4008209dabcee2064991c9a3bd1eff7503353aa57bd698ff8ee9000e002f8a88

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Batalkan_transaksl/banklain.html
Size 10KB
Sample260807-phacksvfjc
SHA256 4008209dabcee2064991c9a3bd1eff7503353aa57bd698ff8ee9000e002f8a88
MD5 d13534ddc16be92b542d59d21f6f2b09
SHA1 e43852c14f003d8da4e84caddc6882629b62ad8e
SHA512 d2857d4cc201eee15fc401ad5eac5ac63474947213c3c79fd4a3c7196dbb5f80545765d4beea8577a0814029e187caad3ab5818bb33810cfd31a162e5610fae5
SSDEEP 192:RRcdStRcTGURPM8OQ6OQ+OQ7OQyJQ7rmgfzed8oh0zx1z0zsq:8vm0zedRhgzm
TLSH
T1D532929524A34005B157E4E42BF61B1A37799103920BCC957FDEB3E4CF8AA9DD1A338A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4856	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305787768662395"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{2FF2CD79-73EE-4CB5-A142-DB6AE3459E77}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 1700	2624	msedge.exe	84
PID 2624 wrote to memory of 4856	2624	msedge.exe	85
PID 2624 wrote to memory of 2464	2624	msedge.exe	86
PID 2624 wrote to memory of 2464	2624	msedge.exe	86
PID 2624 wrote to memory of 2464	2624	msedge.exe	86
PID 2624 wrote to memory of 4364	2624	msedge.exe	88
PID 2624 wrote to memory of 4364	2624	msedge.exe	88
PID 2624 wrote to memory of 4972	2624	msedge.exe	89
PID 2624 wrote to memory of 4972	2624	msedge.exe	89
PID 2624 wrote to memory of 4972	2624	msedge.exe	89
PID 2624 wrote to memory of 1560	2624	msedge.exe	90
PID 2624 wrote to memory of 1560	2624	msedge.exe	90
PID 2624 wrote to memory of 1560	2624	msedge.exe	90
PID 2624 wrote to memory of 468	2624	msedge.exe	91
PID 2624 wrote to memory of 468	2624	msedge.exe	91
PID 2624 wrote to memory of 468	2624	msedge.exe	91
PID 2624 wrote to memory of 4524	2624	msedge.exe	92
PID 2624 wrote to memory of 4524	2624	msedge.exe	92
PID 2624 wrote to memory of 4524	2624	msedge.exe	92
PID 2624 wrote to memory of 4992	2624	msedge.exe	96
PID 2624 wrote to memory of 952	2624	msedge.exe	97
PID 2624 wrote to memory of 4992	2624	msedge.exe	96
PID 2624 wrote to memory of 952	2624	msedge.exe	97
PID 2624 wrote to memory of 4956	2624	msedge.exe	99
PID 2624 wrote to memory of 740	2624	msedge.exe	107
PID 2624 wrote to memory of 4732	2624	msedge.exe	108
PID 2624 wrote to memory of 1388	2624	msedge.exe	109
PID 2624 wrote to memory of 3976	2624	msedge.exe	120
PID 2624 wrote to memory of 3976	2624	msedge.exe	120
PID 2624 wrote to memory of 2356	2624	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Batalkan_transaksl\banklain.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x25c,0x7ffb4f7ac188,0x7ffb4f7ac194,0x7ffb4f7ac1a0
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,18436269271459647358,14004851158399154058,524288 --field-trial-handle=2256,i,5234323406720542183,9452863813129745290,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,4994976990742740466,9705962066319691723,262144 --field-trial-handle=2256,i,5234323406720542183,9452863813129745290,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,1370276180045776731,3884136073575955011,524288 --field-trial-handle=2256,i,5234323406720542183,9452863813129745290,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,2222640067312029446,5012546078558552337,2097152 --field-trial-handle=2256,i,5234323406720542183,9452863813129745290,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,4683855842562167510,10968949729774255163,2097152 --field-trial-handle=2256,i,5234323406720542183,9452863813129745290,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,9279074167902489108,16701382932016251038,2097152 --field-trial-handle=2256,i,5234323406720542183,9452863813129745290,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,3462102533755375455,13269896499640619579,2097152 --field-trial-handle=2256,i,5234323406720542183,9452863813129745290,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,17234749162817457260,17685133606185983040,524288 --field-trial-handle=2256,i,5234323406720542183,9452863813129745290,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,13657025903941423016,18398987178780286432,524288 --field-trial-handle=2256,i,5234323406720542183,9452863813129745290,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,12993065495556129859,3081261737745639540,524288 --field-trial-handle=2256,i,5234323406720542183,9452863813129745290,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,12993065495556129859,3081261737745639540,524288 --field-trial-handle=2256,i,5234323406720542183,9452863813129745290,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,1874974262042421637,6881681830021752354,524288 --field-trial-handle=2256,i,5234323406720542183,9452863813129745290,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,6153036887115588892,8108983844370521091,524288 --field-trial-handle=2256,i,5234323406720542183,9452863813129745290,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,3596533936505127988,1941779368830831989,524288 --field-trial-handle=2256,i,5234323406720542183,9452863813129745290,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2896,i,2906611207496962336,14180899026887289802,524288 --field-trial-handle=2256,i,5234323406720542183,9452863813129745290,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6108,i,17862845491492588880,12182507775028562783,262144 --field-trial-handle=2256,i,5234323406720542183,9452863813129745290,262144 --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7f57aaeaa6e011a74bfcea2b1de30c14180d0d0e9468c1e96a0b75b7206d0347
MD5 4eaa7a16e7f2b35c5b034b4ab4fe5fd0
SHA1 28e23a7d580c312728ba26ddcda68ca526b88191
SHA512 d4a5b93b9024cb117d9b4b668dbc64b652b6bfbee8d675dc09759a606cf811f35a832082a965844fe26d73ef18d8d50e9f8046fc428b462cf43fbd70f51b50ca
TLSH
T10B71A20B06693E95EFE71170F3ED420D38F283F50D632E661E6CD83D652AB274492308
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590bdd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590bdd.TMP
Size 3KB
SHA256 8550b3c129f368c0be73bec48fb4f24c4b69f6e23e8d4ca6aa369ae8ae5d5632
MD5 036c912d69c19cad955f9f3bbd7aea1b
SHA1 23cc15bfea2bcf7ae0c2a98c04e307469edca01d
SHA512 d204e8d4efbbc148ab3f0305f6de62d0848de043ae6523304dd74c08efdd0fc59696c89265a9c2b66b19d6b1fc6fc1387c117129cb9e6bdecf7895d457db39ce
