hxxp://archive[.]sunderland93[.]ru

Resubmissions

21/07/2026, 13:21

260721-qlvclavsaz3

20/07/2026, 08:38

260720-kjvbxset8s3

Analysis

max time kernel
131s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 08:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://archive.sunderland93.ru
Sample260720-kjvbxset8s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3724	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290103405517456"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{698FC50C-B6D8-4A55-B664-E92690FD1A9F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 1396	2424	msedge.exe	85
PID 2424 wrote to memory of 3724	2424	msedge.exe	86
PID 2424 wrote to memory of 3480	2424	msedge.exe	87
PID 2424 wrote to memory of 3480	2424	msedge.exe	87
PID 2424 wrote to memory of 3480	2424	msedge.exe	87
PID 2424 wrote to memory of 4352	2424	msedge.exe	89
PID 2424 wrote to memory of 4352	2424	msedge.exe	89
PID 2424 wrote to memory of 1988	2424	msedge.exe	90
PID 2424 wrote to memory of 1988	2424	msedge.exe	90
PID 2424 wrote to memory of 1988	2424	msedge.exe	90
PID 2424 wrote to memory of 3616	2424	msedge.exe	91
PID 2424 wrote to memory of 3616	2424	msedge.exe	91
PID 2424 wrote to memory of 3616	2424	msedge.exe	91
PID 2424 wrote to memory of 2852	2424	msedge.exe	92
PID 2424 wrote to memory of 2852	2424	msedge.exe	92
PID 2424 wrote to memory of 2852	2424	msedge.exe	92
PID 2424 wrote to memory of 2644	2424	msedge.exe	93
PID 2424 wrote to memory of 2644	2424	msedge.exe	93
PID 2424 wrote to memory of 2644	2424	msedge.exe	93
PID 2424 wrote to memory of 3728	2424	msedge.exe	97
PID 2424 wrote to memory of 3728	2424	msedge.exe	97
PID 2424 wrote to memory of 3728	2424	msedge.exe	97
PID 2424 wrote to memory of 3280	2424	msedge.exe	98
PID 2424 wrote to memory of 3280	2424	msedge.exe	98
PID 2424 wrote to memory of 2936	2424	msedge.exe	99
PID 2424 wrote to memory of 2936	2424	msedge.exe	99
PID 2424 wrote to memory of 4980	2424	msedge.exe	101
PID 2424 wrote to memory of 4000	2424	msedge.exe	105
PID 2424 wrote to memory of 3756	2424	msedge.exe	106
PID 2424 wrote to memory of 3668	2424	msedge.exe	107
PID 2424 wrote to memory of 4592	2424	msedge.exe	112
PID 2424 wrote to memory of 4592	2424	msedge.exe	112
PID 2424 wrote to memory of 4176	2424	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://archive.sunderland93.ru
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff85a47c188,0x7ff85a47c194,0x7ff85a47c1a0
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,12035736719108643285,8734225927974532324,524288 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,9474461664219264262,4872473811145438895,262144 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,4955578064528741448,6293358238070913254,524288 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,2277591834309036285,13782316046978502389,2097152 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,2591646494623482586,18297825965798282715,2097152 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,4096005314203569524,16198153408570786798,2097152 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,11149013677671318,2778105274278419166,2097152 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5116,i,17047928538614585770,16748991916310021941,2097152 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,16483721276417528170,3656480316678940838,524288 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,3151480308367367232,14061288459312666585,524288 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,10606764352007257459,11690398025907546255,524288 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,10606764352007257459,11690398025907546255,524288 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,16749822252388136030,9072539304350741855,524288 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,5608223637242578260,2609421795604362845,524288 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,13697993819811130695,17796659520227698079,524288 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,7342317680747457013,15421184615888396086,524288 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6396,i,14768638624439259476,10852642428193886406,262144 --field-trial-handle=2248,i,17709827909570338437,14538149481717148047,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

