hxxp://34[.]196[.]3[.]244

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://34.196.3.244
Sample260813-akebzsff39

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2492	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310537781590399"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{512DAADD-6324-49BC-B759-11D774185C38}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 3772	2640	msedge.exe	85
PID 2640 wrote to memory of 2492	2640	msedge.exe	86
PID 2640 wrote to memory of 5088	2640	msedge.exe	87
PID 2640 wrote to memory of 5088	2640	msedge.exe	87
PID 2640 wrote to memory of 5088	2640	msedge.exe	87
PID 2640 wrote to memory of 1172	2640	msedge.exe	88
PID 2640 wrote to memory of 1172	2640	msedge.exe	88
PID 2640 wrote to memory of 1564	2640	msedge.exe	89
PID 2640 wrote to memory of 1564	2640	msedge.exe	89
PID 2640 wrote to memory of 676	2640	msedge.exe	90
PID 2640 wrote to memory of 1564	2640	msedge.exe	89
PID 2640 wrote to memory of 676	2640	msedge.exe	90
PID 2640 wrote to memory of 676	2640	msedge.exe	90
PID 2640 wrote to memory of 4288	2640	msedge.exe	92
PID 2640 wrote to memory of 1616	2640	msedge.exe	93
PID 2640 wrote to memory of 4288	2640	msedge.exe	92
PID 2640 wrote to memory of 4288	2640	msedge.exe	92
PID 2640 wrote to memory of 1616	2640	msedge.exe	93
PID 2640 wrote to memory of 1616	2640	msedge.exe	93
PID 2640 wrote to memory of 5020	2640	msedge.exe	97
PID 2640 wrote to memory of 5020	2640	msedge.exe	97
PID 2640 wrote to memory of 948	2640	msedge.exe	98
PID 2640 wrote to memory of 948	2640	msedge.exe	98
PID 2640 wrote to memory of 1772	2640	msedge.exe	100
PID 2640 wrote to memory of 2496	2640	msedge.exe	114
PID 2640 wrote to memory of 4732	2640	msedge.exe	115
PID 2640 wrote to memory of 2484	2640	msedge.exe	116
PID 2640 wrote to memory of 4172	2640	msedge.exe	122
PID 2640 wrote to memory of 4172	2640	msedge.exe	122
PID 2640 wrote to memory of 2844	2640	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://34.196.3.244
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffb1b7cc188,0x7ffb1b7cc194,0x7ffb1b7cc1a0
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,14606095537158857042,2371089749139108008,524288 --field-trial-handle=2192,i,3892795054138864963,8132712532129931786,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,2680946277932096691,2189822679298849742,262144 --field-trial-handle=2192,i,3892795054138864963,8132712532129931786,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,5990602872152456980,15712557359781203161,524288 --field-trial-handle=2192,i,3892795054138864963,8132712532129931786,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,5283107150094341335,10552053633859221781,2097152 --field-trial-handle=2192,i,3892795054138864963,8132712532129931786,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,3707589447383382141,8807184048810821693,2097152 --field-trial-handle=2192,i,3892795054138864963,8132712532129931786,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,12852865545059244986,2286809557699545916,2097152 --field-trial-handle=2192,i,3892795054138864963,8132712532129931786,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,18002839908438952513,2052798114876992533,2097152 --field-trial-handle=2192,i,3892795054138864963,8132712532129931786,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,5904298005033012811,8421197832931097741,524288 --field-trial-handle=2192,i,3892795054138864963,8132712532129931786,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,11079356041510945009,16370172075769190196,524288 --field-trial-handle=2192,i,3892795054138864963,8132712532129931786,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,10901453442946554257,5509079832721146493,524288 --field-trial-handle=2192,i,3892795054138864963,8132712532129931786,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,10901453442946554257,5509079832721146493,524288 --field-trial-handle=2192,i,3892795054138864963,8132712532129931786,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,10953531935139911938,8169711338064200422,524288 --field-trial-handle=2192,i,3892795054138864963,8132712532129931786,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,5032735823662932521,14434024622089947260,524288 --field-trial-handle=2192,i,3892795054138864963,8132712532129931786,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,14265356334544102436,1149272539338084372,524288 --field-trial-handle=2192,i,3892795054138864963,8132712532129931786,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,2951735134093872656,16371570529132366433,524288 --field-trial-handle=2192,i,3892795054138864963,8132712532129931786,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6664,i,18349013071007069188,5130425311659162731,262144 --field-trial-handle=2192,i,3892795054138864963,8132712532129931786,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 991008b9b0595d73a834485ea29586af44591a386941c327848eaa62bdda1d31
MD5 361e52e3af42b9ecd11b87e3113f10ec
SHA1 317337f4abf4ee15758d7ffaf16d705572917ecd
SHA512 176061638831bb89d64d18adaba36e7e65a39b64768b1d30891a8116bd979cdb3c938e30394f379c786c984d6a7590d1d7d0b299de23e12b878648fc110b41a7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T1ACB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b497834f18442fb0d9b4d2da64d3e4bd01057fe0c82caf09d36d2a84a63d1c0f
MD5 f563771ba16be03cb4140d0a6a215612
SHA1 ced101262a1af96b33909d21f60207edb536c5f6
SHA512 3096b107e22ed013134ffabba6447f4aa420b6f714e4ab9fab6bba9852af2a5a7e286c2515fc08401e16c20c8ae6f75fc557496c4043a87e6486cd393b71f4ad
TLSH
T105715E7911D22756E39A7533E2F2060635708FA90F133E611174F93DE819B266726DF8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e598.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e598.TMP
Size 3KB
SHA256 babb08120d3508952f504576eaf8fef86ea5dd7f473babe6392d33084f5c24e7
MD5 40b55e229eb5e286741e30e5b0a20c37
SHA1 5c3d4311c1b239090c64f4f9dec2094adde4d651
SHA512 db1faca943e94729628b552a2b7a592a2d2cc72c8d0077ba8e1c102fbfc5d3d80490beddd8b6c3113b71b7543800eacb309d0d62ff8af4821d132e3943ecab5d
TLSH
T178713C7911C227A6E38A3533E2F2160A30708FA90F137E2110B4F93ED809B166776DF8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0f617ef9de288fdc90563be20c822c73067ebb81ccdaee3d3f6594736bf2bdbe
MD5 f75998ed65a66d0de24ac6a1ad6ac4d6
SHA1 1f2725cb460ef03fe319bd447925776f663c2324
SHA512 45b8ec24ff3c367d14659ea860d20ef6b9c7bfde53fe6da1468c180a1d990b230ae5797386630a895dd7b9a4e9f7f6d565b532711bb20e6ed590cba5862babd2
