hxxp://www[.]khebraip[.]com/

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 10:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.khebraip.com/
Sample260804-mhgesahe73

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2464	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303128785852588"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{228C1880-D416-4F7F-92EF-AF7C15D85F48}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 3360	2776	msedge.exe	87
PID 2776 wrote to memory of 2464	2776	msedge.exe	88
PID 2776 wrote to memory of 412	2776	msedge.exe	90
PID 2776 wrote to memory of 3040	2776	msedge.exe	89
PID 2776 wrote to memory of 412	2776	msedge.exe	90
PID 2776 wrote to memory of 3040	2776	msedge.exe	89
PID 2776 wrote to memory of 3040	2776	msedge.exe	89
PID 2776 wrote to memory of 3564	2776	msedge.exe	92
PID 2776 wrote to memory of 3564	2776	msedge.exe	92
PID 2776 wrote to memory of 3564	2776	msedge.exe	92
PID 2776 wrote to memory of 4364	2776	msedge.exe	93
PID 2776 wrote to memory of 4364	2776	msedge.exe	93
PID 2776 wrote to memory of 4364	2776	msedge.exe	93
PID 2776 wrote to memory of 1480	2776	msedge.exe	94
PID 2776 wrote to memory of 2068	2776	msedge.exe	95
PID 2776 wrote to memory of 1480	2776	msedge.exe	94
PID 2776 wrote to memory of 1480	2776	msedge.exe	94
PID 2776 wrote to memory of 2068	2776	msedge.exe	95
PID 2776 wrote to memory of 2068	2776	msedge.exe	95
PID 2776 wrote to memory of 2372	2776	msedge.exe	98
PID 2776 wrote to memory of 2372	2776	msedge.exe	98
PID 2776 wrote to memory of 2372	2776	msedge.exe	98
PID 2776 wrote to memory of 4936	2776	msedge.exe	100
PID 2776 wrote to memory of 2272	2776	msedge.exe	101
PID 2776 wrote to memory of 4936	2776	msedge.exe	100
PID 2776 wrote to memory of 2272	2776	msedge.exe	101
PID 2776 wrote to memory of 4472	2776	msedge.exe	103
PID 2776 wrote to memory of 4528	2776	msedge.exe	106
PID 2776 wrote to memory of 3096	2776	msedge.exe	107
PID 2776 wrote to memory of 4232	2776	msedge.exe	108
PID 2776 wrote to memory of 1592	2776	msedge.exe	115
PID 2776 wrote to memory of 1592	2776	msedge.exe	115
PID 2776 wrote to memory of 5108	2776	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.khebraip.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fff7e95c188,0x7fff7e95c194,0x7fff7e95c1a0
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,3558434751920823007,11352538313389440318,524288 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,11047398442415874525,8448367029379150355,262144 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,16665892722258802618,4256395781164678233,524288 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,7827783086281413839,3098747516630007739,2097152 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,2084709936243958492,15826591514303191177,2097152 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,878876997021124027,7693627180608833027,2097152 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,7860359566377809563,7499927317533057373,2097152 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3680,i,10598446738202086223,11021138340067072601,2097152 