60fced74-d6ae-4fdc-882f-9193f9e749f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\60fced74-d6ae-4fdc-882f-9193f9e749f3.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 affc0f14650b0cf948fe83a402717f27d206c5ea5ce4c5fdb5013c8a63eec30c
MD5 6ced65676b1d24799b6a52f55ac34e5e
SHA1 0eee2c8bc66153748e20f094984501010a092ee4
SHA512 fa41023b9517a769b69a15e9c4c7a75c4139c8798d8dfae7f60d1ec3254aa233800e0eb1bcd2552aed82dfc3d4fd14180f0c62f625255dd14c0de11b2af16ba7
TLSH
T1E47171BC020301E1E362933A68D3C1D63CF18BCAF96BEDE65110D4BE26C67618278F50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c0ca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c0ca.TMP
Size 3KB
SHA256 c604e8d7df5c768e9fdd48e9209be939c5372529cea38e644e3415819d542855
MD5 bfad12635fcabfbaad0c058c39339db3
SHA1 5ba8a317b2c8ea17598409f532687580cb9dccc3
SHA512 e69ff35311b62191aac33d09541b4c6456a774bb578ace491d29755c095eede8e0345f54f8104b66dd03ead549c835f8a22fc8de6e3fcc49c299f24473dee12d
TLSH
T1E97161BC020701A1E352933AA8D3C5D67CF18BCAF96BFDE61110D4BE26D67618278F50
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d73bb3550611a78265204b379106cd85a6757101b9342c9599438f1e66d71060
MD5 bf0089b44c25882c88127a2e49acaf76
SHA1 e4c39a5886effd1af0e31f332d6b9561ff9a81ca
SHA512 cf16f4f64d8a10994a623b1ac35380f3a10842df7a7f3574de44ef070393b538b802f657e019a33d4014191dc399c183309d06223c38180a75716f9ccf36a7e5
TLSH
T14F318AB3C7E4D56ECA0512F0AA24AE1ACE5D0519822C3C5AC9E4FF5BD3E2475D201A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e146d0911880bbf97c737feadfb4d00f49c17c46972797fdc8ee7a30ba496b43
MD5 04d56095ba7fa2de78f5a73a570766d4
SHA1 b18b5c29d293914f05eb568af3fb1d4e742a3309
SHA512 3f51d2c8447ca1615d1d54ec5f2ad1cf3e5c8f145b922e04026acb6a23ec79b60d427379fdc87dff9299e240fa361cd84571677e692db582c0d8b93eee22045e
SSDEEP 192:sxZLRYyM/jK1Ml8Mk6/frsxAFoDIdpIaHW6+WN/4A/YIEBm0IgrJ:sxZLmM6/frsWFocrHb//i9
TLSH
T1BF52C616AA38597BCCDBD209B955BF53D6F50462E2900E44A9FCDF1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0e0f5194f88a7c45f15dd72bd2ddfe9b1a1018f872955d98aaec0cb4ed2684f7
MD5 4514e6239419072f9e75b1b260cc86f7
SHA1 b20609e8b4b7601bfc5e56a16b9aee3cbb646164
SHA512 fe8f925b5e3d5c592aa15367fdfca07c91137eb29df172e27f68bd4aeeeaff7d62dd199d5a573de63986b3ccde02d3dff24d40ba6642563c559adfdeb821da0b
SSDEEP 192:sxZLRYyM/jK1Ml8UQqk6/frshAFlDIdp6aHW6+WN/4A/YI3YH0Ig5kJ:sxZLmq56/frsmFlcJHb//RO
TLSH
T17952D716AA385977CCDBD209B985BF53D6F55472E2900E44A9FCCF1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8f4cf63f36a157f7dcca157276f0f0d19e3836d4a2954948339c32699b7732f4
MD5 e01bc9ed7a959422f353ecc73cc4d664
SHA1 4e9b6577f2143cf90013b319cca839fe05da0a99
SHA512 7a8931030eb24f8916652c5e84d0ae3e8080e01fd4b26ed1c1f6adac7edabacf7bea1ca9f3634b95a28087d6dcbc738376d47e170d83da6d8c9b21744c671c24
SSDEEP 768:TzsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9oroqgI6:TzsqxXlWvJD6Tu1ja54LAs9TqQ
TLSH
T16CD21C3B694CC77E4F840E5DEC266FD76ED801CBA6988D4447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 0e624259a9aa559542954a7a4d088ff6d98033a04be32bea1e406dcf2ef4237a
MD5 99ff94f9d1152a698b959ae4624790c5
SHA1 785935672de14a69551d411e6b5677335724c95c
SHA512 deb08cc2d1e872c5cdb61312135df1980625ded758555a7f3aa07b6fa36fe61e48a8c4bf2890e110326de61ea05cbd116a73878218b40177635aaf682e5ccf05
SSDEEP 96:KYbaKYIKScgKVWeS8AKhumJqKaoyKWoK3qEz:ExbPz4h3r
TLSH
T194E1C416713E061239FE2988B2A685374F423163705CA86F7FB950650E6BE235CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