TLSH
T11871A20B06693E95EFE71170F3EC420D38F283F94D632E661DACC83D652AB2B4492308
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1f196367713df742ad35f52bfe7b5695e4f8a6d039be284f4d7bff52beda2c03
MD5 6c558495d23b008c0adcefd32de0b7c8
SHA1 7144a76fbd4dd57f86d89b89502b39eedc1c66d1
SHA512 241e9661c599886c14b143dff3cf9067535ea5b7edaec60113ff8c8e7eb4e68fed53f5df86040753ecc0484db68914304ec380d1537e809f4363710f3191d88b
TLSH
T1A5418EB6C3D5877E881152F05B25AE1BDD1D055B422C3C25C9F4AF5B63F24B1D20165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ed2415f007e5ca49d7f68b523c9d4ea9f6f189e491c4b234fae615670d8180c8
MD5 7f6180cc65d4aa528590b5baa37da9a4
SHA1 7466bd59f4b757d3e54bafca1bdfcebd023ca583
SHA512 b53a282cfa65523069989944bd99be51aabd50ba199c407e2f4a45f9e165476bb1c5980f5639a2aa13ca9bb3ba644d0a4cd62de1c0c759bc48f57a38992e8dfb
SSDEEP 192:sxZMR+kT/fVs08CypTIdpd/HW6+WNGY4wCLNIgrJ:sxZMXT/fVs84MxHbGD9
TLSH
T12922C7526E38697B8CCBD20DBB25BF13D6F95032A1951E58EAFC951C04E7ADD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e4d9059d560da511c0edd8ffea9f7bdb2d124ac5efe5e19d2013ce3a0d76f5c2
MD5 cf2de8e439d141e409a67b0ac1c20490
SHA1 b437b042840591deab318194248f978a20afb582
SHA512 2ee0d9abc570ffd6f4ca4543d9ab1df3fa6d6ef1a008ba63a668ed729895ac0db81368b54e25a8534170ee6ae29496ee1b9a7d1c22d607e3fbf1f61edcc96235
SSDEEP 192:sxZMR+kT/fVsm8CypTIdpd/HW6+WNGY4wCLNIg5qJ:sxZMXT/fVs24MxHbGDE
TLSH
T1BE22D7526E38697B8CCBD20DBB55BF13D6F94032A1951E58EAFC961C04E7ADD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1b8b809f08b37a0936d913b86abef4ad08974779eb0cab8ac937ca757175b36a
MD5 359b89da968c400c011a60c854945002
SHA1 f8496607bdfe7ed7b2dea9adbd07a5e4596b430e
SHA512 71008d69de55a068c315584a7cf5d3dba0bebbe4e9d4ffed07a77f497f4ee40deb5e87c760a19ae96167c524e0eaee6b4c656ca3f31a549af6557d4ae8d40e2c
SSDEEP 192:sxZMR+kT/fVsm8C/pTIdpd/HW6+WNGY4wsLNIg5AJ:sxZMXT/fVs2xMxHbG7u
TLSH
T11222E8526E38697B8CCBD20DBB55BF03E6F9403291951E58E6FC9A1C04E7ADD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 96254283e73f6d277ad9cba613aa4c455ee12cefcbd9b0cab7b6342582608c47
MD5 8792483cb9d01e50d2b0e66aed5cefdf
SHA1 f4d9a5bfa8927dd8074c92cc674a79c41cef4a51
SHA512 4a63fabaa76b99d7e0f95d825ec726150fa532d9611bcc73a147f1d8d988f859c5718465bfd11bf197d3a042f0fdd5ec7afa5312af9e414b4d66c792c4b94822
SSDEEP 768:UfqirTNWvx7jr8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMALl6opTXroxZUnU:UfqirTNWvx7jru1ja5ALocTEvUU
TLSH
T1A2C2EA3B640CCB7E4FC05A9DDC5A6F963EA802CB5B948D4087FA994C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ee4446e710b64fa3855e5ac80544d39fd5207105bfba74092ea4e0d848a6d8cb
MD5 1e80e0c14d7b607c0a0f39ce477c9071
SHA1 e6a94d34b638ebf8e4125a88f39892fc096da9a3
SHA512 b32de2ab0fb191fb2320063b4ebcd2abf94c3e1debacf00d76c53481e91fb1b33f3c7fdafc24d747f4d496e2600614cd4e6e975bd6c0264d414ced6636135f57
SSDEEP 48:Ki/27vhFpk5FAPIAXkKzBbJkHP0GghP5yJAIHKBGMBgIrK9SczyW:KEIgK9WK6A4KBGaggK9Sip
TLSH
