hxxp://mariachicentinela[.]pcard[.]site

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mariachicentinela.pcard.site
Sample260627-tb1cmscs4k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2836	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270492373151059"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{706E4171-9CCF-46BE-89F4-F2C92FE15173}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1888	msedge.exe
1888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 2792	820	msedge.exe	85
PID 820 wrote to memory of 2836	820	msedge.exe	86
PID 820 wrote to memory of 1248	820	msedge.exe	87
PID 820 wrote to memory of 1248	820	msedge.exe	87
PID 820 wrote to memory of 1248	820	msedge.exe	87
PID 820 wrote to memory of 3220	820	msedge.exe	88
PID 820 wrote to memory of 3220	820	msedge.exe	88
PID 820 wrote to memory of 4260	820	msedge.exe	90
PID 820 wrote to memory of 4260	820	msedge.exe	90
PID 820 wrote to memory of 4716	820	msedge.exe	91
PID 820 wrote to memory of 4260	820	msedge.exe	90
PID 820 wrote to memory of 4716	820	msedge.exe	91
PID 820 wrote to memory of 4716	820	msedge.exe	91
PID 820 wrote to memory of 4760	820	msedge.exe	92
PID 820 wrote to memory of 4532	820	msedge.exe	93
PID 820 wrote to memory of 4760	820	msedge.exe	92
PID 820 wrote to memory of 4760	820	msedge.exe	92
PID 820 wrote to memory of 4532	820	msedge.exe	93
PID 820 wrote to memory of 4532	820	msedge.exe	93
PID 820 wrote to memory of 400	820	msedge.exe	97
PID 820 wrote to memory of 400	820	msedge.exe	97
PID 820 wrote to memory of 400	820	msedge.exe	97
PID 820 wrote to memory of 4132	820	msedge.exe	98
PID 820 wrote to memory of 4132	820	msedge.exe	98
PID 820 wrote to memory of 3788	820	msedge.exe	99
PID 820 wrote to memory of 3788	820	msedge.exe	99
PID 820 wrote to memory of 2924	820	msedge.exe	103
PID 820 wrote to memory of 2044	820	msedge.exe	110
PID 820 wrote to memory of 2044	820	msedge.exe	110
PID 820 wrote to memory of 2044	820	msedge.exe	110
PID 820 wrote to memory of 2488	820	msedge.exe	118
PID 820 wrote to memory of 4148	820	msedge.exe	119
PID 820 wrote to memory of 536	820	msedge.exe	120
PID 820 wrote to memory of 3824	820	msedge.exe	123
PID 820 wrote to memory of 3824	820	msedge.exe	123
PID 820 wrote to memory of 1888	820	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mariachicentinela.pcard.site
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc12efc188,0x7ffc12efc194,0x7ffc12efc1a0
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,11708440842307049732,11534197174919790964,524288 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,9585296238231338653,16638974291140672239,262144 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,15124816308815214490,17129322185678602661,524288 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,3663490586327937084,5856570411305894636,2097152 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,8083778629300442176,2961180220560564824,2097152 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,9476566647370771949,2222469141835323172,2097152 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,9897317903124667133,41508110892950375,2097152 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:2
