hxxps://usfansleak[.]duckdns[.]org

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 15:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://usfansleak.duckdns.org
Sample260730-s4s9csvwax

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4200	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298996864537432"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{9F337B5F-CAEF-48A2-8120-5443C2622E17}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4232	4736	msedge.exe	88
PID 4736 wrote to memory of 4200	4736	msedge.exe	89
PID 4736 wrote to memory of 2096	4736	msedge.exe	90
PID 4736 wrote to memory of 2096	4736	msedge.exe	90
PID 4736 wrote to memory of 3960	4736	msedge.exe	91
PID 4736 wrote to memory of 3960	4736	msedge.exe	91
PID 4736 wrote to memory of 3960	4736	msedge.exe	91
PID 4736 wrote to memory of 1192	4736	msedge.exe	92
PID 4736 wrote to memory of 1192	4736	msedge.exe	92
PID 4736 wrote to memory of 1192	4736	msedge.exe	92
PID 4736 wrote to memory of 4076	4736	msedge.exe	93
PID 4736 wrote to memory of 4076	4736	msedge.exe	93
PID 4736 wrote to memory of 4076	4736	msedge.exe	93
PID 4736 wrote to memory of 4772	4736	msedge.exe	95
PID 4736 wrote to memory of 4772	4736	msedge.exe	95
PID 4736 wrote to memory of 4772	4736	msedge.exe	95
PID 4736 wrote to memory of 2924	4736	msedge.exe	96
PID 4736 wrote to memory of 2924	4736	msedge.exe	96
PID 4736 wrote to memory of 2924	4736	msedge.exe	96
PID 4736 wrote to memory of 4212	4736	msedge.exe	99
PID 4736 wrote to memory of 4212	4736	msedge.exe	99
PID 4736 wrote to memory of 4692	4736	msedge.exe	100
PID 4736 wrote to memory of 4692	4736	msedge.exe	100
PID 4736 wrote to memory of 4544	4736	msedge.exe	102
PID 4736 wrote to memory of 4892	4736	msedge.exe	111
PID 4736 wrote to memory of 3300	4736	msedge.exe	112
PID 4736 wrote to memory of 564	4736	msedge.exe	113
PID 4736 wrote to memory of 1624	4736	msedge.exe	115
PID 4736 wrote to memory of 1624	4736	msedge.exe	115
PID 4736 wrote to memory of 4508	4736	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://usfansleak.duckdns.org
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffef3b2c188,0x7ffef3b2c194,0x7ffef3b2c1a0
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,16057494370057374570,15943150982340983336,524288 --field-trial-handle=2196,i,15830803430838079848,11648833967583936937,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,7421932831529170731,16052146644173651746,524288 --field-trial-handle=2196,i,15830803430838079848,11648833967583936937,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,2584349119232459705,9225265233134542935,262144 --field-trial-handle=2196,i,15830803430838079848,11648833967583936937,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,14043647959254617104,3309020269682180281,2097152 --field-trial-handle=2196,i,15830803430838079848,11648833967583936937,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3384,i,7985047394798548225,9467537083933730652,2097152 --field-trial-handle=2196,i,15830803430838079848,11648833967583936937,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,7087693513622280543,15100536286754400141,2097152 --field-trial-handle=2196,i,15830803430838079848,11648833967583936937,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,789481712124911520,12194646818262251902,2097152 --field-trial-handle=2196,i,15830803430838079848,11648833967583936937,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,10689177718356521394,2452505995407844683,524288 --field-trial-handle=2196,i,15830803430838079848,11648833967583936937,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,15721437219572328679,9452876225979875064,524288 --field-trial-handle=2196,i,15830803430838079848,11648833967583936937,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,240682291649631701,16078077539099473873,524288 --field-trial-handle=2196,i,15830803430838079848,11648833967583936937,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,240682291649631701,16078077539099473873,524288 --field-trial-handle=2196,i,15830803430838079848,11648833967583936937,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,4095081923098320926,16706399045603660284,524288 --field-trial-handle=2196,i,15830803430838079848,11648833967583936937,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,5062582084581662657,12910973751667967096,524288 --field-trial-handle=2196,i,15830803430838079848,11648833967583936937,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,2864953926997543931,14870887563492240337,524288 --field-trial-handle=2196,i,15830803430838079848,11648833967583936937,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,3054104560392073079,8801996880642757189,524288 --field-trial-handle=2196,i,15830803430838079848,11648833967583936937,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6348,i,14580948492443552370,11581259693675170842,262144 --field-trial-handle=2196,i,15830803430838079848,11648833967583936937,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

7029e777-3424-4bfc-9ab0-730fb61152a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7029e777-3424-4bfc-9ab0-730fb61152a5.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e51649e7901136a1c9b0c2930e978859c51ca61a4ac3a939a51c2a61203743a5
MD5 b48e3973db2303b54cbeed35d1b730aa
SHA1 d9dca9856c26f0a17299bbdaaa50cef731d90a9b
SHA512 0f7f66c08ddffb1ea7d6d84e340369d090093ca07fa854d8f1560a03cd5568ef52a1e6d48994b93cb07b3acc1adc2bba0e29f9b54ed00097bae84c007dc8614a
TLSH
T1A6714E3B66424941D34121B1E8A91700F6BECD9D4ECB3E692E908DFFB51AB47B346CD8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59070b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59070b.TMP
Size 3KB
SHA256 534e68ad6d2b43af092c688756603277939d4af44e5c5a35a6e79d38bae41f14
MD5 12bd6c4279cb6a1f9b65d55068e86892
SHA1 fc06f38111b67017ee1b6468b9665bf0837511f4
SHA512 295f07234ae4bdc0ec1cf1eaab2f397688a7c21205ae5e7252c4eed4cdf8e8cb5802f0e3509681afed71f1bb46c7a91d6c7b27ac20115e39704d3dad75a1d3a8
TLSH
T1FB71293726424952D34020B1E8A91750F6BDCCAD8DCB7E6A1D904DFEF919747B306CD8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 42d9895ecc6aaf3ff23bd173a5660316d62c7d8461872d1f4e1f934a32aa8bc4
MD5 f81aa470ab51bf167a7629d9bc8f355e
SHA1 2980bc60355d2fdb5882cc5a780a803293debaf3
SHA512 6ffa2d287fd507498048ae67e30bc11eb9210d62885ee64c6468799ad0835f025b55de0603674808047077dbce977b3536c90447e0bd52bce0bf405e81bf7cb5
TLSH
T1E251DBF3C3D58A2ECC925EF0EA15AE63DE2C0A59C21C3C1698D4AF5797E2860D34164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b016b195dfb83d4483f7c3d932d2db90a288667c6d7038b97914140c9c4d4020
MD5 f4731e169e5d2a7191f11143f6d52f2f
SHA1 348a27bd70dbb0e52ac645ff67898e95fe9008ff
SHA512 2c99e5a8c2f4f49683cea2bc97b5e9d05e0212b383c4073ddf90a648fdd5255d2f383fa5e47eea99911d2dd38aa18fabfb61bd24ff85850fe19f6d09b9f7dfb2
SSDEEP 192:sxZteRXyM/jK1Ml8Mk0i/frbsEB6fDnIdpYbHW6+WNZNx//Yw9VgkOIgrJ:sxZteZM0i/frbsq6roWHbZ/e9
TLSH
T15952E7166B38997BCCDBD209FA41BB53D6F90532D2945E44A9FCDA0C04E6AED231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1793beabb662d90bbf41792b65e3a73e5f5bd8348f8dee5d9d669a8b85a4377a
MD5 ebd9faf2d8555477a6b146271298f6e7
SHA1 09dead3941feb923def30ef55a6ec3076c0a53ab
SHA512 b7a85805559a652f53cda401ddd7c401eee5e5cd5feb5c2873c49475ae58a4986d40db4cfa210e351d8c40d4d323a1835bb625f177daaa13f5ede6c532ec874a
SSDEEP 192:sxZteRXyM/jK1Ml8UQyk0i/frbsVBGfDnIdpCbHW6+WNZNx//Ywse0kOIg5za1J:sxZteZqx0i/frbsbGro8HbZ/Itaf
TLSH
T1B452F716AA38997BCCDBD209FA41BF53D6F54472D2901E44A9FCDA0C04E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fb164b65c1bbd85f64f0404e8b2d86c7126537dad642f47c208b61d9ce713b23
MD5 93770ce586601ccb2e5a6feee4683603
SHA1 e3c638ba008babb3c6b2cc56c0c5457bd89406b9
