2513d8c4a6561ecd3f1ce036e860bc692a63c127918eb1be1f8e0cd398b6be78

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Batalkan_transaksl/css/index.html
Size 69B
Sample260807-phacksvfjc
SHA256 2513d8c4a6561ecd3f1ce036e860bc692a63c127918eb1be1f8e0cd398b6be78
MD5 d937fe0c84aaa46354991ecb105466b1
SHA1 15a5f8429e9f2ef0296cf9716f5dfbd08b9acca9
SHA512 b4b31482b59d756470853106a111778f737cfaf4787db6f320e80e0d75f344bd3dc2389434ea4648f2212cda8649c9aa308aba7726cbe52d1ba2bc4258e09e73
TLSH
T1C5A002B759C67480064F548D275324D6F9CFA0BC9A6E09C26C06428A61E3C9326A9B5D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3744	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305787744500172"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{F412C67C-431D-487B-B895-E0328D6C210E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
460	msedge.exe
460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 2876	3884	msedge.exe	86
PID 3884 wrote to memory of 1824	3884	msedge.exe	87
PID 3884 wrote to memory of 3744	3884	msedge.exe	88
PID 3884 wrote to memory of 1824	3884	msedge.exe	87
PID 3884 wrote to memory of 1824	3884	msedge.exe	87
PID 3884 wrote to memory of 2012	3884	msedge.exe	89
PID 3884 wrote to memory of 2012	3884	msedge.exe	89
PID 3884 wrote to memory of 2352	3884	msedge.exe	90
PID 3884 wrote to memory of 4476	3884	msedge.exe	91
PID 3884 wrote to memory of 2352	3884	msedge.exe	90
PID 3884 wrote to memory of 2352	3884	msedge.exe	90
PID 3884 wrote to memory of 4476	3884	msedge.exe	91
PID 3884 wrote to memory of 4476	3884	msedge.exe	91
PID 3884 wrote to memory of 2348	3884	msedge.exe	93
PID 3884 wrote to memory of 5004	3884	msedge.exe	94
PID 3884 wrote to memory of 2348	3884	msedge.exe	93
PID 3884 wrote to memory of 2348	3884	msedge.exe	93
PID 3884 wrote to memory of 5004	3884	msedge.exe	94
PID 3884 wrote to memory of 5004	3884	msedge.exe	94
PID 3884 wrote to memory of 4748	3884	msedge.exe	98
PID 3884 wrote to memory of 1436	3884	msedge.exe	99
PID 3884 wrote to memory of 4748	3884	msedge.exe	98
PID 3884 wrote to memory of 1436	3884	msedge.exe	99
PID 3884 wrote to memory of 4172	3884	msedge.exe	101
PID 3884 wrote to memory of 900	3884	msedge.exe	108
PID 3884 wrote to memory of 2572	3884	msedge.exe	109
PID 3884 wrote to memory of 1656	3884	msedge.exe	110
PID 3884 wrote to memory of 664	3884	msedge.exe	118
PID 3884 wrote to memory of 664	3884	msedge.exe	118
PID 3884 wrote to memory of 460	3884	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Batalkan_transaksl\css\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b8,0x7ffcaaaac188,0x7ffcaaaac194,0x7ffcaaaac1a0
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,8705578602749652861,1897054803067450040,262144 --field-trial-handle=2320,i,12954542627908561366,3037249078637120408,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,9168649121458110350,8719123722100487325,524288 --field-trial-handle=2320,i,12954542627908561366,3037249078637120408,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,15006276237508604779,6567406435212806002,524288 --field-trial-handle=2320,i,12954542627908561366,3037249078637120408,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,4300952433631998343,8297861071139159610,2097152 --field-trial-handle=2320,i,12954542627908561366,3037249078637120408,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,14017127374195008490,11233171589479434060,2097152 --field-trial-handle=2320,i,12954542627908561366,3037249078637120408,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,15763853680172201193,17729887952814203710,2097152 --field-trial-handle=2320,i,12954542627908561366,3037249078637120408,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=2352,i,1561905532921999130,13772469384784416357,2097152 --field-trial-handle=2320,i,12954542627908561366,3037249078637120408,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:2
