57e6e4b4e059f72a949acc0206f179bd8fa7776d4fb49565c48d83c7f1816856

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Batalkan_transaksl/blokirkartu.html
Size 42KB
Sample260807-phacksvfjc
SHA256 57e6e4b4e059f72a949acc0206f179bd8fa7776d4fb49565c48d83c7f1816856
MD5 61a52935996872551a8c1b3365f1e236
SHA1 54ae5af97923cefaf7127bd6ad8522a95b39c9e7
SHA512 b66c0b479284345943e88d6299d19c5f4250dc8d945bd50c2b6d873170da04e7b78f4e5f9c2d86a32a05ddefde51b3e6f4156abf288889686410b236cb37943e
SSDEEP 768:hqtWuq7FFgh8FjYfHfF8V/2aFerFZIo2BxxFiifG7RJq6d9qlaJH6CBXmtPuKpF7:rXm6N2aIrDIlBxxPfG7RJqBaJH6CYtWe
TLSH
T17413C6A2AFE0146C6557E0ACA9B7BB0433399403D60FCD68BAEC6458DF85BE5057378C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
108	raw.githubusercontent.com
109	raw.githubusercontent.com
111	raw.githubusercontent.com
131	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1764	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305787796449896"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{79032B72-89AC-40D1-A6B0-24CF49EEEC72}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3700	msedge.exe
3700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 1852	3444	msedge.exe	86
PID 3444 wrote to memory of 1764	3444	msedge.exe	87
PID 3444 wrote to memory of 1676	3444	msedge.exe	88
PID 3444 wrote to memory of 1676	3444	msedge.exe	88
PID 3444 wrote to memory of 1676	3444	msedge.exe	88
PID 3444 wrote to memory of 4292	3444	msedge.exe	89
PID 3444 wrote to memory of 4292	3444	msedge.exe	89
PID 3444 wrote to memory of 4968	3444	msedge.exe	91
PID 3444 wrote to memory of 4620	3444	msedge.exe	90
PID 3444 wrote to memory of 4968	3444	msedge.exe	91
PID 3444 wrote to memory of 4968	3444	msedge.exe	91
PID 3444 wrote to memory of 4620	3444	msedge.exe	90
PID 3444 wrote to memory of 4620	3444	msedge.exe	90
PID 3444 wrote to memory of 3724	3444	msedge.exe	93
PID 3444 wrote to memory of 3336	3444	msedge.exe	94
PID 3444 wrote to memory of 3724	3444	msedge.exe	93
PID 3444 wrote to memory of 3724	3444	msedge.exe	93
PID 3444 wrote to memory of 3336	3444	msedge.exe	94
PID 3444 wrote to memory of 3336	3444	msedge.exe	94
PID 3444 wrote to memory of 3768	3444	msedge.exe	97
PID 3444 wrote to memory of 3768	3444	msedge.exe	97
PID 3444 wrote to memory of 1632	3444	msedge.exe	98
PID 3444 wrote to memory of 1632	3444	msedge.exe	98
PID 3444 wrote to memory of 3820	3444	msedge.exe	100
PID 3444 wrote to memory of 4424	3444	msedge.exe	106
PID 3444 wrote to memory of 3164	3444	msedge.exe	107
PID 3444 wrote to memory of 3408	3444	msedge.exe	108
PID 3444 wrote to memory of 524	3444	msedge.exe	112
PID 3444 wrote to memory of 524	3444	msedge.exe	112
PID 3444 wrote to memory of 3700	3444	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Batalkan_transaksl\blokirkartu.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffbe146c188,0x7ffbe146c194,0x7ffbe146c1a0
