hxxps://farfetch[.]7b[.]tn/

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://farfetch.7b.tn/
Sample260730-q192las1bs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298928038720909"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{E5CD87B8-5E5D-44C8-9DEB-21ED333EAA21}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 5008	440	msedge.exe	88
PID 440 wrote to memory of 5000	440	msedge.exe	90
PID 440 wrote to memory of 2764	440	msedge.exe	91
PID 440 wrote to memory of 2764	440	msedge.exe	91
PID 440 wrote to memory of 2764	440	msedge.exe	91
PID 440 wrote to memory of 3244	440	msedge.exe	92
PID 440 wrote to memory of 3244	440	msedge.exe	92
PID 440 wrote to memory of 3936	440	msedge.exe	93
PID 440 wrote to memory of 3480	440	msedge.exe	94
PID 440 wrote to memory of 3936	440	msedge.exe	93
PID 440 wrote to memory of 3936	440	msedge.exe	93
PID 440 wrote to memory of 3480	440	msedge.exe	94
PID 440 wrote to memory of 3480	440	msedge.exe	94
PID 440 wrote to memory of 2988	440	msedge.exe	95
PID 440 wrote to memory of 3144	440	msedge.exe	96
PID 440 wrote to memory of 2988	440	msedge.exe	95
PID 440 wrote to memory of 2988	440	msedge.exe	95
PID 440 wrote to memory of 3144	440	msedge.exe	96
PID 440 wrote to memory of 3144	440	msedge.exe	96
PID 440 wrote to memory of 1968	440	msedge.exe	101
PID 440 wrote to memory of 4332	440	msedge.exe	100
PID 440 wrote to memory of 1968	440	msedge.exe	101
PID 440 wrote to memory of 4332	440	msedge.exe	100
PID 440 wrote to memory of 4860	440	msedge.exe	103
PID 440 wrote to memory of 3168	440	msedge.exe	108
PID 440 wrote to memory of 4708	440	msedge.exe	109
PID 440 wrote to memory of 4184	440	msedge.exe	110
PID 440 wrote to memory of 4140	440	msedge.exe	111
PID 440 wrote to memory of 4140	440	msedge.exe	111
PID 440 wrote to memory of 2892	440	msedge.exe	118
PID 440 wrote to memory of 2892	440	msedge.exe	118
PID 440 wrote to memory of 3312	440	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://farfetch.7b.tn/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbd12cc188,0x7ffbd12cc194,0x7ffbd12cc1a0
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,11163295017330744803,6275226288467700292,524288 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,1849054648258759069,872794729896793904,262144 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,1928394766380996270,3914775260747242296,524288 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,13111491470228927200,779782194751223259,2097152 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,14173828004247195386,17963005140317543927,2097152 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,559187090556458953,12494442101862196447,2097152 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,8927660954051883260,18419930145342150965,2097152 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,9052774811219146655,14406438168056516833,524288 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,12134473008946993711,14219031269581261725,524288 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,17313847599139628635,13879681529093224033,524288 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,17313847599139628635,13879681529093224033,524288 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,10673661600431787337,6381707559199495430,524288 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,1709181691707745692,14013456113926829469,524288 