hxxps://thetabchurch[.]com/

Resubmissions

04/08/2026, 15:55

260804-tc9ygahq7v3

04/08/2026, 15:52

260804-tbc74sdb933

04/08/2026, 11:56

260804-n4f7ksdq9y10

04/08/2026, 11:51

260804-nz82ssyhjg10

Analysis

user interaction
yes
max time kernel
124s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://thetabchurch.com/
Sample260804-tbc74sdb93

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4936	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303324031830618"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{FCA7C96A-E9C3-444B-8702-0016F135573C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1636	2128	msedge.exe	85
PID 2128 wrote to memory of 4936	2128	msedge.exe	86
PID 2128 wrote to memory of 3456	2128	msedge.exe	87
PID 2128 wrote to memory of 3456	2128	msedge.exe	87
PID 2128 wrote to memory of 3456	2128	msedge.exe	87
PID 2128 wrote to memory of 2300	2128	msedge.exe	88
PID 2128 wrote to memory of 2300	2128	msedge.exe	88
PID 2128 wrote to memory of 4644	2128	msedge.exe	90
PID 2128 wrote to memory of 4644	2128	msedge.exe	90
PID 2128 wrote to memory of 3044	2128	msedge.exe	91
PID 2128 wrote to memory of 4644	2128	msedge.exe	90
PID 2128 wrote to memory of 3044	2128	msedge.exe	91
PID 2128 wrote to memory of 3044	2128	msedge.exe	91
PID 2128 wrote to memory of 3488	2128	msedge.exe	92
PID 2128 wrote to memory of 3488	2128	msedge.exe	92
PID 2128 wrote to memory of 3488	2128	msedge.exe	92
PID 2128 wrote to memory of 980	2128	msedge.exe	93
PID 2128 wrote to memory of 980	2128	msedge.exe	93
PID 2128 wrote to memory of 980	2128	msedge.exe	93
PID 2128 wrote to memory of 4676	2128	msedge.exe	97
PID 2128 wrote to memory of 1048	2128	msedge.exe	98
PID 2128 wrote to memory of 4676	2128	msedge.exe	97
PID 2128 wrote to memory of 1048	2128	msedge.exe	98
PID 2128 wrote to memory of 4724	2128	msedge.exe	100
PID 2128 wrote to memory of 3920	2128	msedge.exe	110
PID 2128 wrote to memory of 5116	2128	msedge.exe	111
PID 2128 wrote to memory of 2024	2128	msedge.exe	112
PID 2128 wrote to memory of 1412	2128	msedge.exe	114
PID 2128 wrote to memory of 1412	2128	msedge.exe	114
PID 2128 wrote to memory of 4128	2128	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://thetabchurch.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff0ed9c188,0x7fff0ed9c194,0x7fff0ed9c1a0
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,7084445638009864143,14308896146124188558,524288 --field-trial-handle=2316,i,2436895046474698321,734764475535982477,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,12540629789107663492,12832923875701702422,262144 --field-trial-handle=2316,i,2436895046474698321,734764475535982477,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,16964408001248573427,14028641759187577363,524288 --field-trial-handle=2316,i,2436895046474698321,734764475535982477,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,3629623551691708494,4159314899048230933,2097152 --field-trial-handle=2316,i,2436895046474698321,734764475535982477,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,14025739392027372951,8088405397740337728,2097152 --field-trial-handle=2316,i,2436895046474698321,734764475535982477,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,3705673069156933138,8213829528393069261,2097152 --field-trial-handle=2316,i,2436895046474698321,734764475535982477,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,9324330493448941168,7187994864177097624,2097152 --field-trial-handle=2316,i,2436895046474698321,734764475535982477,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,3294893637714496827,8236431429671325559,524288 --field-trial-handle=2316,i,2436895046474698321,734764475535982477,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,14004705404443517329,15609293343044897661,524288 --field-trial-handle=2316,i,2436895046474698321,734764475535982477,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,14185967473357140954,8893147088503157901,524288 --field-trial-handle=2316,i,2436895046474698321,734764475535982477,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,14185967473357140954,8893147088503157901,524288 --field-trial-handle=2316,i,2436895046474698321,734764475535982477,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,3775926473862200522,17730513947841735863,524288 --field-trial-handle=2316,i,2436895046474698321,734764475535982477,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,4484672102786974774,4191576073907046994,524288 --field-trial-handle=2316,i,2436895046474698321,734764475535982477,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,12992858156902245012,12362142394136867115,524288 --field-trial-handle=2316,i,2436895046474698321,734764475535982477,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,4504141688998482173,7942822705780317967,524288 --field-trial-handle=2316,i,2436895046474698321,734764475535982477,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,16316153318686667295,3669142095824034692,262144 --field-trial-handle=2316,i,2436895046474698321,734764475535982477,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 19770e7fe2094711e80964a836e60964de6a8ad16ccaac3d8dfad98369019638
MD5 44dad74e010b183434bee387e897e5a5
SHA1 1e8cd1a25c1805f95db825d1abc631a4dc4b3528
SHA512 4bbc70e7b7329e93d20b196e728888ea0151b121d95738e26f908478d84bd38ac8410bda7f62d907ab7d1206a6ca2df9c6c71f59ce1ad6ea772dbae5c26236d5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

