01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FOSSBilling-main/src/data/log/index.html
Size 1B
Sample260710-wwpsrag16v
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4248	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281814191555476"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{C32FE135-6D5C-483D-A16C-016AF345B036}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3564	1936	msedge.exe	85
PID 1936 wrote to memory of 4248	1936	msedge.exe	86
PID 1936 wrote to memory of 3696	1936	msedge.exe	87
PID 1936 wrote to memory of 3696	1936	msedge.exe	87
PID 1936 wrote to memory of 3696	1936	msedge.exe	87
PID 1936 wrote to memory of 3068	1936	msedge.exe	89
PID 1936 wrote to memory of 3068	1936	msedge.exe	89
PID 1936 wrote to memory of 2900	1936	msedge.exe	90
PID 1936 wrote to memory of 2900	1936	msedge.exe	90
PID 1936 wrote to memory of 2900	1936	msedge.exe	90
PID 1936 wrote to memory of 3808	1936	msedge.exe	91
PID 1936 wrote to memory of 3808	1936	msedge.exe	91
PID 1936 wrote to memory of 3808	1936	msedge.exe	91
PID 1936 wrote to memory of 1664	1936	msedge.exe	92
PID 1936 wrote to memory of 4580	1936	msedge.exe	93
PID 1936 wrote to memory of 1664	1936	msedge.exe	92
PID 1936 wrote to memory of 1664	1936	msedge.exe	92
PID 1936 wrote to memory of 4580	1936	msedge.exe	93
PID 1936 wrote to memory of 4580	1936	msedge.exe	93
PID 1936 wrote to memory of 764	1936	msedge.exe	98
PID 1936 wrote to memory of 764	1936	msedge.exe	98
PID 1936 wrote to memory of 3288	1936	msedge.exe	99
PID 1936 wrote to memory of 3288	1936	msedge.exe	99
PID 1936 wrote to memory of 2552	1936	msedge.exe	101
PID 1936 wrote to memory of 3344	1936	msedge.exe	105
PID 1936 wrote to memory of 1200	1936	msedge.exe	106
PID 1936 wrote to memory of 3836	1936	msedge.exe	107
PID 1936 wrote to memory of 1308	1936	msedge.exe	116
PID 1936 wrote to memory of 1308	1936	msedge.exe	116
PID 1936 wrote to memory of 2668	1936	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\FOSSBilling-main\src\data\log\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa394dc188,0x7ffa394dc194,0x7ffa394dc1a0
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,3601122946342784535,5505738695417003548,524288 --field-trial-handle=1960,i,16893217209661894842,5501684255010088040,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,9048599022508270086,3389916109600896628,262144 --field-trial-handle=1960,i,16893217209661894842,5501684255010088040,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,7156167067591697151,293141431851576770,524288 --field-trial-handle=1960,i,16893217209661894842,5501684255010088040,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,7602429610174840675,9770057784915878232,2097152 --field-trial-handle=1960,i,16893217209661894842,5501684255010088040,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,8543420438481632518,2331807764848134392,2097152 --field-trial-handle=1960,i,16893217209661894842,5501684255010088040,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,15699917756373040069,13980319738838590692,2097152 --field-trial-handle=1960,i,16893217209661894842,5501684255010088040,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,14557464087572171664,5303705237092777194,2097152 --field-trial-handle=1960,i,16893217209661894842,5501684255010088040,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,3774564940524346067,16591941849564925339,524288 --field-trial-handle=1960,i,16893217209661894842,5501684255010088040,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,5700923213705044722,6898868385373258391,524288 --field-trial-handle=1960,i,16893217209661894842,5501684255010088040,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,13312370445581709461,14684043565256399580,524288 --field-trial-handle=1960,i,16893217209661894842,5501684255010088040,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,13312370445581709461,14684043565256399580,524288 --field-trial-handle=1960,i,16893217209661894842,5501684255010088040,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,27380995036603825,6338551420803049198,524288 --field-trial-handle=1960,i,16893217209661894842,5501684255010088040,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,12212470653600242662,6076320530187350647,524288 --field-trial-handle=1960,i,16893217209661894842,5501684255010088040,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,3621372052260009105,6005745902929693350,524288 --field-trial-handle=1960,i,16893217209661894842,5501684255010088040,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,12146412017664750707,13174192724190580039,524288 --field-trial-handle=1960,i,16893217209661894842,5501684255010088040,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,16238115092495950204,7094183624917359111,262144 --field-trial-handle=1960,i,16893217209661894842,5501684255010088040,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f2184aaf5f3af9e57133e924181625f0bd42aa4efb2776ca17c698792c41b473
MD5 cc392c2efc8036e3b52e4b699b45aee0
SHA1 54a21d8cd2f092208c466c29021fe12cbba423bc
SHA512 4860fdf04bcd25bd36c5fa4fbfb23bdca3b9cc509d72b5530b2153842835a35f27dd2639a4b8fdd61bb805963ae40c574428ec46288e5d6f73b659871b05f5db
TLSH
T1BA714E3701C940C2DB82013A54F26284F8BD82EAF53FDF5510F7AABE4B93711815A17B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b503.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b503.TMP
Size 3KB
SHA256 6aa294646037b780d3d0d17c6a92cdd74371fc5bb71bf3ac88200f5e97326760
MD5 77093d7141e9d5a4a6b576799d2f0736
SHA1 8b6f2175079cc69ceaab6a89761cf9059bb9c341
SHA512 db7a8210823181d587996185f3972e84bdf64b16c6d5f32a43f212588a21856aaf7368741f614c96604bb538d885e8b92ea886bba9b239a1ca45dae4e758ccca
TLSH
T14F714E3701C940C2DB92013A54F16284F8BE82EAF53FDF5150FB6A7E4B93751819A1BB
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 899B
SHA256 1d06358ab99f69a86cc48a29a8e0f793dd47faf5f1e2041603e40dc973e8b48b
MD5 b2cd46c051759a2cbb83fcd02cfb05b7
SHA1 127df1b1302d1afef4aa2c6a132753b22c75646a
SHA512 a7f162edf48b84231d485bedb332a9db6a53040ec917612c2ca90e7b758936eb9d0b06ea54270d5ed2fb556f8397abb472c1eafe5e32610e307616ab7e1160ea
TLSH
T1C2119CF783E4896E9A1146F0AA186F1BCE2C0542432C3D5A86E0AE1B93A3468E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 af938592c35db47633a98c01646415da4ee2c5745eeff88f3627dce2fad01f87
MD5 4438e3f650dace2f9df4149a71d1af56
SHA1 1761f58bfe6c08caec4e68187fd40107b348f167
SHA512 15985689bdbf3d39852948e745aefd646c70867747eeffea2d70ce7f68a07c857e99a40c242d0cae62c2109a96dc7bb028b9fbb75294c320c27a4733036e723d
SSDEEP 192:sxZgRSyM/jK1Ml8UQBkj/fVsJqa2IdpH7HW6+WNGYzASTdIg5PJ:sxZgoqSj/fVsJqmbHbGG3
TLSH
T1C152E8526A385977DCDBD209FA41BF93D6F4547292900E44AAFCDA0C00E7BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d2ad40e73585b472b0f5a1449a5cb84c4bbdb6030fac009e10c96b4c44e8abda
MD5 74a76a54a9749e94e4baea504fb4df34
SHA1 3d3e80d7d242f16331e895f8c1770e9e96d852c7
SHA512 240c82bc039ea048f285ab1e9a8a6cfb842a577f151eeacb457904fa02a4359987b5da96b6c6e476fe44ebfcf843f404abecdabec6c72db3ba1e4c3b0ddd1bc7
SSDEEP 192:sxZgRSyM/jK1Ml8Mkj/fVsCva2Idpd7HW6+WNGYzQDTdIgrJ:sxZgoMj/fVsCvmNHbG99
TLSH
T1A042D8126A38597BCCDBD209FA55BF53D6F4157292900D48AAFCDA0C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 03e7f2d870a5319ba8e75b6fe1d8113064dd63d718710e2eddfcd8b7b0fbd7af