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,635963733103420497,6937112634069900281,524288 --field-trial-handle=2320,i,12954542627908561366,3037249078637120408,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,1472020265935821479,1066766155408185983,524288 --field-trial-handle=2320,i,12954542627908561366,3037249078637120408,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,18372566439851220788,13944254455135140784,524288 --field-trial-handle=2320,i,12954542627908561366,3037249078637120408,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,18372566439851220788,13944254455135140784,524288 --field-trial-handle=2320,i,12954542627908561366,3037249078637120408,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,16942143263530640064,12120220824319702034,524288 --field-trial-handle=2320,i,12954542627908561366,3037249078637120408,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,17841551460865888265,15530365897053081055,524288 --field-trial-handle=2320,i,12954542627908561366,3037249078637120408,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,6425271506267064290,17074044032997684252,524288 --field-trial-handle=2320,i,12954542627908561366,3037249078637120408,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,2182861596510840672,4003803739325142758,524288 --field-trial-handle=2320,i,12954542627908561366,3037249078637120408,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6080,i,18087103269018020131,12819684862856622619,262144 --field-trial-handle=2320,i,12954542627908561366,3037249078637120408,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f2c8acda3b977666a92244d9e40469b91906b081058ab867794d939d351ef11d
MD5 9f2dd53495b18626e3189f556d1e4f68
SHA1 601088bc354ade7b539241166a25d2fddc01f681
SHA512 f53d745573dc5b15d5edbd2a237c7c8fb8f8db924b1c4ca0fbeb719541e4dffc62db0be982e932a8198c538df245d0dc369dae09fb30676b323d8a5dd49e0679
TLSH
T1E561E7BD0582EDF6E3D13A3190C03A8738F190E8FD63FD5D01E348B9640AB114A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588fc8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588fc8.TMP
Size 3KB
SHA256 90f1ebb13f50ce78d53152c3f222bfee3f869d542b924fa9f71a7fa0e4fa7317
MD5 333fd8ba879414356a105aafcafcde21
SHA1 63577f6d701ef1036e0e6c0e62cc763362f9b5c0
SHA512 474a4803c117b2486c8bc657c8d0eca5390a60dbee10afc0b3bc0b8868df6c59f20325da8ebaec55c6b26b3caac9ed1dfe12cea167136b1d4478e234b61bb6a4
TLSH
T1C361C3BE0582EDF6E3E13A3190C03A8738F190E8F823BD5D01E348B5640AB114A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 3c51a0c717f87fec5f7b2a77fea106bed610a5dfe52e3a985b55f3186ad82f79
MD5 5f9db8209dcb136f737a5844e2c72921
SHA1 e1da66afefa5f3c640dbcb7879b488c3ce6faf58
SHA512 79067ce75d6addb90dbaf6f7dca5d313ecf9990872626b17c5ad2758ba455589bba9e28281d334d48efc5393d69f0faf8fcf8b7d759efd4294646e6c40cd3456
TLSH
T13A117DB3C7E5856E891116F05A24BE2BCE1D0505431C7C15C5D4FF27D7E3475D10155B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ed04928dd5e2941a01c5d183ea15cc9151edc2fb39fc7b3085f738f1db3d9763
MD5 ded6564f07929e97893d819ce347e1f1
SHA1 9ef7bf1ba4caff0a5c1a2f46c29a1a7da107ce07
SHA512 81b0a6b3e2f604a11806fb69752c55d30a4e9829bf99a69a110f57008c0aa4cb813d841dbd2ec67cfa7c992d13d747fe5f3851f5bac8896b057de1845c35be9d
SSDEEP 192:sxZuRxyM/jK1Ml8Mke/fgs+CZZAIdpdEHW6+WNGY9IKdGBZIgrJ:sxZuTMe/fgstZbKHbGig9
TLSH
T11142F9116A38997BCCDBD20DFA557F53D6F8457392900E54A9FCDA1C00E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 384b1e61cf7f123262a104a7692f7b11698908833925195df08de1fa8bf3682d
MD5 c123b173b3805b83207b0904b217df61
SHA1 3097230d68d28b2aa8aa6579df069b04dd42ef81
SHA512 368df251b660274088faa363dc6488891aecc81978dc257f8c84271c7bf9f324a44ffe90ef928c7085158518ffe38ff5b3ba9197a909ac2669630d3e1f0f3661
SSDEEP 192:sxZuRxyM/jK1Ml8UQmke/fgsDCZaZAIdpHEHW6+WNGY9IPd9BZIg5XJ:sxZuTqNe/fgs2ZabkHbGNpz
TLSH
T19152E815AA385977CCDBD20DFA41BF53D6F8447292940E54A9FCDA1C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7facf834646f37a8907739e15736525b66e943fa895f60496df6eadea2b61023
MD5 6adc170286c97e3728640b92589d9119
SHA1 0ca23038def839625ad4c9ffd1cc62a3f3768da8