345c4f00-c030-4f82-80ed-9a0696997c52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\345c4f00-c030-4f82-80ed-9a0696997c52.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a399b2a62a178c977ebbcdb2cf6518fb86a21cd9950ba8b145c898bb244c6ff5
MD5 01899088b6cb99d173476ecda02d01ed
SHA1 7e9700e166d06ab94f3019ab24cc8837d828c756
SHA512 8f0b9a478dc85150228a6919c57153574b83b951ccbbaeb130aca4c7c7f43b8ff56829c19838f714c555e813705fcc250d9fab4773c9b5df12d89b59585507ca
TLSH
T1FE7181750AA316C4FB220B3AB3F1760435B1409449AFEE163907BFF8A5C67BE2115A1F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589f68.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589f68.TMP
Size 3KB
SHA256 fbd74a22cd4382c72ead1b0b05a1666827b3530183b2a542dacfa4db21bbafef
MD5 d0f8dfce74a10578dc1d17868560e895
SHA1 378dfa8af5f97c06aaaec6b4f984898edc6847ba
SHA512 ef192e11539c92bb99fcd508e7cd274656fce00aa0e39f41bff8cabee40bbc2db5650c49de549e2a69dffb393f7ea8eb0e97393fff08de65206731c08153dc9e
TLSH
T1A8613C79066315C4F3214238F3F1721475B14598099FEE1A38177FF465C17BE6125A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ff874b09508b7047e60caf3f196bedc9f95e080c81fd9805f449fcec3c57869f
MD5 087592f91de4fa645faf1147f8bcb14a
SHA1 ab86c07149a8e3f597cbc3a6014ece99705623b3
SHA512 b036c700cac4bb0e2f66da60feb308a21ac3573d9d6fd8366738247b7b37399b7ce73fe0481a6c416f29fb17de9d9278c403c9c8846505e994f5ad5c54ae22ce
TLSH
T189819DF2C3D88E6ECC9157F1AA146E1BCD2D1A1542283C99C4D4FE5B57E20B1D21275F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b25faef595aecd7e4744540099e4e0507993208d42a3a52b250ec86a899a9238
MD5 587c41fc87437416f0c1e567242b2b2b
SHA1 4ddaf9a12522ab62272532cb22256c1af4484421
SHA512 0653ae8388727eae843703fab28efcdbf9529628a66f7e05ef2d8778c5e5986cf036727802cbb5de10e76e311c6deb23ba43a412560a75b44de7ca449336b5ed
SSDEEP 192:sxZcRyyM/jK1Ml8Mk3/fNsuvxsIdpN4HW6+WNiJ14/YHUVGyIgrJ:sxZcwM3/fNsuvx1eHbW4/j9
TLSH
T17652FA166A346977CCCBD209FA45BF53D6F91472E2940E48A9FCDA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2cb22bd978ac378f2183fec2663b6251e33a5d4e36df7eccc4e338d9f252f6b3
MD5 909e09876c84e8f7d1d0b437f32caaf8
SHA1 a8c3050195f482d9d10292cb20a6297c863cf5a5
SHA512 893772d8f65ab10293a727d443da5f4cd6f0087f74332d74c2e61c7232d4cda07bf01c9781630f9b63b89e1124884ad725d55047945fdd46503175e0c9b7e280
SSDEEP 768:knUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RfroVi0E:knUZYTMWvg0Pou1ja7eLZmRM3E
TLSH
T1FDD20A2F280CCB7E4F844E9DEC2A6F863ED801CB5A584D5447EA884C02CB7EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\81f7d89c998bbe8f779b2836ea99b19ac7114538\088a5d41-5ce5-4b2b-8bf7-67f5543e282d\index-dir\the-real-index
Size 72B
SHA256 819fa896e12f086caaf44cad5fba60dea7ef82c2feae3811ade40a9741410a3f
MD5 7e79ec05e1c6b119fbc03c3d15bcaf5e
SHA1 76a440bc0430b8ce0d4d1b3fbf8e7e3dfe208484
SHA512 cb5b6bc5b851872259b9a0b657831dde4697d3dea8f4e6b0d6767e8a3dab0f46edafbc5819cd227763a355675338e10e3ebc23865de8339e9f89d71c94edb6d8
TLSH
