8B47A73E2D174EBCC067B5812950B3885A0CCDDA2BFD306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 10084ce2c99539ab1738019d3c3417016637181af7d5a1e485778220deb141ca
MD5 e9036b138ccf34f4ff01005f26c28858
SHA1 83e1997f858dfa06fc12e87a2bf9b04490efbec8
SHA512 ffaa771a2cb57c85d7260d7c60b8ee13c16d473c5a58d838800f7ae2af63635080203dc08540e27a80ddbe297cfc4a45d1d956b87c8005be0117f1f3f027cf8f
SSDEEP 384:KBtNn/s3n9SfsN1U4tIziYwKe+CLOztNBYmn15wbAjEH:oj+9UuUKNTOztNBYmn12bfH
TLSH
T1F3926D366D381C671DE39989F54B362B5EA88077E6C53E8085DC5F0D02DE798232AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 18d0a2a27d1367f6cf708e6424e8d24514df43b49d755de4d885c4b7f70ce1d2
MD5 9a791bf7ae9101d6684727a33fa816df
SHA1 b5f0f3ce1a20dc8fc5305ab0dea9b139614ccf41
SHA512 8a14b6300b261cf556bd388acb2778b439d8677a667712d70544fa66c4586fbb5808fcce571d6c934ef0fe9e14ce575f0b622f902cce1a1c018525fa63a104a4
SSDEEP 192:JONl6v+YLNQmiUy+XZh+CGWOFmRMusB/rU6:JONl6vz/3Zh+CLORBjU6
TLSH
T16202E9357D782C6B9FF2AE45F44737275FA8217BEA912F80D9D82E1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 91b20831324b162c3b4b43b972b2d26c4e506d2ead868e56ff828bd621366c07
MD5 91a60d092f02537b012d9cddaede8b34
SHA1 2e538621786eec3085d72aa3edb4c8103822beaa
SHA512 fad08017cf5682605c2547d0d15fc005c4b2b307164feed313a62ffef20876d0542ff1cbdc780f20b4268455594a0ab5e008bea3b1385d42d1a79e6c73f63888
SSDEEP 192:aONv6v+YLHQmiUyRXWh+CGWOFmRet2CHBtqX1U6:aONv6vzVCWh+CLOzt3BYU6
TLSH
T1CD121A32BC785C6B1EE2A945F44736275EA85167EA867F80D5C82F1C02DF69C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36e767fe-c741-47f7-ae64-35f001247136.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\36e767fe-c741-47f7-ae64-35f001247136.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 43129f212ddd049a15dc2238f40a37d150ce81bc89fb9961af9e368ea59bdc47
MD5 587b8b7b79a2630df0c4dd9c3aa54161
SHA1 d2b353a52a75e651fa7ddc78e413cc55e211ac1c
SHA512 8fd44c33d1d00939332066ebde7dcb981e53b987d297bddcdf5b8e2855a832245584563c3fce05dd27946bda7da194681f1cd6d90d18cf8a87bc5b38b56fe9fc
TLSH
T1B9412758AAE51148B3B76E0BAFF7A86D447FB9372F1AD55E10100E4E0A22B40CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download