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,6645508485928398759,10891554424768761515,524288 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,11629551443526935142,1884347726118038293,524288 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,17667256051015603917,1132652299816961252,524288 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,17667256051015603917,1132652299816961252,524288 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,8811555893583541454,464691168082819450,524288 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,16099780923416416519,18234444625145200813,524288 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,18194148274612744616,17070638833080057487,524288 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,16330080305319970883,12862794421470719427,524288 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6304,i,5150305562266406513,4488885403585135458,262144 --field-trial-handle=2376,i,3305061507380540810,13072325799374793550,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 484bcb5c661e6c1ab7c1e8eb0c2dc5467b2aad2bbfa7193f8c39808e2bc6a2bc
MD5 0303b5ff4733f8166294ea49530b902f
SHA1 dcaf0862a7b91f354c8fbd6433da224b0d79fe0f
SHA512 3c3ff7263abf5e7941634b2d489f03a0b875cc87021be2b45ea0f9cc3587625ccfb24009d6570292f82c542e63f3bb31ee266157332eb559db4019f9a6131084
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 9a0e089e9dc773ea5c77cb6e1ab4a286197e963aa5bd4cfcf1fa4c498418d294
MD5 86d4bee0623b545a973089fbb2f90336
SHA1 e7a82168b42f8edb99fdd931b1513575efa61880
SHA512 ee5d78ec01ab96a71c58e17276cd6bcc688982c9cf08cdbef5d2a1c8cf8a30ace1a03ba21351a356fb3eef4ce08d24f2f550ec8d45380d67b3a2792912731e3c
SSDEEP 48:bKHmegenSRIMy/XFJmj4CYb0pccGTbrxAv1NzMvVAen93E2V3U7lBPa38P6EaW7P:OVQ6NJv0lGTRczwAx2F8oMiEV7P
TLSH
T10B913B3B06E08DC1E7A047F875DD2AF4717281DBFC9F5FAE11549AB43867B23520948A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4bfd1dcd20b77c3dfd50b647a8e17aee9bb7f65c762fc4ff00af1211431e8cd1
MD5 2f02299554a2d4561a8cbffeba1206a9
SHA1 37901f7df1e530ff62a27ec35ab30088043be2d2
SHA512 cbf200f799eb86c8f11feba6332eb9b2d4b66107411d0322babcc23fa8670b817449ba67731c292e2fe738d0c192c10f4c7340df096f4db9eba3450c90f521df
TLSH
T152813E3B06E19DC0EBA403FC75DE19F4B47284DBFC8F0EAE11505AF47827B22520544A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596874.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596874.TMP
Size 3KB
SHA256 9f80b5b0c39048235bf8a55149ebe926e056a74684b402a7a529a3bfa827856a
MD5 df407d18d4b5a9a917fed3b1e6566c95
SHA1 3a39bc3ef68dbd3fec1ff05a02841beabf125d3f
SHA512 dd2fbd888f79b3b1999e3e0c61e3f40bbd4a53df21f4c101584399a8d393b941e0d2f0dca9eb3e3a8a4560a5d9e3b9177cf06f82d7b41de05456aec855c4185d
TLSH
T1E6713C3B09E15DC0E7A443FC75EE1AF478B285DBFC8F4FAE51904AB4792BB224205558
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 88c1069fc53e3ae5ab1bc02fbff70c5cb02961b8d0cf9f783e552c659ffbe0c3
MD5 0ed708b69c63ba863ee19c44c466f7f2
SHA1 5e706e5ff3bf22c9f1d5cc150330e90fcd66a979