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,14304340594458361884,13228259762940505444,524288 --field-trial-handle=2088,i,15766287429126027982,6388756072999710449,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,17105041528530998904,12079757972609844335,262144 --field-trial-handle=2088,i,15766287429126027982,6388756072999710449,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,9747905888756094395,7757236795791497978,524288 --field-trial-handle=2088,i,15766287429126027982,6388756072999710449,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,11632667573825610247,11409542269558220257,2097152 --field-trial-handle=2088,i,15766287429126027982,6388756072999710449,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,9114558358889351652,1307660737929041100,2097152 --field-trial-handle=2088,i,15766287429126027982,6388756072999710449,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,4209877932396433325,3237280737890031954,2097152 --field-trial-handle=2088,i,15766287429126027982,6388756072999710449,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,2299415184377917951,4415982538950850049,2097152 --field-trial-handle=2088,i,15766287429126027982,6388756072999710449,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,12694138714018269416,15521442449583016443,524288 --field-trial-handle=2088,i,15766287429126027982,6388756072999710449,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,9239268432742113852,7133309913823306878,524288 --field-trial-handle=2088,i,15766287429126027982,6388756072999710449,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,12341789347011373216,15235644066036646635,524288 --field-trial-handle=2088,i,15766287429126027982,6388756072999710449,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,12341789347011373216,15235644066036646635,524288 --field-trial-handle=2088,i,15766287429126027982,6388756072999710449,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,9644156529909367031,14379557887823549834,524288 --field-trial-handle=2088,i,15766287429126027982,6388756072999710449,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,11194198740243160902,13689524756581576537,524288 --field-trial-handle=2088,i,15766287429126027982,6388756072999710449,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,383686142823811027,15423772831047723460,524288 --field-trial-handle=2088,i,15766287429126027982,6388756072999710449,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,18421567579403320642,17554491958590426500,524288 --field-trial-handle=2088,i,15766287429126027982,6388756072999710449,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:8
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6124,i,9662509389613276577,823135757844710762,262144 --field-trial-handle=2088,i,15766287429126027982,6388756072999710449,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 03fc91b350074cc6d8a90982ed7e82febe2c0b7965c1714708a598d6b3a6d507
MD5 48c0c45e934374f084e3dda428be813a
SHA1 624ed31d292a84f3397508fe2b32b5ce233f4fcc
SHA512 a77f50d8fdab5326c23018bb62dc53c199f10248322fcc865e1ac5fd75394ad24d8647b8717d78ec59cf704ed0a1eae76ca4e85cbec92bea6c73002f3a79bfc5
TLSH
T1AC712B1A02FA489DD721A330F1CA1D1E7CF3F19B0E139E89319CD8BDA53A734E4A9458
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c2ed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c2ed.TMP
Size 3KB
SHA256 d63b5dae8b0782d4907563b2a444bcaae97e0e06907f46aac63d3ab66918200b
MD5 1944aa8a60d7a57c7dcc963787476ec7
SHA1 8358b0199658fad9eb3e31d5944b8c5e5ef4f5f8
SHA512 f9175660fa674300ed0c35a5cded10989e12f4568dbe5d24d48d36b65a0ac8d0de9a41038c6c7612a65b996461048edb6cc1ef3bd514c50965e3af9c0d8f9a20
TLSH
T177712B1A12FA489DD721A330F1DA1D1E7CF3E19A0E139E89319CC8BDA53A734E4A5458