TLSH
T198319EF7C7E4C63D8D1166F4AB296E2FCE1D051943283D2AC9E4AE5B9BE2071E10164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 46c0e5cb8b8284e355884827cb775b05031360a39a868bc3dfb9eff777f18642
MD5 8fbbc15eec65929598979e7670859738
SHA1 e95299ce8047339f4837b842b2ce57cd31173eaa
SHA512 86279f462898c6cc7052f33a9969e3bcd71ff91e4ae7e15d05240d2779a7b25ce78dc2c07b6b734924dbac6c76940390020a77b7296a1319bd9ff5b52ecd0c9d
SSDEEP 192:sxZxRHyM/jK1Ml8Mky/fMsRBiY4IdpkBHdsk6+WNEFK/Y4hmhyIgrJ:sxZx7My/fMsriYJwHd29/x9
TLSH
T11252B611AA34A977CCDBD219BA45BF53D6F90473A2901E44A9FCD91C04E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5012ef116c3198db150dab29de24bcbc756964b38b10b847d8985408fd85e48d
MD5 f9b7f38751a5bede7983059aa3f3deca
SHA1 00b6a2961e0c9daf1d4070a428fa2ad1712358bc
SHA512 6871e3025a2ae8a394400dd02b9065fdb159f68c0c3bd003733fb40bd3c316b602b4577e3297a1f4e481614c9ff70c34f4e2c1e5af503096c8a0147410ae9802
SSDEEP 192:sxZxRHyM/jK1Ml8UQxky/fMsy1BiJ4IdpGBHdsk6+WNEFK/Y4NvXryIg5tJ:sxZxVqCy/fMsyviJJKHd29/bGJ
TLSH
T17952A511AA349A778CEBE21AB945BF53D7F9047391901E44A9FCD91C04E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e4b05269e28ba6fb07b3d2996ff65e7afcf7b8eb0cd2b387057e10e8ea7ec75c
MD5 703b9047a614b9c08993d457747e5479
SHA1 b1d753c6560c7e1b9a7e5fcc3bb1fb241fdd2c01
SHA512 f1d51a72cb9b06f24a271f351ad4eb578f5bf52445ad14858da46d85ced683d0895921a5e9a36a18f92161b51ac8020d09b11e820f990109498d7eb496c0a456
SSDEEP 192:sxZxRHyM/jK1Ml8Mky/fMsy1BiJ4IdpkBHdsk6+WNEFK/Y4x4hyIg5tJ:sxZxVMy/fMsyviJJwHd29/7J
TLSH
T17652A611AA345A778CEBD219BA45BF53D7F9447392900E44A9FCD91C04E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8ae3014b92597b3c0c5af8c4871a56b66ad77329392614ddea297917788e172e
MD5 478ea433b27523547efea0232146dff7
SHA1 3290e4ca88f59d22c48945db8d77350f946533ae
SHA512 9bd42fd2b8da0d88d63a33cfa6895aefdf5974c5bfbf3fefe72d12ec61cf163e149b8ef515ceec53411fad1fa257e71e15b541a013e8791afb009bf5295d1a9d
SSDEEP 768:es8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdNroakOUn9:es8iJPNWvx76ru1jahALocdmEU9
TLSH
T1A9D2FA3B680CCB7E4F844E9CEC266F966ED801CB6B944D5447FA884C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 67e997ce30aabea879491ca4390af0ba20819406d537a08bcd4013af3dc266ba
MD5 6f7ecea0a85c09000b8366491ef6a053
SHA1 b23848e151ac90bdc64143f5f747d1ab9d96814f
SHA512 2c21a07c014320108e4bd9ed1b862001306e6530e8616baef6bed75a259bc743643ef1ca661f7434b089b5f1cff709b1b1539b1f2644e5058264563c964e004a
SSDEEP 48:KV9IhKe0sbyV1INKGQADw3MQGee+QOFlIzw+K+LWC+KoudNSgfyAa1+KQs48Qcbp:KV9aKe0yG12KGQBpmKqsCOn+K8E9
TLSH
T187B12131B4BB53413C3E295CA9758A36068275E33019A57F3BA811B24F6BE660EFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5494313-5f9d-4b3b-b211-64a37ffbf9ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d5494313-5f9d-4b3b-b211-64a37ffbf9ce.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 bf7d2b509642acb476f4ddf9be24972f71ad661f84430689975db4775ff4e4d9
MD5 740486aac5f031b4662681539d45a1ef
SHA1 1111e6001899ad7dc093d2dd0559292e2e8fd9af
SHA512 9507adb2260a5d5166a7b790a4ec7841ee96cc5cde6e833cf22dc6364b3eec0250a14c5089c4fbfee0c628fd06d4279d737e093b3ba36e764a4a2c83ed86edef