SHA512 4550faf48260db86ce06249b6327bc34af48aa2a1ecdfcd525466dd2e78eaa68aaa1a91770f764b86499bc09cbecf83e7aa159b5564317222fce402ae6bf3674
SSDEEP 768:4V4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dProhEcra+:4V4jeXmWvmKLEu1jacPLZQdcVl
TLSH
T187D20A3B280CCF7E4F844E5CED26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 390a3450a2b0d8f67d42fe2d42f438a8c4a6d930d5f481910ebbdd87b14e5a6b
MD5 fda1cc9f1d1ff107d031527d10053f43
SHA1 2e2489585f6ebd64738f8e6d3745be3c39b3779f
SHA512 39677f55c52b338c25f8fcbe0126aacaf8d7273ca5b2ed19e94c5a06c1d75362e48b141e796ba414fa191f2e708bd41387fcde4d76a587faffe9b7b30cdc2d46
SSDEEP 96:KPYDMoGi+cmypHUwcKsJUecI4oJ24Bp65OaQwgSmdcWUx/KsuUP/ILDUtbGlqW0t:UlXYNv
TLSH
T15891121179BA02432D3D351C8690DB1B9E9271A3315EA93B7BBC25724FA6E115CFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7f269b7-cacf-411c-96af-e049957501c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b7f269b7-cacf-411c-96af-e049957501c5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6e421f07c332854d3be0c9e756d17b70c545298024416bef9ca1a9df3af38942
MD5 15b1b2c5dfb6a7f2144c2bc996ff8560
SHA1 077179ac1dd7dc1ad8769126c1f4d9493493b9a9
SHA512 0d7244b8cc110e4c337ada612aaee7b2185a495de002fb5efe2ddb6dfc98e84a6029571a22c2525a6161a69c6f729f31097ad5b5a5d20577c5147fb5f1e4a891
SSDEEP 192:u42LsNxVnQxfO9ZEfOY7QmiU191z4H/+jV0jzor2IXQN2v5cFTUqp51z6:ZcsNXnGGMfHt98f+682IXeFFH51z6
TLSH
T119422A366879AC6B9EE3A541F05B32139EF84167DBC96F84D6EC5F1C00DE2AC1317816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b020dfa5fd62acb703623d89a37c5d28ae80685e10927e587df0fc63716434dd
MD5 d3a8d48ccd3e14695b8bf9ee979a4696
SHA1 8bb61497a75dc4bfaa0f5fb40f9ef65102eae0c4
SHA512 d8f471c2fb61cec1167b804ddf278ce28d015f027484760bbb153ac693abb93fba451876ea74d05b7582c9066904163c7063ec0e10d3b1379bbe30a4f60edda9
SSDEEP 384:FeiFiZcIOzsNp8TUNTUlIlRGGMfHt38f+682IXeLFH51zU:HFQOcwgwcGGH51I
TLSH
T14BB2F9F258D7943AE9AE5B43E77D2D124EBCC063F685A640B3D85A0DCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d2c33445f62720a7a951fc28b1ecce37529b8eb4b67246eb1999df8e93737032
MD5 641a1b8c1409e2bf8be88071e39c5034
SHA1 90c81bc4fe9da17fee967d7b55bcf25670491309
SHA512 37413958b9b47b515028b46cc91dd233241a6a5b2eb3036d4b80d47c922fcf7d04e6da96024a2acf9372cb8a4bf33e83d3891b876b5b72562a87ca8164a6ff68
SSDEEP 192:EONQ6hZ0QmiUyjPpc/+jV0jzor2e5wOZxdlU6:EONQ6oQpu+682t2PlU6
TLSH
T1FA02E935A8686C7B8EE2AE45F48737235FE5116BE9956B84D6E81B1C00C769C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 2579f43cc630115be692a6288ba8f22fcbb7a1e5962b011458fe6fa8ff3290d4
MD5 bf11d52b75473de6c096c918618eeab0
SHA1 04fcf4966a182a1082aa0d6715456fb4655f8ef9
SHA512 a1dd1f7fbf52999df3dd3042e2d1cb87ea3eeef689e90f948a99348f587e390cc6dc694f8a36e1dceae27a2ad7d5ea1c7d0f4563b793be5975ee5d52faa88617
SSDEEP 384:9lZcIhsNXRGGMfHt98f+682IXeFFH51zU:HhbcGqH51I
TLSH
T15F726D366C786C7BA9E7A941F49632134EF89027E7C96F84D5FCAB1D00D96AC0317C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 638b34755da0eb44845d2dd36a8bdc1eafb928c8c1fc3860ba6f5b98eee2271e
MD5 ffbb973174b21a2a4203742fbb297b32
SHA1 ef1e16a792faf9c897a9f51e858e1e11bedf9465
SHA512 03ce586e670df0117572f4509591d066a15109095cb19921b0a76c3746d6d8cc1190cd274c831b51e6c973d5f1e93f1997136d634c5f095681e15255adf69b51
SSDEEP 192:FEONFk6hZBZQmiUyCPsc/+jV0jzor2IXQN2w5cOqUqpU6:FEON6613nsu+682IXei9HU6
TLSH
T13912EA36A968AC6B5DD2A541F09732135FE45127EFC9BF84E6EC2F1C00DF6AC1346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3ffeeca41870167ff33ad24f8f3e550ff040429251dc1f458214911d2e381ccc
MD5 6fbcbe82ae59bc2add3cf4d92c4a1f48
SHA1 dd94abc80591406eb284559cebe5d2426edb0a16
SHA512 c8c8282a41278a101568a460c263cbe5dfdedf138178e90ea757c5dee2170e074c0ad1af111968c57e4c0d12c47d4751eb2016baa64255bd832fd6f4bf69e641
TLSH
T13141F688A6E91148B3B77E5AAFF7A46D487AB8772F0B955D10110E4E0622B40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download