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5116,i,2357530544127666759,5081167467301413793,2097152 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,2285901464661707887,273969966034021627,524288 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,3431378634233952722,18433256162039721482,524288 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,1463862488768069531,13108169586217754203,524288 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,1463862488768069531,13108169586217754203,524288 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6400,i,9515080288330888655,3184492329191858480,2097152 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,5577723019336806333,6059016396940535493,524288 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,2366794675824023255,767156555010239380,524288 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,5535967600100231425,6794023236322567488,524288 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,2063315131155520340,4315618283677763143,524288 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3672,i,9286276056297497571,284385583920886142,262144 --field-trial-handle=2324,i,17526110388592549094,1457247436839587251,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 147d137facd988894d76e7be971eaca628776772059bc0b9f34bd0618ed38636
MD5 5332121faf98222dd60b40ea44d9c159
SHA1 ed1cc1de0198de9973376b0dd03356e852a3aea7
SHA512 c4a7813ded73bc39c181a07369225888689b3882f6a2c15a00c9f7efd0ecc25ddbc64cdb37a115f31bc75b9eb6c285a64242ad7013c09426e0a9a54b8ddb0541
TLSH
T11E71812842A63461EBF41AF0E4C31205B47E47DF0B0F0D45189C9FBD6E89364B17178B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d7ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d7ec.TMP
Size 3KB
SHA256 c520e04c100ff69c91b81007ce6839b820c4ed253ef49b43670cd7cc249d5d88
MD5 d392a4271000517ee8c1edcba03ea119
SHA1 760091588fe20729703424313c30f1a6653b4b1d
SHA512 6d11ac528dda3c9291d26ca192e3ba9ca372ec2b0ca3aa8c795eeb71fcdfb8deb931c38936da6b14d573b7346b36b99015b2bf25346a59ad28e3da5e62b703a4
TLSH
T18E71812842A27461EBF41AF0E4C31205B47E47DF0B0F4D45189C9FBD6E89364B17178B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2733a07309490d148870378d0b04515c741558c67f34b7a45687160c18e26856
MD5 dc0ff05a5854cbf7c274a5253225cdfc
SHA1 4fb7a4a0380b680299ccb8f6b084c9444f3289b2
SHA512 0148d38ac5e9c10e4fc5a2c8e51844297a62e6baddb6743b176f8449facbd9ab90a552fbf3dd10c6f6540601fe5fe1c3e691daca7da2a70ebedb0f3058abd7f8
TLSH
T1F621C0F787E085AEDA1156F0AA18BE1FCE1D0515432C3C1A85E4FF1793E3475E002A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c0ccdbbc6621ac1b3b5af4a3148d3043ee15e592c5bd6c9d174b31f07761e778
MD5 49eca0873da3d41456851cac0e18349c
SHA1 40f8d4cced65094b1c5a42ad351eda61ef90647c
SHA512 084b05245752356c374f31b6c4095aad6c6ca308fce9458da7ae3b1a95230d8d9329c976b0fe51ac480275c1f12d537215ebcbe3a2a75d25a497f04f82296e1e
SSDEEP 192:sxZWRiyM/jK1Ml8UQ7kB/fgs3dDwIdp2KHyzd6+WNAznY4740uIg5IJ:sxZWoqQB/fgs3xRFHtA+S
TLSH
T1C752E752AA345977CCDBD219FA51BF53D6F5447392901E48A9FCCA0C06E7AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b96ff6741c7ffaec7e388852a43e248dfa570de0586fa2d0c8fd4957ae717c63
MD5 7ff89a8bd766717a2f2833b9742e2e3b
SHA1 22c9745fa24b0e0f5c43ff8a492ccdf8878095ae
SHA512 04e17749ce97c83be172224dfa8d4bfad7d7e0d6968640220c345867267b651bae1ff61b6d233bd002bf138d6b7f46197d5015d3e14567d9bd575d0be04273c7
SSDEEP 192:sxZWRiyM/jK1Ml8MkB/fgs7dkjIdp0wHyzd6+WNAzAY4w52uIgrJ:sxZWoMB/fgs7e85HtLU9
TLSH
T10E52E712AB385977CCDBC219FA51BB53D6F50573A2900E48A9FCDA0C05E7AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6c1caac608b5d659add265bc319fdcff4123c1ae1286bdac49fcae8835c0547f
MD5 7dc79235f86ab2f04a929ff0ab6ce324
SHA1 9d2996ef7e0b1b5ee3f198f56e4c559322d87d80
SHA512 7f36a7fa0a3fa7f458b2c336e3fa292da1cab4064034e9673d41d6bff56221b4f2da9bc0d3efd8757a945db5fba5302a82463ab28ef5244cd4f4bec56ed9a100
SSDEEP 768:tN8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opduromk3Unj:tN8iJPNWvx76ru1jahALocdldUj
TLSH
T185D2FA3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EE51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d1976f8820f1b23416a90cbb5b521a1a09f3ca9985ecfa5669966b0d901214db