SSDEEP 384:asNTTY30vaZ4kg8kyv7XLo37OOPrXLpe8C/gB35:a35ZJbs37Oi9Pf35
TLSH
T119727D32A4786C679CF3A695B44A3713AFF9446BE7C42F54DAEC970C04CE2AC1306D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 4f35af86930c817d5d7dfb847168c970d0e6b8aaca9f24b18a0fb6276f65301d
MD5 b97768f09846e8b89905db6304bee6dd
SHA1 ccc284c00d34b147f0439487dbc180ab17a8d63c
SHA512 cf0d94f895136c7a79bd10c3bfdb000f025e2b771ab4053266f50c27523b20ea10b948ab92e7dd5e0d7c3cc7c0eac9e13fa8d9968485f12f78765fd4fe9543da
SSDEEP 384:XiFIsNO8TUNTUlIl8Y30vEZ4kg8kyv7XLow7OOPrXLpe8C/gB35:SFIlwgX3ZJbsw7Oi9Pf35
TLSH
T1FAB209F244E7983ADDAE9B47A73D2E039EBDC067F5846A54B798550CCC8A1BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 70c3fbdf2ab7f7c9bb246147a098b299a9c545a18ddc5200b3c599492f17a78d
MD5 ddf691d33270a37a3ef78e64cde79f34
SHA1 307c3cb7f4fd4d83cc12897689899814236e71b2
SHA512 cc63a66a7f7be434fe6d950affc875a3511892b34f85055e350076931e61d8ffafe30257633ab8bb1b01a2daddad1fc0c943f293270e8aac5c3801b31513b41d
SSDEEP 384:XiFIsNt8TUNTUlIl8Y30vEZ4kg8kyv7XLoC7OOPrXLpe8C/gB35:SFIgwgX3ZJbsC7Oi9Pf35
TLSH
T1DBB209F244E7983BD9AE9B47A73D2E039EBDC067F5845A54B798550CCC8A1BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e99677403841479d68b7af834c3979b088003773c6fd9f22ce35381abc1f4178
MD5 c6eb630b4b772d7d75007019e31f17e8
SHA1 5741f9fb322b5d331f75d858ce220de71244d024
SHA512 39970334ab880a833672eb6afb4f906394a0c7aacbd694dcc5cd78d539306580ebc5e1f245199046583b04e89ff92dd895bd4a2dfd44f236fe4ff372aed412d0
SSDEEP 192:gONv6kDfQmiUyy0Z9035jzorkbravWQihaU6:gONv6ghQZ9g8kyv00U6
TLSH
T12C02D83568786C6B8EF3AE49B44B27275FE5112BEA952F84DAE81B1C40C725C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9d042a991e9c240073687b9c04a7d99ca79c1d8a317774967868a549697223cb
MD5 e8b345a66ead5cbda9a1d01f00e120f7
SHA1 5f858b3d8563f011bcdd7b4be5b47129e0413ff5
SHA512 8a0a13f9aca948ddd0e364cf13b564060b0b3b694dae590698f2d4611aa2aa9daeb31faca21eff848e414f990042550ca477266f8bcde516e4a5a272e87031aa
SSDEEP 192:PONG6kYQmiUym029035jzorkbrav7XHNNoTcR+qvU6:PONG69i29g8kyv7XLo07U6
TLSH
T1A4123C3264786C6B5DE3A955B44B36235FE54127EBC86F94D9EC171C01DF29C130A823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 2a00bc52e77760e0984bf729c0ec6fa39e247255f5ed483a82808d79cb884596
MD5 4dd2c5a9cce6f1a77a01cf666749da25
SHA1 a1b929dafd30c778901630aec7f4e9ef979707a0
SHA512 65aef586a926593cd4262c9d844ddcdfc985560bad6c08d7696e7720f17f278e2b6e1f5a51fa1178fa3abfa0136bafc17639d75624fc65063201c79bedb7a5ad
SSDEEP 384:+sNT8Y30vaZ4kg8kyv7XLo37OOPrXLpe8C/gB35:+w5ZJbs37Oi9Pf35
TLSH
T1C2727D72A4786C679CF3A695B54A3713AFF9446BE7C42F54DAEC970C04CE2AC1306D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba124cda-e4fe-41e4-8282-da7402fd2db6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ba124cda-e4fe-41e4-8282-da7402fd2db6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c42d75aa71757d30fa2980ef7799855aabd43a0ed1a00dc48c541d7eb4c36bec
MD5 632ce317454ac77f584863a9a106e814
SHA1 ef68519f9dffd6077f529ee0b3878d684b197b6e
SHA512 3e1eb35538b67baa4cdd8882338127842c62befd54f306d34462e6fd2db8f401b5b21819b5c0759f1d459996a3da022a06a5e06c72a61ed0d46be5fb7a475666
TLSH
T119411C58E6F91148B3B77F5AABF6A86E487E78772F0AD45D00110E4F0A22B41C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download