01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FOSSBilling-main/src/data/uploads/index.html
Size 1B
Sample260710-wwpsrag16v
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4444	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281813361018068"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{93BA3AB2-3247-40CE-A1CC-CA1F27A44562}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 1676	2992	msedge.exe	85
PID 2992 wrote to memory of 4976	2992	msedge.exe	86
PID 2992 wrote to memory of 4444	2992	msedge.exe	87
PID 2992 wrote to memory of 4976	2992	msedge.exe	86
PID 2992 wrote to memory of 3160	2992	msedge.exe	88
PID 2992 wrote to memory of 4976	2992	msedge.exe	86
PID 2992 wrote to memory of 3160	2992	msedge.exe	88
PID 2992 wrote to memory of 3108	2992	msedge.exe	90
PID 2992 wrote to memory of 836	2992	msedge.exe	91
PID 2992 wrote to memory of 3108	2992	msedge.exe	90
PID 2992 wrote to memory of 3108	2992	msedge.exe	90
PID 2992 wrote to memory of 836	2992	msedge.exe	91
PID 2992 wrote to memory of 836	2992	msedge.exe	91
PID 2992 wrote to memory of 3156	2992	msedge.exe	92
PID 2992 wrote to memory of 3156	2992	msedge.exe	92
PID 2992 wrote to memory of 3156	2992	msedge.exe	92
PID 2992 wrote to memory of 2304	2992	msedge.exe	93
PID 2992 wrote to memory of 2304	2992	msedge.exe	93
PID 2992 wrote to memory of 2304	2992	msedge.exe	93
PID 2992 wrote to memory of 3144	2992	msedge.exe	100
PID 2992 wrote to memory of 4308	2992	msedge.exe	101
PID 2992 wrote to memory of 3144	2992	msedge.exe	100
PID 2992 wrote to memory of 4308	2992	msedge.exe	101
PID 2992 wrote to memory of 3708	2992	msedge.exe	104
PID 2992 wrote to memory of 4740	2992	msedge.exe	109
PID 2992 wrote to memory of 988	2992	msedge.exe	110
PID 2992 wrote to memory of 1788	2992	msedge.exe	111
PID 2992 wrote to memory of 4656	2992	msedge.exe	112
PID 2992 wrote to memory of 4656	2992	msedge.exe	112
PID 2992 wrote to memory of 3828	2992	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\FOSSBilling-main\src\data\uploads\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb6119c188,0x7ffb6119c194,0x7ffb6119c1a0
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,11137825784011510560,10445067914741529905,262144 --field-trial-handle=2096,i,5803553246400794839,12438201456519096038,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,9167845616154956978,5909477059159643913,524288 --field-trial-handle=2096,i,5803553246400794839,12438201456519096038,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,14613389669707964848,14116494881366818684,524288 --field-trial-handle=2096,i,5803553246400794839,12438201456519096038,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,10167308378703133463,13052869132825204040,2097152 --field-trial-handle=2096,i,5803553246400794839,12438201456519096038,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,165297806471808653,1974461700455961389,2097152 --field-trial-handle=2096,i,5803553246400794839,12438201456519096038,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,12621656225720069284,2703024400001533003,2097152 --field-trial-handle=2096,i,5803553246400794839,12438201456519096038,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,13038664513004051997,2243983774067885152,2097152 --field-trial-handle=2096,i,5803553246400794839,12438201456519096038,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,2226492280544940454,7671191580879588757,524288 --field-trial-handle=2096,i,5803553246400794839,12438201456519096038,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,2964408232692510847,7545044761390003958,524288 --field-trial-handle=2096,i,5803553246400794839,12438201456519096038,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,7874589922311573262,17205082834760131,524288 --field-trial-handle=2096,i,5803553246400794839,12438201456519096038,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,7874589922311573262,17205082834760131,524288 --field-trial-handle=2096,i,5803553246400794839,12438201456519096038,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,5631695180542555156,9822939294702377751,524288 --field-trial-handle=2096,i,5803553246400794839,12438201456519096038,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,13676328099441043886,13521892809224144883,524288 --field-trial-handle=2096,i,5803553246400794839,12438201456519096038,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,7846435538573430101,15829306514128252607,524288 --field-trial-handle=2096,i,5803553246400794839,12438201456519096038,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,3503240148009633385,9663971538351433814,524288 --field-trial-handle=2096,i,5803553246400794839,12438201456519096038,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6124,i,11991225338953370649,17551034143198923455,262144 --field-trial-handle=2096,i,5803553246400794839,12438201456519096038,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae10af80c983ecdad438965cb208911f945e43bc36fe488247e2cd8bad97b450
MD5 f5ccd04bc3cab603843f2aa41a035cdb
SHA1 a4745772a8bc8f2c6e201e674b2ae558abaeb5f0
SHA512 e655264449a4bb6b25d28102be4b80887fc34a446f6baa3f02657035b3c41c200becbfdfe3947962121baf11f7b7315d8b709736af52453e82162331001d4608
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7A:fwUQC5VwBIiElEd2K57P7A
TLSH
T121B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 aadf9fa6691ab1396da52caae386afd76806462f558d29458c1f0bc36eaea759
MD5 4e9fde06117f8a763315c3087943a666
SHA1 a475038b137b2082e81c3318c88c80f23f8e7759
SHA512 2347e8af3ee26a93225876c1d38a8b6a7897b2d97f1a792fe2a4e3a6e646fd04f4b75fedad6a0c3bea590e3851915143b113148a8b8215ee4bfa50a99cc61798
TLSH
T10B615D1802C24972EFBE1072C0F196153EF3599F8EDB8E1247E4C4FE603AB5EA9E6004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b32e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b32e.TMP
Size 3KB
SHA256 a93ce05e091929800b3bd1759051cae2de2814ab5d678a844491ab44eb1cf957
MD5 43d44013ca2e8494708c6c99b8de15ff
SHA1 8fe40f216877f78c90306d1fce2d0a1173cd053a
SHA512 44ebb256eb49912e1b55544def4afcec7aa2d4224a7eb89ed545ea5ae350c15929286cc0040a4cd455ffb216fb48a0d4db79f1587d833bfb0228782952781c1b
TLSH
T114614C1802C24972EFBE1072C4F196193EF3499F8EDB8E1247E4C4FE6039B5EA9E6004
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 430b00509b6deff02239cec0a50d018618ee2dae83cd89693d5cc8f81f4b795c
MD5 34a0b2ed9a38e755970691a67ffebc36
SHA1 6efe09066de75d909f9ac796ceb7e6900ca6ba33
SHA512 3c972e1a09feec8507baf2a1f7761678d288b55436d6cb7ac74b32c5b9d979d2d7fb8e4c28961d97cb4d484a01347944ac71c1c5dc13558651b4e9418f2c42d4
TLSH
T1DB117DF3C3D585AE891116F0AA24AE2BCE2D0606831C7C1986D4EF2793E3075E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 982f206522e33d843c1308d7d85a0f9ca8448526e8722fe472c05a7dd8aea288
MD5 0776a65b4d4db2d791b26bb45fc8a147
SHA1 1b2adaddafe3f03ed0ca824d98a938b98b5423c8
SHA512 e2d427ec0c6c3ddb9945280631a941ff36468f30e52a0809f78e86ab98b180ee4bff01c330d7215f456e9e7002c5bd41a3aad4aae8a7a108aed174d54d0c9d85
SSDEEP 192:sxZDRMyM/jK1Ml8Mkw/fzsCH3Idpd4HW6+WNGYwKQzeAIgrJ:sxZDaMw/fzsCHYaHbGz9
TLSH
T10342E8126A34997BCCCBD209FA55BB53D6F90572A2900D44AAFCDA0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b493ed89a5244a6256d313bd2936594d8db448f796a26fcb9e9928676aca6944
MD5 2edfe335f1a844822cce94d5715acddb
SHA1 6c03c1654cccf35b0c57c232b4ad2c186c8b2168
SHA512 5ef28f10d5dffafe9be80a73a4189ca527fbe8dd14ca4570b5b97cc59e68bafb17582844afa80db290413e06049e659d350e162c683fe2262ee1787a5f9e718a
SSDEEP 192:sxZDRMyM/jK1Ml8UQukw/fzs2W3IdpH4HW6+WNGYwK4QggAIg54J:sxZDaqFw/fzs2WYYHbGVa
TLSH
T1E652E816AA349D77DCDBD209F955BB93D6F90472A2900E44AAFCCB0C05E6BDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2f0a42c04574b2b2ddb6fe5ac9c48895a1d817eb264a8a71a82140ecf01b85dc
MD5 59fcb03fc471821e467de7bd702540be
SHA1 07c188342822b4618c40d0edc30c410bd1e7341b