MD5 d0a5adbfd892929bd35371ebce25901a
SHA1 16b6d5773401cae41edb4718c24896283ef6bb1f
SHA512 c9ad4dc857de3556869580c33da167c0924e5f2cfefd1944dea61fcbc93d689b412940d41aed95de9360a464d8de9c938ca085da3385a74077ffe52d4aff04ef
SSDEEP 768:ULW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj3roIdiJY5:ULW7kf0Wvqidau1jaa5LA3jk45
TLSH
T13BD2FB3B684CCB7E4F840E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595087.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595087.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3d9594d5fefb78ca552a399811bd5f5c3378148e56326c014c4c77b884f81cf1
MD5 ae1a09f635e94955215a917c519136e7
SHA1 f6d601fd032577d58dae2f57840b1866f9163571
SHA512 269e2f4c0d79fd995c9b1d5df42f491b629439b165c8f9dfe0f824da2ef5e14862ed31fbbde0405f50a410648d5da86792007cbb2c47805e22a45fd8e243629a
SSDEEP 384:+tNn/s3n9SfsNJ9BxF7bKi5tbM2jJOObjI9G6w7Al:+j+9Uor7mSVzjJ29MAl
TLSH
T148928E337C799E7AAD92A254F08B3B175FF8417B93842E44E6EC6F0C05EB2AC1316516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 141760af2139ccc4aa16ed803c35d2e6a4bcffdfabe3ec0092221e50e4174b6f
MD5 e3a64590945cf770e9259ca742131017
SHA1 62641cecba83ac47499e4bc06a8f065ddda97fc9
SHA512 612a6d2eadf6505214ef93337b1e5f5026b8b8f76970723e94416875cb5abbeff34797ffba0a64117906f4aa162b6dad340e97fa4d999ae570d17963c368f0d7
SSDEEP 384:miF1tNn/s3n9SOzsNr8TUNTUlIlgBxF7bKi5tbM2sJOObjI9G6w7Al:NF1j+9lKwgCr7mSVzsJ29MAl
TLSH
T103A26D336CA8CE7BAEA29B94F54A37179FF441BBC6846A80E7DCAF0C01D719C1306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5fefbbdcf6d64c00ad148ca986a35f325590e65ed256dfbd831bfe78855a927d
MD5 ea1d1a489cba4c60a0b65b63503773ff
SHA1 03af2a9e3c3d7c9748c17ebdb80a77f63f98a615
SHA512 c0d006b9d4d6f4408c4dd5d07dbd5cb13533118278ddae0fbca211b6fd904295d4efecb1ceb1fcd02040a0617d13ee31443fa2dddc621bcc1e6fdc43a2989904
SSDEEP 192:MONo64BAQmiUyi1mW5GBPK7hCI9waDPXU6:MONo6eA1oWQM5/U6
TLSH
T1CB020A356C796CBB9EB2AE44F48637175FE8117BE6945B40EAE82B1C00D764C230392B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 44b807f916440e3c0a4ed8d7d357b411084a192c0e52d9ab5e9fce2dd08bb1ef
MD5 f0a0c336b7602983eabceaa000ca115e
SHA1 d7ce51a4e3c6ffecdc9e877d1429852e08aaae6f
SHA512 8493c0aaa86a624e7b407cd185c801444b0b740c4b0bccdd9fc0ff69edbea34cac3406b007dcde5308f55407cfa733645aeb7a4884651807b2254c492addfb53
SSDEEP 384:VtNn/s3n9SfsNJgBxF7bKi5tbM2jJOObjI9G6w7Al:Vj+9Udr7mSVzjJ29MAl
TLSH
T137929E337C799E7AAD92A150F08B3B175FF4417B93842E44E6ECAF0C05DB2AC1316516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aa617ec880ea81c611b14d99c2c3949145241a112f8d62e53be5a34ab41e6f2e
MD5 9554738bad497c2cbb04611b14c9bc2c
SHA1 912be22ac9f5d4176a5a275cc3be84be9b55bf17
SHA512 3e840cf6624cb59e0a8bc6c494b7dab5e482ad7006c7012a33888200633497b995a4ccaa326ced454cebf103bfa7f8887a5a9fbe3433122555695051568cc3d8
SSDEEP 192:dONM64BiQmiUy1mv5GBPK7hCI9jlEoWw7qpoU6:dONM6eehvQM2OJU6
TLSH
T136120A777CB99C6B6EA2B590F4C637035FA5412BE6846F40E6EC2B1C05EB65C230B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

361984dc-e93e-424a-9979-4c067687848c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\361984dc-e93e-424a-9979-4c067687848c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c1e25548dc60e1f7f78b414d5e8a292af125024b9da4158dc9266d488e7411b2
MD5 4dc7170b08e7232da0d66deb1a22b164
SHA1 11fca749f085d03c68389796e65965d978735375
SHA512 c58f34e9214c74ae81a32dba98659b8d33c7a2bff16b3f5041697c9889800e4ce2a9056531e6d976b9c7acc993df22cdfe85c04cd87e89cdbdfdafee0c321b4a
TLSH
T1D1411898AAF91148B3B76F5A9FF7A96E447B79372E06D05D10010E4F0A62A80C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download