SHA512 49bceb6196dabb6eb45fe250815d64ca72c8283db121e4b942b7dcfcf78ac2de234d9e890c723e8318c057a37eb05a15639e710abd62097cb100b9f27211fa49
TLSH
T14D51A0F3C3E8A96DCC1153F1AA256E2BCE1E091483683D1AC9D49F1BD7E2071D501A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 58dd87d6a6712b21423d424ab91e103b5925054a1e23d47bd2db9e66c85d1d58
MD5 87b4718af29dbd541cdca7132a950d93
SHA1 a853d1eca254149f4502b613e5d7a666055bfb6e
SHA512 483a20acbadde822ef43f5f2fd9682a499498eeafb4edc5e2566307195732aee7cc19a732991a636ccadf9b000bdfb1cb0ba870e9eb88cf54eee2c52593a11dd
TLSH
T1B551BFE3C7E8A96DCC1153F1AA256E2BCE1E091483283D2AC9D4EF1BD7E2071D501A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6297c0cf266463e2c451661125eefc516749a647b81bd8f4c4cadfa9c4600bfe
MD5 567b90c9cb6db586088961ff32cd9bb0
SHA1 d8c8ffed3cd8b7b2a25e734870943470dc07302c
SHA512 4d57d08ff100a60ff31e5d7f1a2cbdb0b779586f678e974f57745ff4f71750e192b823f525051cd00c526a240a968ecc8dd28082c42540eefd83bb44aad90e7a
SSDEEP 192:sxZIRzyM/jK1Ml8Mkc/fGsP1QTRIdpwdHW6+WNQ65/YCetws6IgrJ:sxZIjMc/fGsPaTaMHb7/xJ9
TLSH
T19B52FA116A38A977CCCBD20DF945BF53D6F9147292901E54AAFCDA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a66b6c809e0dd0d8da8c9a98e8dcd01205a44cdd78aa4d74cb878c882c2de5a6
MD5 ba864c69f5329d1f425480f1cdbaa4b1
SHA1 890f419e2677715a2bb8562f34ebb4717479e5da
SHA512 5ef142509c569b557dcb63a7aaa7f98ef4e183a0331561e5ad18b76949700b2de5fe7c4f9ea43d9eae4dafc232160a7308bef1e7716aa3c0f1d61c46f7050a51
SSDEEP 192:sxZIRzyM/jK1Ml8UQykc/fGsO1QZUIdpSGHW6+WNQLIZYC7Y2is6Ig56J:sxZINqxc/fGsOaZNVHbjZn8JU
TLSH
T18C52E7116A38A977CCCBD20DBA45BF53D6F5147292900E44AAFCDA1C00E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 625a5d8d73e7798f5668be56cc8e76d91c1f0ed09ad80b2f55d0b109f0f3000a
MD5 98364fc42b88e9e89880128c4b42825f
SHA1 0ece5d200b582e54ca448349a4f0899cf0530140
SHA512 44b084124876acfef2649d8b93610b82853c93ac4deda6447532ce08d3c8aac393c67cb2c96910953274ea1d9809ef06e424e5802c11f988064889e04d608cb7
SSDEEP 192:sxZIRzyM/jK1Ml8Mkc/fGsO1QZRIdpwdHW6+WNQ65/YCvYtws6Ig56J:sxZINMc/fGsOaZaMHb7/L9JU
TLSH
T17B52E9116A38A977CCCBD209FA457F53D6F9547392901E54AAFCDA1C00E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c7be184aff0774af0c80755d87fea16e1a6a1c7491763010259f07dd930eaaba
MD5 40e9bf07e068b546a7f1c7b426f93364
SHA1 fbb4457da0a33f61c7ce1f062b961fb0ffdec1f9
SHA512 3d799f0554dc3a86731c19832de9aa579220c4122c4ba68784dfee4fdcb563783d542fa235508474f9be3ecce3c86bd59f9ff2ccde951ad1c037f4ec80e6ec63
SSDEEP 768:lq8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVyrol:lq8bqn+WvSCt6u1jaCZLbWVpl
TLSH
T11BD20B3B280CCB7E4F845E5DDC26AF966ED801CB6B988D4447FA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 5063c9d87f78939f92dc3a7ee17094bfa012a00c1736b2c869ab7b1ba229c349
MD5 66da99ea87b9ba9698e42bc8a36a9a8f
SHA1 add76e613d1771fa0c56c08e3a3b31e1f3896f71
SHA512 40eaa906935822db06a985f8f105569f5c504923ca6ed730e19d42b09a300d76bc73da934b69ea7c67452c5e68aeb17259a55e60db92da928d6270b13f4f465f
SSDEEP 48:KoPI1Ksk4fy5eIXKbqkH3IVK8kIvyhQIfKFmcpz:KoP2Kski6ewKbqE3mK8kqyQQKFmmz
TLSH