T164A0021819D60E81C6500279B453039132345D94317597116AF05844CA79540D51704C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589c2b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\81f7d89c998bbe8f779b2836ea99b19ac7114538\088a5d41-5ce5-4b2b-8bf7-67f5543e282d\index-dir\the-real-index~RFe589c2b.TMP
Size 48B
SHA256 db9a59026f8268d82c535ccd2614a5cd4d905e560c82acdbd10307d348771677
MD5 240c9dc122fbf037cd7b1b4f446f3e9d
SHA1 c1d19a9bc5982b735dc40df8f908532098b03997
SHA512 0fbb88d2bbe683ad1fc010800eabdef5814315a55d4f3d1642890d6fecfe9aa20b36fa78d6395e3fe895d30ca8b5fd706ccec3168aa3bc3953bd4a15a38a6f30
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\81f7d89c998bbe8f779b2836ea99b19ac7114538\index.txt
Size 131B
SHA256 b18cd609a35bc29ff8f00df5351ce83829b77a44e3b0a40f16e143fdebcd7f3f
MD5 7526cfd75894def7be218c9faf9e6602
SHA1 e04b0c21c2d33154a0078e17ca330237ee8c6789
SHA512 6aa6f999aad8034011228f82e5778cddabd3de53d00c5dc0a4b85810f52cdd319ee5893f7ae01f493a83c07117d654d2da02b487ad56f0b56355dfc2ff2a5984
TLSH
T105C02B6B0080C1D41ACC43D0CC35D36EF80E3AF8CE444C000D2F425650060A30801F01
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe589c5a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\81f7d89c998bbe8f779b2836ea99b19ac7114538\index.txt~RFe589c5a.TMP
Size 133B
SHA256 99865833125c47c6b29b5813e9e5dda7ea3831a03b449666fac0f987d0d73170
MD5 59d37acb91189100e3fb9c401c127c80
SHA1 3959b567936eec6f45dc87b4faa2b28e12306ed6
SHA512 3349d576e44f6defd9ce0d8709f39eb30af1f25131cb35614f6565245f926e934e3647fe16e5724d6aa90cb1e34f83e72df23d3d38418d7b3bbd57f57a97f0cd
TLSH
T1C6C02B6A0090C3A019CC43D0CC3593ADF40E3EF8C9044C100D2FB25560360A30900F01
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 0d2b401ec7b78dd78c73ccbc6f125f5139ee752edae7b3302464927f569189b0
MD5 25778c8ed5329e45958741070c83453d
SHA1 c5d292d0ec4d1aebee5c2dfedc23555494894deb
SHA512 c06fcf3581b8b1532c450facc202923559443a77cdd1094d6f1ab04b0dba42549ba08d498ad1c9170dde476f6861dc996246a4cce00790458442ceef6e05d022
TLSH
T176A0023141540147C001027190C506C5E715BD515A49631793EC407698FC144D712308
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58723d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58723d.TMP
Size 48B
SHA256 5f3969e2172496728d81a38dc2f16d90d4f6d78f3d655cc12c915a81a3622420
MD5 d684996de8a4e82b09ce50171f72ce12
SHA1 2b4b34f6618f07b32a908fffb35021cb440b2857
SHA512 f9e6bcb6fed3e9c349d70542999a7b089a802908a6c4941bae3ef1d4bbf405c524bfd9532652f0e4f0288e4b5a84b9cdff03acae26440df43a47d5a15f27d281
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 8KB
SHA256 e3e8da434a23d51921a5f45d6b69f23530574de4f50ddcce711dcd7c98f39464
MD5 fb522b9bb97aa13432d69e6d8be13be7
SHA1 8338a6b233cdf63a90d6e810d6bf26b43415e811
SHA512 0bd15688e97b07ffd96699876aac1fc046f4dd091fb40c701acd89b698a4b7e8920c641e02853d7a3d008fdae12981777db507269c1c7d053445d32d349798e7
SSDEEP 96:KA1eK2AEsIKZSi6cgKNiOvaKAsWje9+cK/qIMYKRiCikQKl2k:E2PncJjeyAvbP
TLSH
T1EF02560271FA12123C3E2D0C82949B678A52F5A3345CAD6F7BBC55B14E66E205DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5905f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5905f2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9fb0260ef17cea0edba66e8ee8de6c542260eb6b5bfda4bdb481bfedbed50836
