hxxps://ziangel[.]st/

Analysis

max time kernel
148s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ziangel.st/
Sample260701-eyvcksgs21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1448	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273532998234686"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{187B67EA-9C39-463A-8311-2A8E435020B2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 636	1584	msedge.exe	87
PID 1584 wrote to memory of 1448	1584	msedge.exe	88
PID 1584 wrote to memory of 4652	1584	msedge.exe	89
PID 1584 wrote to memory of 4652	1584	msedge.exe	89
PID 1584 wrote to memory of 4652	1584	msedge.exe	89
PID 1584 wrote to memory of 4884	1584	msedge.exe	91
PID 1584 wrote to memory of 4884	1584	msedge.exe	91
PID 1584 wrote to memory of 2024	1584	msedge.exe	92
PID 1584 wrote to memory of 2024	1584	msedge.exe	92
PID 1584 wrote to memory of 3760	1584	msedge.exe	93
PID 1584 wrote to memory of 2024	1584	msedge.exe	92
PID 1584 wrote to memory of 3760	1584	msedge.exe	93
PID 1584 wrote to memory of 3760	1584	msedge.exe	93
PID 1584 wrote to memory of 1264	1584	msedge.exe	94
PID 1584 wrote to memory of 1264	1584	msedge.exe	94
PID 1584 wrote to memory of 1264	1584	msedge.exe	94
PID 1584 wrote to memory of 3684	1584	msedge.exe	95
PID 1584 wrote to memory of 3684	1584	msedge.exe	95
PID 1584 wrote to memory of 3684	1584	msedge.exe	95
PID 1584 wrote to memory of 3320	1584	msedge.exe	99
PID 1584 wrote to memory of 1276	1584	msedge.exe	100
PID 1584 wrote to memory of 3320	1584	msedge.exe	99
PID 1584 wrote to memory of 1276	1584	msedge.exe	100
PID 1584 wrote to memory of 2228	1584	msedge.exe	102
PID 1584 wrote to memory of 4132	1584	msedge.exe	112
PID 1584 wrote to memory of 3164	1584	msedge.exe	113
PID 1584 wrote to memory of 3084	1584	msedge.exe	114
PID 1584 wrote to memory of 3988	1584	msedge.exe	116
PID 1584 wrote to memory of 3988	1584	msedge.exe	116
PID 1584 wrote to memory of 1772	1584	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ziangel.st/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffaf729c188,0x7ffaf729c194,0x7ffaf729c1a0
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,18366827973976869172,6286195816189620262,524288 --field-trial-handle=2020,i,4701411083466969330,5288798022844474686,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,12314237679029094603,9702189777413976677,262144 --field-trial-handle=2020,i,4701411083466969330,5288798022844474686,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,3645023018620635956,17362755421161969180,524288 --field-trial-handle=2020,i,4701411083466969330,5288798022844474686,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,12833422403671797525,9325389569454816889,2097152 --field-trial-handle=2020,i,4701411083466969330,5288798022844474686,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,5359400910968220719,13078971702855928074,2097152 --field-trial-handle=2020,i,4701411083466969330,5288798022844474686,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,12690764026871246680,1111549210843141840,2097152 --field-trial-handle=2020,i,4701411083466969330,5288798022844474686,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,2656621168746790159,3060049104568389443,2097152 --field-trial-handle=2020,i,4701411083466969330,5288798022844474686,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:2