T18CC1D92133BB061138BE290C96E9A537CD4276637818E46F7B7804E64E67E216DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e1ab217ea1cde04481c9ddfa263c59ec1ff436ea22f7690873137bdab12987f9
MD5 af4ebdf8009cebcebeed01be2a277eba
SHA1 df6045fd7d1852c7a007b12c53b3b8cc01bb0b6a
SHA512 deff1f5e4096c6dd4159e283663f775ac36bac5216d1f874cbe64a6c615f6fe1ef45698eccd146a03b3400291fc05c7942c86c2dfa9e74554108d771c58da720
SSDEEP 384:XZcIhsNsrZW1i9BEa+YOMII3+2cQBeRs9JKgqijU1U:fhlNqalOpI3lcQTjKgqmU1U
TLSH
T132929D31583CAD769DEAB585F8873A178FF89067D6C56F90D1EDAF0C019A98C130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0589f2b80cab45a50840515bfdd1bb45a65d70a55516ea2ba11b10f350d5463f
MD5 206697778e78baa20b0a7a3d8432aa5b
SHA1 4519bae136760b6b338d55018b9865a635607bfd
SHA512 73e4b4689451cdad94c2412b85754f57093312ac398f8a3b447e230f4fd80ce7e0fce3de7d80c76086bed15638ad7637aa6e0f0e3df8b2d41cd49a74367cd52a
SSDEEP 192:vON26Db6QmiUyAQHBa+jEOm/HoTRgSdU6:vON26u2HBa+YOMIKCU6
TLSH
T1CB02D83568786CB79EF26E49F88727279FD8106BD9962B84DAEC1F0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 60750cf1e97f07c4ca2f8f571eeef92793f4dfe5a102899c7a11297321f3e924
MD5 7fa5a31523b418fe4e7f73205eeee95a
SHA1 977d8b58718388b053d4474cb8cf5852fbc8c88c
SHA512 10338989d8f0ef28e0f472077768072c381ec63168d153c956ffaf8ff4cf7d55fbd391c545db09e90325fa68811f33e2149cac2f01866a21c602258bc2a0e367
SSDEEP 384:bZcIhsNscZW1i9BEa+YOMII3+2cQBeRs9JKgqijU1U:DhcNqalOpI3lcQTjKgqmU1U
TLSH
T106929D30583CAD769DEAB585F8873A178FF89067D6C56F90D1EDAF0C019A98C130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 31a542cd0111f5680febf6365686f3cbf822ae04ea64353c12761088a4294a49
MD5 2da58cb6fa9d83d09f4bf9281ba43b85
SHA1 2a73087d8146a2327283be2dcadf656301789b3c
SHA512 461244a4fbc0aa9bab33286d7b1b767fe97679237fa8764396300589a206ab0d75e83bf9abd2d4cba3cebe59525177902fb70d5a41cff33b415bb40b3dc85d34
SSDEEP 384:aFiZcIwzsNk8TUNTUlIlcZW1ibBEa+YOMII3+29QBeRs9JKgqijU1U:aFQsBwgWrqalOpI3l9QTjKgqmU1U
TLSH
T123C23AF104EB8936D9AE6743A77E2D138EBCC057B5816A90B3DD9A0CCC461BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ea0b21291dc32994bc874bb501c6955a7db92b57b0de3af47b26b32375d1740b
MD5 efd5a287d0bf6225468c1516753c1844
SHA1 f4b555c4ab7a1377bc9b389d2c803d8eccd033fc
SHA512 b5030ab181b360758476d555ba7ff4e113c880c8cd0e861da74016665ad0de3a646d36ba17e58865e4c27b4c2b93b1f4838a83d31df181d1c8853af4be82d1e9
SSDEEP 192:LONN6DbsQmiUy0iQzBa+jEOm/HoI3+2FNz0q2U6:LONN6UFhzBa+YOMII3+27QU6
TLSH
T198122A36683C9C775DE2A554F88736138FE85067DA8A6B90D6DD1F0C01EFA5C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

579f98fe-97fc-4f24-b70b-c1118c620103.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\579f98fe-97fc-4f24-b70b-c1118c620103.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9a101371d68bfb1a5609256dff913905bd055ec64388a84e95487faf13009c8f
MD5 66092a8c5d0d6d47662e3df8578f4531
SHA1 421542982b6cd77c6026d9b80aec68113cfc526d
SHA512 edc7011b1c0eeec03e5e31eaf8920c6dc04afb3847eb1d6488e9fe0c191e1c5aefdcf8208a8bc6ebedb28e01a94888903f6af9f404f98436336a42430d7f7378
TLSH
T1CC41F858B6EA1148B3B76F5A5BF6A86D447B78332E17D59E00110E4F0A62A40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download