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a848c5be1ccfcfd83bc8d93070e608722a7649b551733353929b51bf43552cfa
MD5 93cc8237b16410dedd5d58b76f0b208c
SHA1 3a22de3ddcc67cb013199646c779a0622959c4ff
SHA512 84de2ffae5d183a22193832e5b6099c8f6217c3b664ef3bc0d52112e66e55d5dbfb6ba0b9650da4bbe2dc742b87ad9bd020488e40be49e4b4b46c4cf8550d8e7
TLSH
T17D715BB6C2D44B7E981152F09B267E2ADD1D155A422C3C6A8DF5AF4F73F24B0D20129F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 85ef3540cd30eeacc7f2c02d61562294a1b79d6628967fb1a2abde67404fcc26
MD5 b478eb9742d52bab98a9e8c01f113fd5
SHA1 fc05a1c22a6bd9011f18868d8ff15d14afaf1a0a
SHA512 70e0a83444144c079d1597ac834b946ab1c258a02f69ac9d5a4c955137be883c015768bd007bf58d8f7af7ced3f9468f245339db59113bcccb4b97b261a371ad
SSDEEP 192:sxZdRMyM/jK1Ml8Mkh/fJsSC1AIdpdnHW6+WNGY4wn0cIgrJ:sxZdSMh/fJsJ1BJHbGw9
TLSH
T1D742F911AB38697BCCDBD20DFA55BF53D6F94472A2900D44A9FCDA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0576cca01a19e76d5588fa7b3333f4f0829ca2c11b361708e4d2d1cf4981df77
MD5 39c6528462ef65ae9f9a219614138d7e
SHA1 0f2cf7dd1d81575fc4bf1e435347906d30b2c87b
SHA512 5e192ab4a7f997fe3976dd436d1d334f4b7b419cd059561326d20c0eb2ea96674076fee7ceae25024de5834db681ba34c353811347110a9f697350195f0bc6b2
SSDEEP 192:sxZSRMyM/jK1Ml8UQbkh/fJs8ChOBIdpHnHW6+WNGY4bA0cIg5ZJ:sxZSaqwh/fJs3hbHHbGy5
TLSH
T19A52F951AA385977CCDBD20DFA45BF53D6F9447292900E44AAFCDA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0366fac9a29e9a5089075e2e0df863da42b372fed147201298080852f6d142ce
MD5 43fb67783a7cb3552cec65c9bf91b401
SHA1 2b1c4e2ee3a7b406dc68636fa4d83bad711eb7d8
SHA512 b6980725f263fe215cb8b61426cd942f5166204dfbc3c989129538f87ab7721861f91d7c9c36e3cf7cf3b9c53d8d409c2728864e579b34a6d120e594271a93b0
SSDEEP 192:sxZSRMyM/jK1Ml8Mkh/fJs8C1OBIdpdnHW6+WNGY4wn0cIg57J:sxZSaMh/fJs31bJHbGwH
TLSH
T17E42F911AA38597BCCDBD20DFA45BF53D6F9447292900E44A9FCDA1C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 748aafd889147bad27c526d55a6bffa9196bfbeb5a7f08b5c661beadf65a9dd9
MD5 cf4de8952cbac79897caedf809a968da
SHA1 fb01840ce3bc169c386f62277677c361ca97277c
SHA512 d279ff2bcfdfef7f222d91a98c6778d8b9ef1b368d8ddb72144a962dfcc65cfad2b4afa467b81328f6a1a5e884d035ba5e3d0e421dc09bdbac9dc40012bb15db
SSDEEP 768:uo8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdJroBgkCUn3:uo8iJPNWvx76ru1jahALocdioU3
TLSH
T101D2FA3B680CCB7E4F844E9CEC266F966ED801CB5B984D5447FA884C03C76EA51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0ef36930e23b153cd4132d09c914c182bde1a126955e71f0825a36ea542e1242
MD5 faf28b769b6b5bc1b29d52c7aaf2e85a
SHA1 ceb781473063cb5bb073ceaac745b902cd1ea0ba
SHA512 ee6b3b9a5b8594c2ef3a780a6922ddc9c49a347c1e93cc4cdad302f9a497bd98073d372f859db7aa5eb55ff606a3117ed00f5c9ceda921831f9b817394e61b5c
SSDEEP 48:KsgIvKBWMPyNPK7/1pNkdpgPIgXkKDBbtkHf0aA1voIDKlqcbyVY:Ksg4KBW2qEgKNCqoQKlqK2Y
TLSH
T1B0912F1770BE16513C3E3808E26296164A4277A33118E56F7BE944F20E7BE251DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595e91.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595e91.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 6aa00ad41c43544d8a73a48de81bbc24d3c795cd6d45488f1eec9bff796b4ff2
MD5 ba940a7ddcba0d8e35f87cde1941efae
SHA1 bb0232b1d1841d97969bdfb5cd4c25dfe5ac96cc
SHA512 ea33441fe295a4e2025a7402629687af4e831161fd71286b5e12958d4e6b2695917bb77e6efc5206c982080c7d70dd6436378259d0ca83eba5ad7585abdd45e1