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,2535940720210947557,2215504104372673602,524288 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2952,i,4478673448637272272,8404536385943052029,524288 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,10808784639327418652,641050542142782093,524288 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5220,i,9292935407097360523,7189609058373123562,262144 --field-trial-handle=2260,i,3146997204994503272,627710358245619876,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ec26c584dec5a20f75d9046059e7589159f2609ccd7a4da0eff0a27f07835b22
MD5 c7da711ebc58f95d3e0ab73824a17d19
SHA1 d1ee834625fdf36ea1520fd3d95f0d2386b631a9
SHA512 54f5f3c70deaaa53f10cdfe474e3ac6b57f54426fbe1e47d94d2f9dd00027e700d0be822432c4a6a23a18437da6d8201aa535c8f30aa50cb0f0636216bd64b1b
TLSH
T11E71B5F50279489DFB59DCB170F281023530B9F9FCAF2E9681D0EA387A92354990B23D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d31a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d31a.TMP
Size 3KB
SHA256 26d7735727b037b758b7a17e707f91c0a110c7b8b868c47ef2c16867aca77b1c
MD5 f7b70665ae087f67cd604145def09be9
SHA1 b998a167cfb31833cbaec41c37def9d488f76784
SHA512 990d5501d87b2454c41a763294efa34dc46c935f14654f53e510a5d360bee9c736560be2e7bcd3e02a01f6ddd5bba935dfa318e281e04cfae90900bb75e6b4c1
TLSH
T16D71A5F54279489DFB69DCB070F281023530B9F9FCAF2E9690D0AA387A92354990B13C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 505e8b26bf0a413b90df059b5bfd29c1f6fc9ab5a4643cf7cf35a7ac20c499f1
MD5 f1e4ab399aa2aabfc17599506ecfe254
SHA1 9dfb2117923b47dc427cb4528af873bcf290d144
SHA512 334e26339b52add2c2037c663cac7c6a485084f27fd8fe0d1f0e8cbc456db9611049a22d622bee1c64b4344bf189354ce8da16d1754e8b2eae96d3eb875c5a81
TLSH
T1C431BCF3C3E4856ECA0157F09B24AE2BCE2D060642283D1985D4EF5BD3E3075E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7c05cc9191fbc0679a51f8c6103d8aa0d0a079d4ddd57c94c449f3674016a900
MD5 ddcef2d696ee83ff8cc0c06f12a6757f
SHA1 5b30f95292e943f49fe66815cf1c8f5aac0c45ac
SHA512 7f5c98d3944fb6e52e9def3b4eb74713dece409585f83762eea5e84c9678075e2492b757fd1f1dc184e883208ce532dbf5c8a792ca610871292350b5ce857830
SSDEEP 192:sxZvRDyM/jK1Ml8Mkc/fjsw/THyylIdpkSHW6+WNOh+/YzNxWTm+PIgrJ:sxZvVMc/fjsw/LybTHbb/OSme9
TLSH
T1EE52E8166B34997BCCDBD209B945BF53D6F90473E2944E44AAFC9A0C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 be9adf060693c8d47ff5ca5ee2ab77be5bf407e41a69d31dbce388ddc893fd72
MD5 177f5b529d74bc40ac5f4163670a9c19
SHA1 21910f35ef11d76b95f5aa71246ea090b7c0ac9a
SHA512 ab9b695104f8dff6ffdd1cc86a89f0c2cb6223c49df282737449e7cc5e85e2abe2b155b7d960bf6178b51f46bc21518b6f057e7ad4432b46751736b970d3e4e2
SSDEEP 192:sxZvRDyM/jK1Ml8UQYkc/fjsx/TXyylIdpaSHW6+WNOh+/YzPxdqm+PIg5oJ:sxZvVq7c/fjsx/TybBHbb/owme2
TLSH
T13452C6566B349977CCDBD209B941BF53D6F90472E2904E44AAFC9B0C05E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e83caf6d254747da396f88af91af70c737289c411e89651ee6a9997b6a9ee909
MD5 b87c625fa82c978457a72aeba57fd4c7
SHA1 912fa3794687d302ba3a0dc3b25708dc5daae0cd
SHA512 53a9f7962d8887dc3fbe938042cd0baecba2dd7c21bfb9b361de2d9909930cd502dc123c565b8166ec76f337914c8da199c8d6cb7bff4c12ea1318d2ef401782
SSDEEP 768:J4W7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjGroIuiNYF:J4W7kf0Wvqidau1jaa5LA3j9jF
TLSH
T1CED2FB3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 77bad65f38ebb910819eef147672054e3cf7858a0e40dc5c53f546b70cebd0bb
MD5 2d73aacb2c1ce87f191d6c64f77021ac
SHA1 b6d48c9077a1b42906437c1dc4aacc6f329e70ea