T11E91011271BE02013C3F6A1CD25397274A8276A7311CA52B7F6941B24DABE251DBCEED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d050b55-80f9-42e1-a70c-39c0315c394a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6d050b55-80f9-42e1-a70c-39c0315c394a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a7045d572e1fcd2af17500bdebe83215202fe3976c7eadd3632b3df8aed5adf3
MD5 8474799cbccae03c60d279dcbe81ad2f
SHA1 1d1ebe8dee63ca99e68d9d36df0e4f89a47ef495
SHA512 e1b0e3ac5d537c7c4dc1946a0fafffdf3f54466d7bd236fd0265b0404e358e2934f66cb15057c308224004f19beb4b079f57b803d275342d600409a497142fa1
SSDEEP 192:u2LsNhxQWDsxm21QmiU1eYgn4k03NoeNjLImq2lYyXj4Xspsz:7sNhxtsww9g4kvMQyxssSz
TLSH
T153426D75AC786C7B4DE3A545F08737139FB8816BCBC92F94DAED670C01CA2A8130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 001d3c09d49407b41c27c96c7511e74ce5efde1cc0b797935108c2b64483bf4c
MD5 69b482cca684423f3c9437f2652131cd
SHA1 aec45dfd7132c27f33197409b693e143641e9e30
SHA512 90223ca194d854ac2544f31f95850ea9f492a0ae22e9d1b463a9e686a31a5bcf8fceec4e3671664c9520cd8d1997ff31d3e57d75bde55bfc041662332491bfb3
SSDEEP 384:q4iFiZcI+zsNz8TUNTUlIl4tsww9g4kvMLyf5UrzX0XWa:kFQeewgastggySkXWa
TLSH
T189A28E724C68993FAEE79E45F58A33178FF48077C6C56BD4E6DDAA1C009A19C1307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6abd6d45a510f1067f5afd20ff4f9abd4f0d19e511efc1b579d52d08c1b74fe7
MD5 2192b0d4492c01e9c6bbe158e02e166d
SHA1 b8d339aa2bd14bf4d1c9484064a2c154e80f8517
SHA512 5199b52ebe6b72f78920354c221a26408160ddbbbc8b19b338a7438b66c51c4569a5d903fe0e726f752e24d943197bbfaa98a61501c9e138948ec0237817c564
SSDEEP 96:ZqONkcQsjpfmUTmDK5ih/cIPURHl8h4otop5v5DTBhPwivh50xy0SFYK7Ax6YLgS:gONc6kDfQmiUyBNZ903NIQi1EU6
TLSH
T18002E7356C786CBB8EE3AE09F58737275FA5102BEA952F80D9E82A1C40D724C1703827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ad8ddeaa47f4365f1da4742cbf97200b68de6f23a1eb14e232128d1d5abec19e
MD5 78b4f1ac69b6d1b001d9aa55870f572f
SHA1 d93e94480f7486a0c908389eea48b3738fb5e649
SHA512 d7a281f3ac815a123f2d421846fd2cb5d0de43589dd609db04855de3b034dee5c98b7d549488dfc5a8f877d86831233c147c70e0f087d67155ec88a3e14e4532
SSDEEP 192:ulnm+xasuheOwQxMGsNh4QWDsxm21QmiU1eYgn4k03NoeNjLImq2f5CFh9L+3grW:SkZcIhsNh4tsww9g4kvMQyf5UrzX0XWa
TLSH
T100929CB15C786C3A59E7A945F58A37174FF8C037D3C92B98D9EDB72C049A1A8130782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 54d3a1a31b6bf43de4ffa72e5da7ce68a4e659d6309e9b23915e7a26a5fc98ef
MD5 31a95b865889ea80175feb217a108441
SHA1 df2ac478f0c9e2338d4bee0a99e870c6af425685
SHA512 d1724cd2849e566ffc33c08ebb242e4d4410137de40462a1cb21db27b8a7ce5a5b469ef79d2cb0ef77a13e8f9eb4f8dc9865f7ffe3ca092b212ccd8a0348262e
SSDEEP 96:1qONkcQsjpfmUTeK5ih/cIPURHl8h4otop5vRDTBDPwivh50xy0SFYK7Ax6YLgCI:MONc6kDQmiUy5Nz903NoeNocRmq2U6
TLSH
T1F9122A35AC786C7B5DD3A951F08737239EA4812BDFC96F91D9EC261C01DB69C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 585423cf9192202e9df8f2b368b6a5339796047f3c6e3ddc88e852cd3848abf2
MD5 a6c116c324f97ec239bb990a54f3ba3f
SHA1 228e96c6dfe585256b1df06d3776556232dffcf4
SHA512 607511407a7089041a1d67404a40702af274f2f85a493b57962777ed7095ccf25d2df4a65ebb2d2bfe4234ea96ab6b728ed2124c291767224ace4c6c24d289f1
TLSH
T1BC41F35CB6F91158B3B77F569BF7A86D847BBC773E06949E10020E4F0662640C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download