01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FOSSBilling-main/src/data/log/index.html
Size 1B
Sample260710-wtnsnsgz21
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3968	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281808105538849"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{5DAEA04A-4836-474C-938F-38F64C139ABF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 2192	3456	msedge.exe	86
PID 3456 wrote to memory of 3968	3456	msedge.exe	88
PID 3456 wrote to memory of 4900	3456	msedge.exe	89
PID 3456 wrote to memory of 4900	3456	msedge.exe	89
PID 3456 wrote to memory of 4900	3456	msedge.exe	89
PID 3456 wrote to memory of 4704	3456	msedge.exe	90
PID 3456 wrote to memory of 4704	3456	msedge.exe	90
PID 3456 wrote to memory of 4768	3456	msedge.exe	91
PID 3456 wrote to memory of 4768	3456	msedge.exe	91
PID 3456 wrote to memory of 4768	3456	msedge.exe	91
PID 3456 wrote to memory of 4292	3456	msedge.exe	92
PID 3456 wrote to memory of 4292	3456	msedge.exe	92
PID 3456 wrote to memory of 4292	3456	msedge.exe	92
PID 3456 wrote to memory of 3736	3456	msedge.exe	93
PID 3456 wrote to memory of 3748	3456	msedge.exe	94
PID 3456 wrote to memory of 3736	3456	msedge.exe	93
PID 3456 wrote to memory of 3736	3456	msedge.exe	93
PID 3456 wrote to memory of 3748	3456	msedge.exe	94
PID 3456 wrote to memory of 3748	3456	msedge.exe	94
PID 3456 wrote to memory of 1044	3456	msedge.exe	97
PID 3456 wrote to memory of 2916	3456	msedge.exe	98
PID 3456 wrote to memory of 1044	3456	msedge.exe	97
PID 3456 wrote to memory of 2916	3456	msedge.exe	98
PID 3456 wrote to memory of 4160	3456	msedge.exe	100
PID 3456 wrote to memory of 2568	3456	msedge.exe	110
PID 3456 wrote to memory of 4380	3456	msedge.exe	111
PID 3456 wrote to memory of 2440	3456	msedge.exe	112
PID 3456 wrote to memory of 1916	3456	msedge.exe	113
PID 3456 wrote to memory of 1916	3456	msedge.exe	113
PID 3456 wrote to memory of 4528	3456	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\FOSSBilling-main\src\data\log\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x25c,0x7ff94aecc188,0x7ff94aecc194,0x7ff94aecc1a0
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,12908694528693706046,9226784988117454420,524288 --field-trial-handle=2224,i,14401848465152428710,12365252376591462702,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,4238085693553416735,17329439461342468509,262144 --field-trial-handle=2224,i,14401848465152428710,12365252376591462702,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,8976097529723256446,15164370114211826129,524288 --field-trial-handle=2224,i,14401848465152428710,12365252376591462702,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,16913918701316452170,6491360965441611659,2097152 --field-trial-handle=2224,i,14401848465152428710,12365252376591462702,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,9077866765674765513,5603888300566204171,2097152 --field-trial-handle=2224,i,14401848465152428710,12365252376591462702,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,7848240035675991193,9361065831719353027,2097152 --field-trial-handle=2224,i,14401848465152428710,12365252376591462702,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,9851787487531980086,11572168137985121366,2097152 --field-trial-handle=2224,i,14401848465152428710,12365252376591462702,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,7697410867679928907,13009035573608607848,524288 --field-trial-handle=2224,i,14401848465152428710,12365252376591462702,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,11824649861868472908,1514216331096843456,524288 --field-trial-handle=2224,i,14401848465152428710,12365252376591462702,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,3776693796615070152,10822050277164624699,524288 --field-trial-handle=2224,i,14401848465152428710,12365252376591462702,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,3776693796615070152,10822050277164624699,524288 --field-trial-handle=2224,i,14401848465152428710,12365252376591462702,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,16516276285229952278,50777293588347301,524288 --field-trial-handle=2224,i,14401848465152428710,12365252376591462702,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,8575502461949719621,2676850748826665068,524288 --field-trial-handle=2224,i,14401848465152428710,12365252376591462702,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,6541560663338914357,3200989468996456332,524288 --field-trial-handle=2224,i,14401848465152428710,12365252376591462702,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,7608437245485142048,5740318797660934131,524288 --field-trial-handle=2224,i,14401848465152428710,12365252376591462702,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6156,i,7791232153677345374,3641764073216554425,262144 --field-trial-handle=2224,i,14401848465152428710,12365252376591462702,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

1e142453-15e5-43e7-acad-e19a3b9724aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e142453-15e5-43e7-acad-e19a3b9724aa.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 54080bc22815c7360ba51aad01e965c85eb1bd566f774f1dc1472e4644a94d30
MD5 b121b88dffce425e126e23efaa76130f
SHA1 b67e69cd59b4867d0529afa6cecb556e2b3a4224
SHA512 e21257fabb237622dad1c7bc958674662358b861e50a2f6471455a69efabf7d10f3896b7a72928b301539318303a01934ff1eae71ed21f32867cd7b62a72d63e
TLSH
T1F871713B126209BAD3AA8033D0F323013177AAEAF4235E5A17708CB76634B52B19957D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 54cdcd128baa2135d5065026c6e4056238345cd48e3b5a948483537379b7b7bd
MD5 de422f2054d18a028719ba76a94abc46
SHA1 c3c0e01c193f0e985fe4161488b8825e0396d5e2
SHA512 3aa931f124212390c77a14018b5c1cda266d26f83306cc6cd311c9a5defe793528ced42e2b54cbb407ae0e4aa8b9921435884fe380378166fe0db6b1c965e382
TLSH
T17821A0F7C3D5856EC91156F0AA28BE1BCE1D0501431C7C1986E4EF2BE3E3475E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0039f093a127e72f2afbb6e28d1bfbd1f3e4d76a092ada81530ef43541422af6
MD5 4daa68f78fbfec4b1abe637ffb82de56
SHA1 f4e2f2e9a5043c9637682e98cd9c2fd0bac2c4a3
SHA512 6abfbc6a9889b7171a3c804d3db8073edee9957feff98e719db946b9cc7b0d8f747a80f78ffa841ac4a7745d524bb1aafb568c2412be750ed915a85575bb91b8
SSDEEP 192:sxZZRCyM/jK1Ml8MkJ/f7s4bqIdpdoHW6+WNGYIkStznIgrJ:sxZZMMJ/f7s4bjCHbGHn9
TLSH
T16142E816AA345D7BCCDBD209FA557F93D6F9457292900D44AAFCCA0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a2a9aaaa7b8beea937c123839127a5174b39650481092a2efdc9906a3a39a7db
MD5 ef75900551482cb586ee5e46002dceff
SHA1 ddafb5c32d4cb826b1d67144e67de0a9fc6a5c29
SHA512 92b50c1716adf43d84bd3cd6f5415c59ffc171f1f1237c0ce72e47b76004c1ee970f67f50464cb671ecab82672ac6c930ebad791b04389129780d75218cc41b1
SSDEEP 192:sxZZRCyM/jK1Ml8UQ7kJ/f7sgFqIdpHoHW6+WNGYI1JLznIg58J:sxZZMqQJ/f7sgFjIHbGRni
TLSH
T14052D616AA345D77DCDBD20DFA457B93D6F5547292900E44AAFCCA0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1d989872641c7c4ec5b1eea0bc291f475b39466e593e02a4587cde414bd808d9
MD5 47c9d346cb6c4987251907d800e3f2b1
SHA1 4fefc27a7f8eaed04f4b911eeae76aa4a11b061d
SHA512 adac288319d9a8e4f1aac35bd7f0bb3b55cbcdd0b0b4a14873d085122db29bcce3dc8243359067e2a9e420100ea3446ce5cff50349dcfc03d718f67ebd85632d
SSDEEP 768:UCsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR90roFZ9:UCsqxXlWvJD6Tu1ja54LAs9fF/
TLSH
T12BD21B3B694CCB7E4F840E5DEC266FD66ED801CBA6988D5447FA880C03CB3EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 352f657fe49d56ab4fc77d6471b1b7cc5a95f7a0456f42ad22ed09fce1391d3e
