b715b02538c6befb774364b526f14d2e6b2f990f9e7a1c721e4f02b04e7885eb

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
consultapp/pages/admin/usuarios.html
Size 8KB
Sample260813-ppynrayxbv
SHA256 b715b02538c6befb774364b526f14d2e6b2f990f9e7a1c721e4f02b04e7885eb
MD5 deb9d479d03716ff0741830666c18243
SHA1 90274fab980943e03961d72791f5a9f1951ec1f9
SHA512 b76f535e97d165bee7fa8ec65dade25ca85e772ed98f2bcc24d6338b110bee91e3161bd414c594582f0b7c9f1c4a20579580f52c7752d82da51857cfc7abb4c9
SSDEEP 192:QvzhXP/6Ribg0dMDQovGySFSUG2pOsK1QytKIpKJwaQi4N2S16121/yfASfV:Qg8U2oPg
TLSH
T16B121D9172F336B3B92381D61B26EF536AE0C063D485C9107BBE1BF94F89DD0694790A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2492	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310979082786537"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{D6B4EDC8-BF55-4ADD-87CA-D372C52FDE6F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 3840	1592	msedge.exe	87
PID 1592 wrote to memory of 2492	1592	msedge.exe	88
PID 1592 wrote to memory of 2244	1592	msedge.exe	89
PID 1592 wrote to memory of 2244	1592	msedge.exe	89
PID 1592 wrote to memory of 2244	1592	msedge.exe	89
PID 1592 wrote to memory of 448	1592	msedge.exe	90
PID 1592 wrote to memory of 448	1592	msedge.exe	90
PID 1592 wrote to memory of 2520	1592	msedge.exe	92
PID 1592 wrote to memory of 3808	1592	msedge.exe	93
PID 1592 wrote to memory of 2520	1592	msedge.exe	92
PID 1592 wrote to memory of 2520	1592	msedge.exe	92
PID 1592 wrote to memory of 3808	1592	msedge.exe	93
PID 1592 wrote to memory of 3808	1592	msedge.exe	93
PID 1592 wrote to memory of 4796	1592	msedge.exe	94
PID 1592 wrote to memory of 3812	1592	msedge.exe	95
PID 1592 wrote to memory of 4796	1592	msedge.exe	94
PID 1592 wrote to memory of 4796	1592	msedge.exe	94
PID 1592 wrote to memory of 3812	1592	msedge.exe	95
PID 1592 wrote to memory of 3812	1592	msedge.exe	95
PID 1592 wrote to memory of 3256	1592	msedge.exe	99
PID 1592 wrote to memory of 3496	1592	msedge.exe	98
PID 1592 wrote to memory of 3256	1592	msedge.exe	99
PID 1592 wrote to memory of 3496	1592	msedge.exe	98
PID 1592 wrote to memory of 1692	1592	msedge.exe	101
PID 1592 wrote to memory of 5032	1592	msedge.exe	104
PID 1592 wrote to memory of 2604	1592	msedge.exe	105
PID 1592 wrote to memory of 2512	1592	msedge.exe	106
PID 1592 wrote to memory of 3292	1592	msedge.exe	107
PID 1592 wrote to memory of 3292	1592	msedge.exe	107
PID 1592 wrote to memory of 5004	1592	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\consultapp\pages\admin\usuarios.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbe35fc188,0x7ffbe35fc194,0x7ffbe35fc1a0
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,9190666677284079853,14522651420079955382,524288 --field-trial-handle=2168,i,4033715346554460421,6765791580275607109,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,7726581493363235303,12403946118367797830,262144 --field-trial-handle=2168,i,4033715346554460421,6765791580275607109,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,8623980918013385651,3358823900831874781,524288 --field-trial-handle=2168,i,4033715346554460421,6765791580275607109,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,7913445155967087976,7743276779776164990,2097152 --field-trial-handle=2168,i,4033715346554460421,6765791580275607109,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,3872931842697883884,581865688539522147,2097152 --field-trial-handle=2168,i,4033715346554460421,6765791580275607109,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,3955948053673819428,4009684318685088927,2097152 --field-trial-handle=2168,i,4033715346554460421,6765791580275607109,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,2851116058296329463,2380909023829055609,2097152 --field-trial-handle=2168,i,4033715346554460421,6765791580275607109,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,12969954762273283435,404013008371474802,524288 --field-trial-handle=2168,i,4033715346554460421,6765791580275607109,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,9523006123456293721,16637876830513288917,524288 --field-trial-handle=2168,i,4033715346554460421,6765791580275607109,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,15249390376429166892,1858972751177221739,524288 --field-trial-handle=2168,i,4033715346554460421,6765791580275607109,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,15249390376429166892,1858972751177221739,524288 --field-trial-handle=2168,i,4033715346554460421,6765791580275607109,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,9821838432180738807,974466912396796401,524288 --field-trial-handle=2168,i,4033715346554460421,6765791580275607109,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,1162476159915595969,9021918269977842310,524288 --field-trial-handle=2168,i,4033715346554460421,6765791580275607109,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,12602000450025544956,1401484469503617576,524288 --field-trial-handle=2168,i,4033715346554460421,6765791580275607109,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,10195413468974570605,12525290000626449381,524288 --field-trial-handle=2168,i,4033715346554460421,6765791580275607109,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3536,i,17801966741428598653,11265630426154012411,262144 --field-trial-handle=2168,i,4033715346554460421,6765791580275607109,262144 --variations-seed-version --mojo-platform-channel-handle=1016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dd93834da96bc48df415033553eedf80bf463830fefe71342451e6e1b32c7df4
MD5 4c06f574572eee1673951f747ca76821
SHA1 df69bd0102f053e4561f41f282f3f7737318c3e2
SHA512 c1877b6b3b78a0b4cfbfb13ce0642e895f7d5d2c05e2baa9946f294b3c71b3059f0ab80b410a2b047739a8cd8e0e70440e81f617957ffac4b11ed7e9d358fed4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
TLSH
T1C3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cea087ed469610ed457d02e0180357d06b168b52b3b08233b3642b8beb44d652
MD5 50b562b1d1fcc88004f88079154a7fee
SHA1 0b99cb3b7936394c68ac7d8b6bf5b4d85e37a7e9
SHA512 001462b46a0d8613409ce7a315eb489c539cb43c38384720c41fad995ff3968f28591f7bda54002bb24aa156c25ff9b184cf0945a65a3f555acd0af63cc375ff
TLSH
T12D61D62886B2C985F7967431F2E1B20474FD88993A5F3F4E684058BFFA1EB147025E38
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589b12.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589b12.TMP
Size 3KB
SHA256 72ae246557caa8ff3f81579579118e534444d404cc29dff5e2ea919fec4f5fd0
MD5 56bde2e534fe54c3eafb579b4a89fcf4
SHA1 96fdd955a582639129017d6ea30e44d94aaa0c59