038774cd-8ceb-4b52-a362-1a8370f482e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\038774cd-8ceb-4b52-a362-1a8370f482e9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7d9b282f15298d603d04f61932420a7b37080abb26b60fed57aadd18c29cde1a
MD5 958c7d4e8289355e9da0e786415a5e8b
SHA1 645c44c1ffc9baa6a06155b00a158de5d86d6296
SHA512 4729b919e7d9eb333e109de6854955717b5c27b70a2364796d1dd8faf3a07585c9ea64212cc966c5df698ee0e5c24fa10bb7fc4becc5a8c63646448ee9bf4303
SSDEEP 192:tONC6JkRtQmiUyG6W+RNfCk7Omth3wRwU6:tONC6UroW+RNaET7U6
TLSH
T1E3020A356C382C7B8EF2AD05B58B27171FA5206BFA952F80DAD81F1C00D765C2347936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 67ffa4efd4c02f8dd04c39c93c78181e807b1aa1d4457c3e9314659610303427
MD5 02d7fe9b636fc0fa0670a430fb5e588d
SHA1 7df9d08e2152a45a1a66c8fd3aad8396fd1bf074
SHA512 338fe4570e059f28893c3e0c019b9e952d58aae9bbafaa96055234c1c84a476144bfabe45480d54d9e915e05ccec06fd98686d900703dad9d43a4c61accd975b
SSDEEP 192:5YONS6JkRxcQmiUyT6II+RNfCk7OmqZZxVc8qOKU6:5YONS6UxsVII+RNaEJxU6
TLSH
T1F012F93668285C7B4EE2A841B4CB36135FB5516BEB896F80D5DC1F1C01EF99C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c8ae347a1266091b2f8fe20cb12743da512bf5c0f84bd1f72d7a7921ae419439
MD5 d579266cdfd0951e97651f470f17b474
SHA1 883e06cd52d82285948ee42ca0026c82352f119b
SHA512 169a277d4e9f472f700e760f021f23a0078f27c20109d81054ce23ab7ecea618663e015e6bf369a49ebfc5fb8ca9abcbc1950ac7105c0f2d1460528ed2625be3
SSDEEP 384:t7iF1tNn/s3n9SYzsNp8TUNTUlIlZnb9HkI4VRNaEzxOObjI9G6w7eR:tWF1j+9XYwglEIuHaIx29Mo
TLSH
T17CC217F658D74D3AC9AE4B43B77E2D164EBCC0A7B6856A40B3885E0CCC961BFC306914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 80aa14c7ed9302a0efac71bedf8cfb1e464232bfed6e9009c44f5d61224c3790
MD5 816da516bb55a8eff4af428064e8e6e1
SHA1 5bbdb18afe4f94b3af9442e5069ed394bec3b20a
SHA512 90e73016a7dd533699f4490984e9e3afefd084244542f80342d04b374edf1a756f66b1dccdf7f5778db2b7e194b1385678f27e61f39dda9b7cce46322a6a14cd
SSDEEP 384:lQtNn/s3n9SfsNXZnb9HLI4VRNaEixOObjI9G6w7eR:lQj+9UKrIuHaPx29Mo
TLSH
T144928C366C284C7B4DE29856F08B361B5FF491ABE7CA2E40D5EC5F0D01DB9AC4307A29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0bd2f7eaaf870beb3125f80fd33d56756df4a81629f72ec5149ec84630d1d254
MD5 a1a8f6cb62b42e18c5675d8f9b4bf7d9
SHA1 e954e2bbfb5b208ed5c3a8d8fc6de535b8f1e8ba
SHA512 b5c28a1226674e04f7ff747c2aac2e2eaba4a2eeea3512138f3f100179feff215f49f4ae0870f83179258207bea027346dd14aee1de1412ef24873c965712db3
SSDEEP 384:UQtNn/s3n9SfsNXYnb9HLI4VRNaEixOObjI9G6w7eR:UQj+9UtrIuHaPx29Mo
TLSH
T1AB928C366C284C7B4DE29856F48B361B5FF491ABE7CA2E40D5EC5F0C01DB9AC4306A29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d4c862f-e744-4dfd-8f40-75da94006f8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8d4c862f-e744-4dfd-8f40-75da94006f8d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0f34a7dda0450e3fe7302d7c3130f9ce719a7931f18aa9b9c948255ff4fe5471
MD5 0463973d0b35bc2f653e5e31e3c0720e
SHA1 4ad6fbcf72329a89dd7567c10bc4f8a1fa4fa32d
SHA512 4708a23f9020f2ef0f0c36ff192f0c3a170bd0eb59f88978849da90051dc896eb3cfa07e943493e7394421e1c5ec19113781ff80cdce861f4876f259842bbfc5
TLSH
T19141076DB6E91108B3B7AE5A9BF768AD447FBD372F06D45D00110E4E0A36B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download