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,11252773520819747676,13512189455992102134,524288 --field-trial-handle=2020,i,4701411083466969330,5288798022844474686,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,4968139568576961031,12705158012976349191,524288 --field-trial-handle=2020,i,4701411083466969330,5288798022844474686,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,10172155708496421762,7984730304973170870,524288 --field-trial-handle=2020,i,4701411083466969330,5288798022844474686,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,10172155708496421762,7984730304973170870,524288 --field-trial-handle=2020,i,4701411083466969330,5288798022844474686,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,14622010790213274484,13973047436135976283,524288 --field-trial-handle=2020,i,4701411083466969330,5288798022844474686,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,14118554804137614686,6244180989086359155,524288 --field-trial-handle=2020,i,4701411083466969330,5288798022844474686,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,1005640154055771429,17139267831672073574,524288 --field-trial-handle=2020,i,4701411083466969330,5288798022844474686,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,6772865555165419750,15392341804793185036,524288 --field-trial-handle=2020,i,4701411083466969330,5288798022844474686,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5452,i,13378235595092900148,5179177690112123993,262144 --field-trial-handle=2020,i,4701411083466969330,5288798022844474686,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

762f36ae-4065-4044-aae2-4996df791a8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\762f36ae-4065-4044-aae2-4996df791a8f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e90e49afdeae0112e50bfd90b890e9671e04f31154bf1df8ffeccb7f08c075d7
MD5 519c1c249d52d328fafecaa80e96aa93
SHA1 38fb70b282fc32ba60f193c5fb1e58af1a5afdda
SHA512 0707fc415d86a3f8544b5611aa3001291af12164b01b3060482eb101ea149012068a3c4da16ebfc9c679d233376e813641173315eb2baec0b361ad0cf8616394
TLSH
T162711ADD3322D492D3600E30F7EF0693B9F141980A8F6D56F218597D6A0AB6F427B538
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c87b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c87b.TMP
Size 3KB
SHA256 69575d60c1a0457e6cf7c4b570e88f6681b690609052229c2aa471c62f53755f
MD5 ee1e7acdda77c4999670e19da2a48e90
SHA1 75f984d9f30243f280751d99c172be1ceaacfd8f
SHA512 6072b9fba434c0fa64a74553c81a8be10de16cc84bccb14b7afd63e862876b6099d233a708848762aae52372c2906a2eeefb32e27d14c734c722c0859351dd75
TLSH
T160711ADD3322D492D3210E30F7EF0693B9F241980A8F6D56F218597D6A0AB6F467B538
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 984bc314968ff9c1bf7312f2a7799bc06c85f6e6abe67195a09ea6832f9b6b7a
MD5 f9c6fba2c114e1c61956845e0f93c723
SHA1 401588357aec7fb5a205cc084abddf2acaf94cf7
SHA512 288025bfe77ba3ceba88a4a857e26b28783b30162091b8828a5c2b890086ac75f1f60bbbdf23e14cd1ece0a0ccfde562fe5879c094b8831f6e1dddacba16ae94
TLSH
T14841CFF3C7E4866DC91192F0AA14BE2BCE5D095583183C2AD9D4FF4BA3E2475E101A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e542e230bfff6efb0b7a9c172c91313e912ad8520e644ad885324867b4465fc4
MD5 7c0946a5ba07f058b80e80da6651b1bc
SHA1 09251849d3eb30172ec7f2d8ed74cfc473663b33
SHA512 c6491058e5c8641f5452001160fb46cebd0a20a13cc97a3693a48688aff8e49d25fa1045d7e09e83a20d19b74b6310b40731a4327e54f8e51c1101768d7adb25
SSDEEP 192:sxZVnYRIAyM/jK1Ml8MkYI/f4bsfCygVznIdp0VuHW6+WNjVDr/YwMoV+EabH+ch:sxZC3MT/f6sf4y1Hb5/W39
TLSH
T1E852E812AA349D77CCDBD209FA41BF53D6F55462D6900D48AAFCCA0C05E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7d47c8335e09942a1f90b57de3e536a4cd6db2cc2a3eebf486893dc3e2e5af58
MD5 fdc4ce0e70761bbf288dcb47d46e0f96
SHA1 2a46d0c211539245ae21c5f9426f967f372fb70a
SHA512 2c3b2fdfa0bc1e4c88417603b79686308955b56c9d3a4b27efb65e4851d56711135fd815ad1e211c1354002fae0a5f6ba980b0cdacc7bc5a891bb924813595cd
SSDEEP 192:sxZVnYRIAyM/jK1Ml8UQYmkYI/f4bsY/CzhgVznIdpCVuHW6+WNjVDr/YwMcVrE/:sxZC3qkT/f6sILynHb5/o3j
TLSH
T12152C612AA385D77CCDBD209FA41BF53D6F5546296900E48AAFC8A0C05E3BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 464920823159d823898fcfb9a1e7e2b40a94942160dd8615dbc62e319ac9caaa
MD5 d817e45f551b7463c13a4e9d9e1f8a0a
SHA1 a0711b171b2fb20380949f89f0fb1762e8facc2d
SHA512 47ae3d6eb4674e532b6e5a7b48d7a0d9e4886638322353c0ee35555f61f7621eea694be8893443d31cee4367ac59d7566c303624a828b52ff5b1c4f5e83426cb