MD5 734f04c78a3f95d949027f56b26e5bc2
SHA1 dc2732ddbe6cacbfec568682b19627705ce189ce
SHA512 b0e181a079f185e090e5fd0bbd7205a4fe51e0e19d0e06c71d861a28ac120a5302d4df5cb277995d9f88ac7e09255170869e8cafdce1e02115a4254b2829a174
SSDEEP 384:dZcIhsNKrUX0s1zX5od+08y91XafBeRs9JKgqijUeAd:FhyNOrafTjKgqmUeM
TLSH
T1FE928D319838AD7B99F7B582B48A36134FF89027E7C46FD4D1EC6B1D009A698131BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7746527d6098dd4a7e2dc5b526e7eef3a99fa083d04ab1ebb122dc7568077090
MD5 69b5f80b3773ff26b84bf5b7c0688e09
SHA1 244132bc32ce045b0d7652ce5ae9dc1cdbefb85c
SHA512 73efdfa1c600787343decbecac0e0228b45c00cef681dc16e744edf1a7998a4325a547b39fe6818626c950bc3df150a8d6fc37752df8c64309005834160c9519
SSDEEP 384:ZiFiZcINzsNS8TUNTUlIlaUX0q1zX5od+08y91XYfBeRs9JKgqijUeAd:wFQ1jwg/NOrYfTjKgqmUeM
TLSH
T126D229F144D7983AD9AEA743A77D2D124EBDD063F6806A94B3DC5A0CCC461BFC30A912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e477eccb451891d20e4fd4044ec2c622e9d0ebb133304dac8367fd782f50db86
MD5 cf6272adff6c2d11e90e3eab70b12e56
SHA1 e4f080906890378e1737c4a3509fd36898e4dc57
SHA512 9d57f093edfbd2ab003e8892687de230718cd6513a6888b9d045020a98ea82682da468aaa24449dd24131e44d263d949aaa5fbbda5aac153f30aeedc6df39cf8
SSDEEP 384:WZcIhsNKaUX011zX5od+08y91XafBeRs9JKgqijUeAd:Eh0NOrafTjKgqmUeM
TLSH
T174928D319838AD7799F7B582B48636134FF89027E7C46FD4D1EC6B1D009A598131BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 984f6de450dbf8537b8186cce37268225e89c9616530e1f6710c2b66bcf85df7
MD5 9c38c44428b5ccd42b3ee84854461bf6
SHA1 530526de890d120295aee7de155e47c2a6a44a13
SHA512 027c282d5f31616dcabf16f87b7b7831561a795e565870c45833fa65600b572374d0131ea47b539d1c8b5934fcc3aba05f51017d9ac67fb338f154ae88ad8c3a
SSDEEP 192:yONJ61VWQmiUy6rgGX5Obd+jIjzorynm2k/aZ3oDLU6:yONJ6WPgGX5od+08y9zuDLU6
TLSH
T18202D835A8687CAB8EF2BE49B48737135FE52167EA552F84D6E81B1C00D769C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f1d37c3a807ddfc6855dd7114ef908825d68ae3ee95a2802df42af586a0cb207
MD5 df75bd261489c28a04012c9e814ef24c
SHA1 2951f1516edd53921ffa2dd041e66a129968cc9f
SHA512 3200fb5b19ea790e82bf316ef41d28a153b3f601821090c4e8deb52758a58b4e3ee7da39ffdf76160d3dd827b02624d4622d398bd016ae665ea4ffbb74a141c8
SSDEEP 192:NONr618WQmiUyUrHGX5Obd+jIjzorynm21XaD1jJnqwU6:NONr6BrHGX5od+08y91XEfU6
TLSH
T17A120836A468AC6B5DE2B545B08732135FE95167EB886F84D2EC2B1C00DF69C131BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab6c26d7-e963-4744-be75-af64528079f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ab6c26d7-e963-4744-be75-af64528079f9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 06f9ff62c11e3ed62125ec9f3ee8def82ce2dee25d6188c2aced321526bf8e61
MD5 5441d716faa7b4f22c496978c7fe8ef1
SHA1 20c2cec2040cfa54f665132c2707e6a649c6b8c3
SHA512 b8ce41c5bb9064a5faf5123d1affbdd4c42bb001b83a6ab3310b4bd6c82b0b3c6f1801cdefc6fe7479aa5033e8b6bbc003f12aff89e46843d1d7b3b24283f9ab
TLSH
T175412458AAE91148B3B77F65AFF6A8AD487BBD772F06D45E00010D8F0A66B40C861733
MD5 SHA1 SHA512 TLSH

Submit Download