SHA512 bd0d8a2055f50238113b7790b27fd0917889f56aecd3b480778503c2b0bf2fcab7bae39a033f793bef2360828c6a5a464ff1f072fb6e9a563a02d04275037f8e
SSDEEP 768:z44jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dwrohJcYaH:z44jeXmWvmKLEu1jacPLZQdbQz
TLSH
T192D2093B284CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c28860d2f8a7104a2b54bf0275fe2a588f3b9fae8283c51be10b898e8e7bc6c2
MD5 3bb2a815a60b2772ca02daa249e0b3a7
SHA1 2b955b434cec63de5811636a3f6e2f4969cb71f4
SHA512 536763780c4857f416edebea3f3aedf54153ab2539a58ba5ba871e26ecd074460b87d5eeedaa1e59dccf125258ae40ebdd4d5aeefe6d8d08a6f5ac30fe5a4a5b
SSDEEP 48:KceI3KLKIjy9lI5KGUcfl8bnNXbTsrCiIj/TK2KOBT61DRqjbwy3:Kce0KLKeOl2KGUJaQKzSCE
TLSH
T1A3913185717B42412C7E690C9390CB2B9AD1B1B3306CA52B7FAC14BA5F66E119DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594f20.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594f20.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d463d7cfea6bd7cf5b09fc1f32e9d4e9ff9123502e08a4beaaf19dde0cc58d36
MD5 2f558d359f6bbac6e8f413593ecc3af2
SHA1 8712261f86843f37f0962d760a730b5661d71d59
SHA512 2494fbfdbd087e2d50443763292c267e03745dd71171ede77fc45ff482d5668550fef42c3ac53bd9b61800392b231bd92abf704b2d3e16fa4ca987b1fcd7aacf
SSDEEP 384:ptNn/s3n9SfsNe+Lqk6if+j8IMX/+2sFAUOObjI9G6w7uq:pj+9U/7qj/lqAU29Mz
TLSH
T1BA929F3798289C278DD39695F08B36279FF4516BD7C56F84DAEC5F0D00CB6AC0316916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4c8dce8461b2fe855bf37e96b4bd3dd8bea4c9d739011edf8974eb553b38face
MD5 fd86733164280f66d7a754d1c6dca4dc
SHA1 dfa7d0a92b30770a1b32abd90eea7b85c8dc85e8
SHA512 b866054ca4af757c4a8119d95f9dce916f940f10642ec4a577e8ea5cad77d9197709286875142828b4dcd31783e0b20a8412945f146bcff0bbe34ddf623dcd14
SSDEEP 192:EONJ6hZ0QmiUyhepc/+jVRjzorIz5wOZA8AhU6:EONJ6o/pu+j8IK2ArhU6
TLSH
T1D702C93568687C7B8EE2AE45F48737135FE5116BE9A56F84DAE81F1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7f955ea368f60eec009f623660059010420d501bad45b6b36b40d38935914d8c
MD5 c128ea4a85a1db5ec4497dc562417f85
SHA1 b947d92f90eed49788a94c0cf3191b0e6e0887d0
SHA512 3b6b93ab95198c73c9fe0949eef7494c1b95dc5426046ef3e9421dc9dbac087465359056b1b065b8b5bf05926feca6251589624c78c344a80384ef20a225eac5
SSDEEP 192:CONP6hZ3QmiUyOe+c/+jVRjzorIMXTr+245cOqAMq6U6:CONP6lG+u+j8IMX/+2j9AUU6
TLSH
T16512FC366468EC675DD2A695F48732139EE55117EBD6BF80D6EC1F1C00DE66C230BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f13b21c5479cdc5c07ba6496c32b4e6ab06a3f4364b8ec431ec0e42093833ccf
MD5 c6c92a0cbcfc600c8d7da6aabd6d27bc
SHA1 e9aac621230125fee1db41f327c02d7d9ba1d706
SHA512 535556f374d8878df02330fa4bbe61adeb6619487590290ad6a8a0ad05779962b90f98cddcf9e127073aab7b6017200ea9971cf4f91170169d2d9063cfbf3135
SSDEEP 384:stNn/s3n9SfsNe7Lqk6if+j8IMX/+2sFAUOObjI9G6w7uq:sj+9UA7qj/lqAU29Mz
TLSH
T101928E379828AC278DD39695F08B36279FF8516B97C56F84DAEC6F0D00CB6AC0316916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 e6d64d7498c0a83ef5d373eba676dd976db5e5bfa484c54f71fc2f19108b9bd2
MD5 2faa5ea6e7e90e175bffffd524c128aa
SHA1 89eb52ab2246ec15721dc8aa7fb4308424ca2676
SHA512 f7165e7a596ff4150a5630ec79b39f3d31d737c912d40869e3ea1759f6aeda118e612882d8abc11b44344e4c83a7b8405c8d9e46ab6341dea172491314366d50
SSDEEP 384:OiF1tNn/s3n9S2zsNu8TUNTUlIl+Lqk6if+j8IMX/+2wFAUOObjI9G6w7uq:lF1j+95zwgb7qj/leAU29Mz
TLSH
T19CA26B339858DD3BAEA29B95F45B32279EF4416BD6D6AB84E7DC9F0D00CB1AC0306D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76dcb458-6ca0-4148-bb74-365cd7edf2ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\76dcb458-6ca0-4148-bb74-365cd7edf2ef.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ad137c38929f3b9507304baf5a2751159eaba19445cafc607430ce106b068099
MD5 a7e99721d2ec9d23e1e7859639a23dea
SHA1 3c38a74a728bb930d5c33b3cfea8c21bd6a81682
SHA512 10cb5e6e465835fca05eb5b12f76958b1aeb2d4d7bb4152729c5395b87055c7a466b1f72dc37dcce65e0c5cf419d840404c6ca1a7ab2f76df8576d4d2f13720e
TLSH
T1DE41D698B6EA1148B3777E5A9FB6A85E447FB9772E07D45E10110E4E0A27F40C861B33
MD5 SHA1 SHA512 TLSH

Submit Download