SSDEEP 768:FO4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d6rohQcUaB:FO4jeXmWvmKLEu1jacPLZQdx9x
TLSH
T1F0D20A3B284CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ee2553af9234e742c7310c51b9c9ea9d2bc5efac13b9903e536895be11960c6a
MD5 33524ac8e5d5ca5f2372fe0cf7c4a476
SHA1 b56d56914b017c3403c9cada3f96bc3b25efd553
SHA512 506e805749a959e34102d1d1a843a63a4749d612a2d720b5fc2e93b22e8921736b4c7ae6df4c7a87cca020918f98a179c0beb3ecb4e2f068ac6a90c7a4b13c35
SSDEEP 96:K0CF6K+Iq66UKP6dOjyuIQAWWQVdguWK4zgsWcGOa:vx/oOjyuIQAhQVuu+zgsFGOa
TLSH
T14E912B02707B62413C7F281CE694965A4B8271633518B86B7FA801B70F67F695CFE8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca948746-1d85-4317-b989-3288a3076604.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ca948746-1d85-4317-b989-3288a3076604.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 16a78a731ebee3a1b389537c371af676b412b4a0c35b09cfa0c77e4776c4a3f9
MD5 98a6c7ad8a7e2223d5bac827dd3d48de
SHA1 8166fc95d626fa4c18cd4b3c610052598baa11f3
SHA512 3348da364b088cffbc49103e19fbcee752965a661027bcadf4d3cb992ca65ea7247ff0f3b1c7f22d67cfdcbc51ef3eaed91bfa8f19b4fb9a1b31252a60586a62
SSDEEP 384:6tNn/s3n9SfsNcU5owBbkff+G8WYWX1FWX0IidKzvafuP:6j+9Ur53xvW78KzaO
TLSH
T188928D335C39AD664DD29589F4473B138FF89267AB853F94D6EC6B1C00CE7AC230A912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6997aef9bc7274559aa7742cb9cf54f4ee61b8775667bcb8b2d6afde29e51c85
MD5 9b51cca1ffa9eddf21f79d180d487b5e
SHA1 15bf7f4e9a47ea0e14d5a527cbd4b9ce700e6e2c
SHA512 db41ec755cc5ede051107092dd219e3a3aa65b9bb78c720666f9b52a555d98896ad0f7b2468f7d41f6e2619a887d32026e7401615c31343ef33ac3609bd757c7
SSDEEP 384:LiF1tNn/s3n9S2zsNd8TUNTUlIlcowBbJff+G8WYWXZFWX0IidKzvafuP:mF1j+9xowgzY3xzW78KzaO
TLSH
T16CC21AF348D78D76C99E5B47B73E2E128EBCC157B6816A50B3985A0CCC862BFD306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 63232d9b012abae0fca833a0df512ca8b96ff6d7eb031104e813c50e685531c9
MD5 216a8582f4632f396a020f7a45c4dd08
SHA1 52b92e2548f9031a632c3a41916a2e840004cf5a
SHA512 ac55341cc247cb18cb48383cb89a1732f62683c46378d374346235ae2fdb1176e07585997190b0beeda511024c2a8a35d548642c4c78744af22cb896c2148914
SSDEEP 192:EONC6hZ0QmiUyVOVwpc/+jV0jzorWYt5wOZiPiU6:EONC6ompu+G8WYc29U6
TLSH
T13B02D935A8686C7B8EE2AE45F48777235FE5112BAD956F84DAEC1B1C00C779C2347832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2a8ff5b77432979b652cb6ef5dab3f0abc820bb5fe5381e894514f5afa164292
MD5 3e3309a9c0e8fb79072df81d2979b927
SHA1 28c3248e5429913b4b5885d5648628cb8f356003
SHA512 02707af4a6636dda66e9092c68a183f9875539557a6e71522bd53343637bd4828c4773d9aee129240efd642b351252e797a86259a00c1ad82f03ab27bdfd7086
SSDEEP 384:ntNn/s3n9SfsNcUcowBbkff+G8WYWX1FWX0IidKzvafuP:nj+9U253xvW78KzaO
TLSH
T123928E335C39AD664DD29589F4473B139FF89267EB852F94D6EC6B1C00CE7AC230A912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 20a805bf6fd6b64bee2e122d0e993467b3507e9963e03834e0d2e91961758e43
MD5 30801c92d4b78daa87d6f4a21c989376
SHA1 e50f784139d9b84966bd5e79d44655ea86db7a94
SHA512 fd469c500ec0afb9623222af5531ea4f40db42a9651d9e4fac10a3feab3458ad07a0f82d304e2d303dedc7c44a03f15b17c0c7df22649d58c51a442e1e5b6cf3
SSDEEP 192:f1ONra6hZ7wQmiUyVHVwfVc/+jV0jzorWYWXo5cOqiwqnU6:NON+6YP9u+G8WYWXz9WU6
TLSH
T1EC12F936A868AC6B5DD2A545F48736134FE95117EF857F80E6EC2B1C00DF6AC134AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0827fc77-623f-416c-a536-c84f1d14fe99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0827fc77-623f-416c-a536-c84f1d14fe99.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 870b3b58b1498ab14afe26929b8da1fdc3c17ae515d75447824fa020316b993e
MD5 17eb94f7c93c6ab62e87097b9bcbcb02
SHA1 8285aa407927f3b9ffcc34f401a97ca602b5c66f
SHA512 678ec531810db614b23c94300b6c5367e9947615f7bf2683df69e9d6cb84d42983e2a252ef600f565b4bb6065fc9b45396a6c0083f82295aea54b62d4db2a854
TLSH
T155410B58A6ED114CB3B36E5A9BF7686E987BB9772F07C06E10110E4F0662B40DC61733
MD5 SHA1 SHA512 TLSH

Submit Download