SHA512 1073bdfe276ac02e334a5c73cfb15110e360757ae3c1b6ccb79c03f23ddb1e4e2d193c227774723be39764c4f470154990a124cf2b8523d55d10b2adb0cf80fc
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTenI1K0k4Py1zIhKM4M4e:KIbCKcenWK0kymzuKM4De
TLSH
T12B914301317B068138BE2949A66696779F8271633818A9FF3BB410621E76F560DFFCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595cbc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595cbc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e087e7fa6925140e66c32eb7ec4f5beb3bc62faf45da229a9ae249ba218d3ff2
MD5 3bd0c7b14ebd51eb9d018351674a3b6c
SHA1 dc6f74ef11679af523bd3acc148085113ce0a8da
SHA512 383fdec64cb724ea3033ae2de2dca94a498600495a76806b7ab49d91cfa48d55411a4d9f6b353dd5bca50282f3b8375e425ac0367a31449bc0f7c9afdeb2e48b
SSDEEP 384:RZcIhsN09UcxyJbC0LutdKR+29e9OObjI9G6w7E2:5hVuJXawlQ929MN
TLSH
T179928E35AC345D36AAA6B115F48A3B175FF8813BE7C85B84E1EDEF0D06DA5AC0306817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3e7834594a2c1ae86645b7c5dc9b75466c4942f7a26b801bdfbfa317525cd60a
MD5 9efa348575f50eb9ae1f1e4b44881975
SHA1 964950e1c8d3fc98c36809087f5806b8042af353
SHA512 fc70c9b9cea5afa5f7fba54a4c2a0c3c26c043d95365549a0b0b2c9b3213f8030ba2180ed98f0c1f7b0234c33e230b5dc36d4dab0ec8c3cabf214c30c95eb438
SSDEEP 384:xiFiZcIczsN0u8TUNTUlIltxyJbC1LutdKR+29F9OObjI9G6w7E2:YFQgVuwgEJGawlj929MN
TLSH
T13AD229F25CE7893AE96E9703A77D2E164EFCC067B6845640B3D89A0CCD961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 28c93b8bafdc07bd8bfc996d40292659d80e578171d770a20f733ca7e721a9d8
MD5 e073434e8399be22dd720e048c4deae4
SHA1 7011485736915eb793ec726b343920d06f1cf0ca
SHA512 db8340d09146573c4bc3cfbacafdfa9f41f89426ce2a67ee2362fbe4bc76c3620596d28e5047eebeba3f3dd4d56d1b646a076ea37ac5d78bfbafb058385e82ca
SSDEEP 384:qZcIhsN09UtxyJbC0LutdKR+29e9OObjI9G6w7E2:IhVdJXawlQ929MN
TLSH
T19A928E35AC345D36AAA6B115F4863B175FF8813BE7C85B84E1EDEF0D06DA5AC0306817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 23b02750c42a5e1cee495e4b31ec2e3531c279014a34abaf47fae059f816c9e1
MD5 0a4b0195192aec5b996c4a8f9a238429
SHA1 6912f91af66865981f691c79df7ace2a69a71b0e
SHA512 287c6553a8d55420e774b3bd9445df54dd882aa0067ba25ecafd2a8c17276af48d6c008cfb67fc70b6383b374e1050d761d20480e2ccb9ad9abad7b11d29c640
SSDEEP 192:BONgr64BhQmiUyRZe5GBPKp/+FdG7BGc+29JWw+qBU6:BONgr6e/KeOdKR+29t9U6
TLSH
T122122A35AC659C3B6EA2B145F48737035FE9412BEBC56B80E6DC6B1C01EF69C230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d181e00f5c0b75afc820b9b1ba2490ffde05f48011cf19cd3af24db5f0539460
MD5 0a4d1c8c6ec3c0a46374fae0ad3f57a6
SHA1 7f157faf1d860e5e52608392221d353bb22c3658
SHA512 cf6b43c771a2ff4b1c1a2f92a26d02f752681462cacd2f6c2fde8170af2c0a291a0adbe20489155ff323accfd2f6b1a81bbb302489417ab535b7860fbe891af3
SSDEEP 192:MONG64BAQmiUyT1ZW5GBPKp/+FdG7BvaDECdU6:MONG6eAsnWOdKC3dU6
TLSH
T12D02FB396C786C7B9FB2AD45F48637175FD8113BE5D56B44EAE85B0C019764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3d0b475-0faf-4693-8b14-5068e5be937e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a3d0b475-0faf-4693-8b14-5068e5be937e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 93aef1cda3c9dd10dee31291d1f179d44f7e8800bbbfb2fe490a7b783171d81d
MD5 41aad88981a566153127fc2f25ccbf24
SHA1 0515a92c3c3642b5b4873e0d4da593452fc0aff5
SHA512 16dbf41a2d56c62137473b55c2b13429aeb93703254ea732384efda99ef41e897e4e3e7c97b22d76a63fd3af25b088941e204c97893029e2cb9c3e1c6c8ce536
TLSH
T18D41289CA6F91108B3B72F5AABF3596D887EBC772E06D16D10020D4F0A63B45C961B37
MD5 SHA1 SHA512 TLSH

Submit Download