SSDEEP 192:uJLsNULQAmgwmz4FQmiU1c/mt4k03pTeF3wLIRqyrf5CFh9L+3grj+W0lWs:6sNULjsjZikkTi9pf5UrzX0lWs
TLSH
T17A725B716C78AC3A5DE3A545B44B33135FB8806BD6892F98DADC7B2C00DE19C670B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8c16da264d0f1e4cac5f3673065b073608da25351a3d9e98d1c32407e17f9801
MD5 5c81812c1001ae60a61356bcba14a62a
SHA1 49f29c852afbf51d5dd54d2c1b2a4f20e7b99f04
SHA512 9a6414fdd5a0681e06050c43adeee437a686a3d0a1a8761cf07c1eda97b2de1e715413a2c2d599d41e830ee718ab283bfffa229db1d2143a37c1c3b4f7ae1fd9
SSDEEP 96:ZqONk1QsjpfmUTmDK5ih/cIPURHl8h4otop5n5DbBhPwivh50xy0SFYKCAxTeYNK:gONl6kDfQmiUyplZ903plQiCctU6
TLSH
T10B02F83568786CBB8EA3AE46F4473B175FE4112BEA852F84DAE81B1C04D724C170783B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 2d57fe2cfe1ede4b2cb08062982e798ed61ed16870fd901896cc38b967c442f3
MD5 958d83dc2994d4bdd746946e9356af1e
SHA1 b3320bad7bdca8ec4f6ab6926c0abf42178740b5
SHA512 99d037f16ce60a0a2cff4b915d87337b6376f9605a2c0b3b521a9db280141f6b233cf46a2cf9fd8dea60d1d1b1de15b7d13943c94e39fa2d56209d2003e58cdd
SSDEEP 384:/iFiZcIpzsNc8TUNTUlIl8jsjZikkTiUpf5UrzX0lWk:KFQJ5wgPl0pSklWk
TLSH
T18AA26D725C68993FADE7AA45F94A33178FF48077D6C56BE4E6DC6A1C009B09C130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e0e96c79814b4f6bcd087ca84c11441487b80e6b08f7fd3ad77cc9e225a3d5a3
MD5 ed87304689d71b1abdf1a457b337abff
SHA1 6750723234e2f58a1217d867d496ec169a9b5354
SHA512 70af841b11899f9bc43f29b289cca9aa25f98900fa0b4d00b7d73c83b3b3b67b4bc5061028c9db5052a3c90759aac3a07543a8b620ac2951365ef9a6e0c3610b
SSDEEP 192:uJm+xasuheOwQxMGsNUrQAmgwmz4FQmiU1c/mt4k03pTeF3wLIRqyrf5CFh9L+3F:PZcIhsNUrjsjZikkTi9pf5UrzX0lWk
TLSH
T1D1927C715C78A83A5DE3A946B84737174FB88137E7C92BD8D9DD772C009A1A8170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 cb1696bc60e3eeb86c120f06f99c3bdc908e644ef61a7d4d2b2e999c83e6eb7e
MD5 661e7373d2306dd33b4fcba97710adf0
SHA1 292769d62118d31cf65ccb18d12052481692f7c2
SHA512 a8fd24cc32bedd950b54e6ca4ae2502313154c5022888d7018d62ed224a24c34fdbac6aa5616113f328607c093125d6753e0a5d9a0e15ed9224f42d85bd46dcc
SSDEEP 192:urm+xasuheOwQxMGsNU8QAmgwmz4FQmiU1c/mt4k03pTeF3wLIRqyrf5CFh9L+3F:ZZcIhsNU8jsjZikkTi9pf5UrzX0lWk
TLSH
T19F927C715C78A83A59E3E945B84637175FB8C037E7C92B98DADCB72C009A168170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a8187ec4c6fa8055bd8092c31d7d9530d735f182cf44782c5b9cebf9e28e18f1
MD5 f7891ceebdbc15078a8f7462675fad02
SHA1 e5111205f3ac08aac327c97152a70e1adc6be8f3
SHA512 f8854cbefebf6956351aa407ae1537e0c94460530d4a6977ad46a28597e559293c03bb53715fbd1eaf9854d61af87d2c6addc1b454c0080d7b4ca9fe1b923527
SSDEEP 192:EON16kkQmiUyWml+903pTeF3YcRRqyrU6:EON169u+9kTihpU6
TLSH
T1ED121A31A8AC6C7B9DE3A851F44336135FA5812BDF896F91D9DC2B1C05DF69C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33a4efd4-4715-4a02-826f-5350d49e2836.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\33a4efd4-4715-4a02-826f-5350d49e2836.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6fba26655e2d74b986382baf781c01f3d05cd7e5bfcdbb89b6e102aa2041d572
MD5 92e4306be59dcc56407e4c5ddab015d4
SHA1 55d4a167ae3a52a781c1c383ecbab1d4f394b513
SHA512 9af114f463a71f5c0cb2760105bcddb982b65f271b111e8038f04d8061172a3871fa68403bf9b6844f785f85cfbe6dcf5c40c23c9fe3e2516a2c02297a334966
TLSH
T177410658B6F91148B3B7AF1AABF7A46D487B79772F06D49D00150E4E0A23F44D862B33
MD5 SHA1 SHA512 TLSH

Submit Download