SHA512 2034aa3bccc59fe7abb4865eb78cd889c84b0f66edfca33a7e53d21686010961dcda41c5af5af40bc7cb89c710990dcc1b875374aed403b2083dee550520691c
SSDEEP 768:1qcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNmro+g6u:1qcv21wWvu+Z+u1jaeFLeRNd++
TLSH
T16FD20A2B280CCB7E4F841E9CED2A6F8A6DD801CB5B988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 81ffd3bfbb6ecc8589f9b0761afabf16048e020909c6be9753db9b3ca5bcfbf9
MD5 4d04fb1616fa6da8b823f6250826041b
SHA1 d71ca16d2ddc6a13f8c22ec1325f1e5f0bba893b
SHA512 88dc72aa3a339f902a07d4e451f690fb4c699b2dc21213d0da14bc5af3504cacf61952e85e5756210efb0a329d07a81f867d2edfaf34d96e730f5ec7d56b2186
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDCygKTyaaWAKXqy4:mTfHXf4
TLSH
T185919506707E06833C7E284C96A685364E4235A77505A57FBFB800E54E67E226DFCCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592cc3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592cc3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1d993c06cd0d5d81c54027c0539e4ceefc86749f5dfbd1122d3fcbf3c0313236
MD5 04a51e87859332c81ff0c50c04be35dd
SHA1 7d4caa1f88d709069c18d33dabeaa22714b2e4e4
SHA512 6fc854f5bcc4600f47848beab605690b1586d9a5013949716c8977a0894bc36c7426ecf47185563b4ff41ecebc33db2aaf48af8f6ee75a78b8e04dd9a7662901
SSDEEP 384:qZcIhsNBaekziMuye+CXOmep3JrRpTf5UrzX0fWI:IhPIlvO9p3hRpTSkfWI
TLSH
T120928C716C385C7A2AE7A945F94B36178FFC9127D2862BC8D5DC7B1C01EB6AC130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 0d5c1ab501793b649d9f9ba9ade1947f0eb52dea8f568a240ef34519018ffe5e
MD5 cbd101f698f247d7b8224f2aa5430c7e
SHA1 7c50bd425e5f5b97ddc93197e38198d0781f9370
SHA512 975db7bed9391ae02fb184230b67bde75c4fadcb51d364686e335e17231324781738080de4124e00a3cc6c0aae38db4713eb5592385b76fab749098649f46973
SSDEEP 384:kiFiZcICzsNT8TUNTUlIlpekziMuye+CXOmep3JrwpTf5UrzX0fWI:/FQK2wglIlvO9p3hwpTSkfWI
TLSH
T136A27C725C68887F6EE69E84F94A32178FF88177C6866AD4E6DC7E1C019B19C1307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4f0f7c00cc0eab0b26dca3bbce21a5cd8aca8828f19a9e31b36c1d3c398c10c4
MD5 0a9d05f4b81ef446c788f58be35f40dc
SHA1 93eee0202c4249bcd2cb00ec4da9f9a113d687c3
SHA512 265e0ea28f49bd0f575c7091841aec5702a21cb35e9e767727a489da18cd381d3de2d5299e80f65660cdf35c7c29a71628595a03808574cfe7376228e5bf08ae
SSDEEP 192:JONO6v+YLNQmiUyHiZh+CG6Om9oEusClU6:JONO6vz/jZh+CXOme6iU6
TLSH
T14202EA35BD281CAB9FF29E45F98737275F98217BE9962F80D9D82E0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 75f45420773af1dd2f4c03ea9f2b60920bfbe169b950542dc63d393ea3aa7670
MD5 5a9d40fcf48e19340e312833ba0646f7
SHA1 3e81af1cabbf926ad580da69659c05ffc8057c9a
SHA512 fe90e83e172769926292c5a3a9c8729f3ac91f8fdb8c20340dc2c6acc24004255daf5eb698fa36c445dd84f168f4a6197fb09a2b3b361f73f77dbb7407343b4f
SSDEEP 384:dZcIhsNBpekziMuye+CXOmep3JrRpTf5UrzX0fWI:FhgIlvO9p3hRpTSkfWI
TLSH
T19D928C716C385C7A2AE6E945F94B32178FBC9127D2862BC8D5DC7B1C01EB6AC130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0732871b6918b2c5fa0c07430ed66e78a99bb24ff2287a59000793e64a091f66
MD5 cc60a8c3a5f7358b2fa0144b83836456
SHA1 7a037e2a293cf0fdd88a3561576b34190143f597
SHA512 7aad1bc13728852251676508acf1b931fab668cf96de1b01e60b6e4781f922e0a9959f3765f0ead4c308efc6eb53360335d047a55f6b2b1155b0fef25b294f27
SSDEEP 192:xONE6v+YLfQmiUytMiuh+CG6Om9opwSJrHcCHpbq4U6:xONE6vzFsuh+CXOmep3Jr1pTU6
TLSH
T18D122C35B8785C7B5EE3A991F48736179EA85177EA4A3F80D5DC3E0C02DF6AC130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b88f0c9-4106-4a2e-be89-1bbe343fce42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7b88f0c9-4106-4a2e-be89-1bbe343fce42.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 55c396957818b36150c7f0420861a44f16326b845f1c772e5ff2135d5623742d
MD5 ce357d4f8578555a43470058b1adf475
SHA1 d07ac2d68643c1d6bae163ee0701eff1f6cba16c
SHA512 9a81b42760fa6f20e85ecf9772bb38cc3406e1606fd93717fdd6dfc111550f5bae8d2fc7ce40968c31921b2c0a0cb9b6def78145e134032b3068e4b915573be9
TLSH
T16941F659A6E91148B3B76F56DBF7A86E487F78372F06859E10010D4F0A63B41C871B33
MD5 SHA1 SHA512 TLSH

Submit Download