MD5 ed494d4c2bfbdd37fd2dfdc96831920e
SHA1 215f0858fb059056df2daabe26a8e95ca13221a5
SHA512 1523541916e2c388b03ecc718b456940b91d2124f3682c81575fd3365668c1c343268f21842ab654cd758ee235bb87370ecf15fd042391861ccbff3c208dc271
SSDEEP 48:KgpIVKKwovyhiIvKLC87yNRIRKCsEsGhwEOU4:KgpiKKwySioKLCCWRyKCs7
TLSH
T14891060271BF02022D7D7919A2B487574781B1B37128E43B7BA954B64E2AE344EFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5973a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5973a0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 3c1dc4e74def57d08f0fcc810370b8e74c31f69f569baa9d146d67b07ea06c2e
MD5 87a63f77b50f7c87f229cffd1ff3d177
SHA1 8ef1bd9e2069214a793be27d03b1f09d71470590
SHA512 dc567afaffb6eb407de22c4d2fb283880c0324d1973d334270820f1189a140793b90463fdb879a7fdee5df2972c49c90ef6f968e464751eff03f1a3f7ef25c2e
SSDEEP 384:xiF1tNn/s3n9SkzsN98TUNTUlIltQWlV1Jrwk/rqdSmn15wbAjEs2:YF1j+9jQwgtzkdSmn12bfs2
TLSH
T13BA26C339C689D3BADE39A85F54A32179FB580B7C7C56E95D6DC4A0C02DB2CC130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 cfafca63ce7f0426a942a197ab8417be2d5f579710b910ac4f2049b8272b3131
MD5 faca0422189430143a2310551c0c5c94
SHA1 3e734cf97bf82c5206fffbb9a1607e7da4c2b006
SHA512 b0424a4c1b1c6b0dde98d1f7a9e60613f72d839a0aa3ce9944874670924c6fda3524abf9746849911fcb1e76deaff900bcea2dd853d975da97ea9b60b6eb8f63
SSDEEP 384:RtNn/s3n9SfsNjsQWlV1Jrwk/rqkSmn15wbAjEs2:Rj+9UdzkkSmn12bfs2
TLSH
T169929D32AC786C3A5DE39545F547361B5FB8847797C82F9585EC4B0C06DB3C8230AE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a5e0980abf0e7c13584ca192107a7f5b85db3815e11696b9e299bfe9617131c0
MD5 b40366ef4ac015f70bb24d4c49503765
SHA1 dba0059ebd9e0c2876b9635953cd3e6eae5aa9b4
SHA512 aa71c1f414edeea4e5a7da8af2e5ddd412998d31f9a8d39bbba327d6b60e3516328642009b5f4755526b6340794d9e2171d3e703eeed94c152a5c4a23df37b15
SSDEEP 384:EtNn/s3n9SfsNjtQWlV1Jrwk/rqkSmn15wbAjEs2:Ej+9UqzkkSmn12bfs2
TLSH
T1EE928D32AC786C3A5DE39545F547361BAFB8847797C82F9585EC4B0C06DB3C8230AE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e774fa0c0bfc620a1dc2de7b58ee826016852275da334629132e81e03d908caa
MD5 5f72d3d69aaf06a777e2e0e56c468dd3
SHA1 58f99519249870ce78fe3def313a8d40571a3e88
SHA512 e241dcd666d4b0497fd759119360b102b318cf04e413139ad3b703ac00e388203e570f3820706ee073652858572a5dcb04dde8391dbaf00ecfe42e54797c2fc0
SSDEEP 96:ZqONk3QsjpfmUTmDK5ih/cIPURHl8h4otop5w5DKBhPwivh50xy0SFYKQAxsYssU:gONz6kDfQmiUySaZ9036TQie5U6
TLSH
T11502E935A8786CBB8EA3AE46F54777275FA5112BEA842F85D9E81B1C04D724C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ae03c50db9c3638c7dc68bf8871c2aef34a8a5e7b1564938188dfb9016652ab6
MD5 08fd4bbf5f6e7b720dad02f2a63ef6f1
SHA1 5105ddd4224dea4dc476780d0e0e6bdb6ee38ed3
SHA512 f0779b9758cb125c366410344a0cd63e748b84a9b8e60d111e059af19d36ced112d580510bbdf0f34e2124002046b25eb5ac8d7a94daf5c33d0bbcf9c3ac501e
SSDEEP 96:MqONkOQsjpfmUTSK5ih/cIPURHl8h4otop5wdDKB2Pwivh50xy0SFYKQAxsYssX+:XON26kvQmiUy4aw9036r1EYEcR6qiTU6
TLSH
T1DE122B72A8786C7B5DE3A841F48736135EA58127DF896F92D5DC271C06DF29C230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a38b2770-f34c-4a72-8dce-b226053e35ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a38b2770-f34c-4a72-8dce-b226053e35ce.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 69a1f47b36216e728844e459b5623e6cb584065ad166978cd17484908bf0248d
MD5 7b22f04fec8a11adc71ea54806f462d7
SHA1 d8a4a0c43611cff83331ce1c74604ef7b1f50070
SHA512 154c7c2efff0e19cc011595d6a1b4d9e4b6ef74f94605e311a9fe3de2fb0529a8f99efdfa18a6ecc3992adfa27bd334e59d58ff75fac1448ca95c0a58589ab71
TLSH
T18141E558A6F91108B3B76F56ABF7A86D487E7D772E0AD45E10010D8F0A32B40D9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download