MD5 2e07dfe75327f19d93201c947e4a4996
SHA1 7aeff4098745847f860d70df321ddade39a26b6f
SHA512 ef8abcfcddeef72e154dd1020ffe27a65fad2a628c1c9a0e999e631e64625bcbba9f8c70504875968c03532bc492184809e746d8afde884b5f70c9e4548f5239
SSDEEP 96:KYbaKYIK6m0Knq6+HuKYYj5uKiYCiE4KxCt:ExX/l9ZfC
TLSH
T145E10502713F02033ABD7908A3AA8A374E4275A37458A4BF3BB955614EB7E115CFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0e35468-5b94-4342-ac53-c9ccc6f1bd40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b0e35468-5b94-4342-ac53-c9ccc6f1bd40.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 b045384ce4280ee0cbbcdd5e497dff66929cdc7012b0936128d18511ca6a142d
MD5 d271de5a6dab3173c8dae302a37df5bc
SHA1 21a30f991531de2883600035ae1907591e8dea7f
SHA512 62e6c939a45559fe81a0df2f739a70516a1268365d967b18546942b66ec9ca6104983908d27bcf5feadc12b273acfce02c2de3a68d48b5906fd72b619632c0ce
SSDEEP 384:9qiF1tNn/s3n9SLzsNH8TUNTUlIlSRbM/GVRNwOWG9Jv3OOObjI9G6w7SUj:9hF1j+9Y6wgxkHwOp9d3O29Mn
TLSH
T1DDA27D339C188D7BAEE29A59FA4B36578FF441BBC6856E84E6CC6E0C01DB6DC0306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 feb3987d5c71abd77304ac097bba924af871c3ca8368571b19e95dc01ffb5876
MD5 ea33f91155a400f6008a6f7bc2092fa7
SHA1 d4ef113567fb1dc73e9bcab82a76a0ef623c5182
SHA512 98054a396b0360be395cefab2afa4d27cd9f80d8e3ec4c4a5d55883f4eff605174cf32655e96a941606fb039ae72eb103813b8fdb11aacaf5010a8c24647c1df
SSDEEP 192:tONg6JkRtQmiUyhHW+RNwOmhOmQh33jRQU6:tONg6Ur2W+RNwOW03SU6
TLSH
T14F02E935A9381C7B9EF2AE49F54B27175FA4103BEA852F80DAD81F0C01D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8d6a12bfa03a1861053f77a9c2866641e5a85cf4cef80e10eb4df4af6f580c86
MD5 993e91814c8311e931d03ed5c5a2ccaf
SHA1 651521e1fc7748a2cca7b04da50ba6743aaa9130
SHA512 2e1a8f6b9fb75a49bc46c1090ff4f466049d8a99c9520851030cd2df852f0872adeb9bae09d21a31fe7ee1f754a56cef4b25838a4b6f0f9e44cc6f91b03757e4
SSDEEP 384:bDtNn/s3n9SfsN9TRbM/GVRNwOWG9Je3OOObjI9G6w7SUj:bDj+9UPkHwOp9k3O29Mn
TLSH
T1B9929D316C384C739EE3A559F58B3A5B8FF4917B97882E84D5DC6F0C02DB69C031691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 86fe20bf71ae4b2492d2df0a5b9eb23bcca3dcf0be732cc94e727e071159d702
MD5 7834d74763f5c4550cbc2c4ccd7e5b4b
SHA1 58ee71addd28273642204edff2bfbbeb7131c541
SHA512 7541175eff72e731f9f8455f96b2fffff5bc7f541ef4e2aac39dbbacc85a79ac253c499e596c387772cb7d0126dfc75acc49f55e55cc1e369cff1e75e9cd28d4
SSDEEP 384:lDtNn/s3n9SfsN9SRbM/GVRNwOWG9Je3OOObjI9G6w7SUj:lDj+9USkHwOp9k3O29Mn
TLSH
T112929D316C284C739EE3A559F54B3A6B8FF4917B97882E84D5DC6F0C02DBA9C031691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8f2be6bbe44efee1d361c9703a7814751e0e9f5e26a2db13a3a2ba0c1af819bb
MD5 cc20ca30b2d49c86af70f805568de345
SHA1 0020ba5d5b4eb12b54f5a239805c9fb6a6cd8cd3
SHA512 101374862bbfed444739b428b2a38ea26d3675ef12e914414a7a3522a737ef4d4a506b09e09932e42e98f7a35204cd0acacc429e0d1df6ad2e242c93e73791c8
SSDEEP 192:YONA6JkRFQmiUy1HS+RNwOmhOmVU9DFeVc3nqV3U6:YONA6UjgS+RNwOWG9JJ3OU6
TLSH
T1CF121A31A8385C7B5EE2A445F58B36575EA5513BEB892FC0D5DC2F0C01EF69C234AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8b723f4-18cb-42f5-a78c-4a1fbe75850e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b8b723f4-18cb-42f5-a78c-4a1fbe75850e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a26a25cf97435b05e66194cc2bdcdb5dc07e5b561fb4a2572b4ab3bd13b43088
MD5 449c3717b43395db0f7142f5c50e20c9
SHA1 80b530762041e272267180f913ae80ac6bcf8147
SHA512 e61593538db83698b7d7b3c704f9a943fcbcaa38ef1ab4a8036b4f65176e02471f8d74285bc77b80071094b2eef18c7d47d3b88aaf044f04004891c4f42705e1
TLSH
T1FE412B59BAEA104CB3B37F56ABF6A46E447BB9372E0A849E00010D4F0562B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download