SHA512 3f8af75c861ad3cfc173cbd60a15f2561e9ec73f3e416de43790fcd438da6968e420a8345d17ea2d8250ce2ce4582b85148c64687817efad1e277c800a7208e2
TLSH
T1B961C52886B1C985F7967431F2E1B20474FD88993A5F3F4E584058BFFA0EB547025E38
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 e046e822a583739fd79b9b1222152f0bf3fbc83f6c99e5b826322d2b7fabc0d1
MD5 df77ae3433b3d5a3956d22248ad7edd5
SHA1 50aef11fef864494ce4b782439494d67e3c1ad77
SHA512 34cacb3b9afc441a56c68db258ce7dc00de403dc8c1fac0cb480ea0ac11223a4bc35f18a3acf0942dc3b21da38cb5794a6dcb9d5c71088d85170db9d8ece6d46
TLSH
T14C117AB3C3E5956E8D1156F05A24AE2BDE2D0A16421C7C19CAD4EF2B97F3075E00299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2d655c1d6d22a875d4092162b30dd5ac6238926541e983ab1ca5466521a526b6
MD5 638aa324316b5930c420c18e0058fa0d
SHA1 fba4044547a0632b27b34d49573f2a76dde060ac
SHA512 e8ac97f12d362fb99057465241ec3877cef23f4f0be62fa08d67a75a6ca022a452c0ad9f69a6f695f40a941c9450be58b6a170fadcaf161910a5919b815fdc98
SSDEEP 192:sxZe2tTRX7yM/jK1Ml8Mknh/fHMst0EeXkIdpde1HW6+WNGY4weNLOesbIgrJ:sxZP9Mh/fsstTOWHbGw9
TLSH
T14742E7126B34A977CCDBD20DFA55BF53D6F91462A2900E44A9FCCA1C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b1f3b2baf0c3433328c57cad7b707f3c90ec44836d50da8ea5a0d55b31db564d
MD5 70b15f248b2c9b277d867e4e78065b0f
SHA1 831ac77fabe225ed7fe35cbd36818f123247c8e7
SHA512 0fa66adb1d18b72c87b4175bc0edbae0615274895cf74c450f63171b26a5e0a39f665b895591a3104091866aef8463431d89ee8fc84dea5e1b282f144f691ebb
SSDEEP 192:sxZe2tTRX7yM/jK1Ml8UQ9knh/fHMs60heXkIdpHe1HW6+WNGY4/eyLOesbIg58J:sxZP9qWh/fss6COoHbG4W
TLSH
T16A52C7166A346977CCDBE20DFA55BF53D7F9147292900E44AAFCCA1C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 451f6ab7ea6f076a39597918817bf4365d9639dedbb872d5081e6b8b553579a4
MD5 88b9ea99d661ca8dde5a93f57a0570b3
SHA1 fb511359ee024fb7101bdb895021e0334720a44b
SHA512 e8e39e5fc25a345dc61b6765c5331a1c3c4e61c74f4e20da09b97840f4da8d78c1ef71df8801c033dbccbae2564c2ce54ae654776c1368a32e920b5a3bcd4f47
SSDEEP 768:tF8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdGrookJUnV:tF8iJPNWvx76ru1jahALocd91UV
TLSH
T134D20A3B680CCB7E4F844E9CEC266F966ED801CB5B984D5447FA884C03C76EA512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0b4751f1c90e08f5dd7cdaca9c16ba8235f31f5dbb34fa4e9859ef85fb5e239e
MD5 1db011e707b62256c351eb70f05c59c0
SHA1 bee0d4c2f0bcdf75218c1e596c80698a527d1f0a
SHA512 2a6ba6e5519c2a15ebf7014382820a4b782fa967e87cf0a23242c6f3733d821481b70967e9ca8c60913c5349d191069fec7ae8fac3df96fe7802f0c62635499d
SSDEEP 48:KYBIJKCEkTypEIbKxqUwGVCWcAMwQI7jIf+wKmlOUwiOg5r0GdyAudK+kb:KYBeKCEi6EQKxqav2KYAmF
TLSH
T1EE91714274F706813DFF360CA194966A4B42717B7625E62B3BE801620E6EE683DFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b72a1c48-9736-43af-ad9f-65827ce521b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b72a1c48-9736-43af-ad9f-65827ce521b4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 58a4f73d567ee3a063d448568ab010d4ebb07c9c57eca001938fbc4c2032fde0
MD5 fab15501fb0c7e3ebdf9f71482616707
SHA1 31588581d9baa46df139e5eceb4b55c13eacd85f
SHA512 e830dced2ff678d6e639db49c240bfb392c94f0955709d5119fc443b48771c4258b7af263ebed740d6d3b086eb61e469de83e839678dd745c9de2f687dc4d947
SSDEEP 384:GZcIhsNmjC2+jLkqdhdFiOOPrXLpe8C/Fyp:UhcNdFiOi9PGyp
TLSH
T19C928D7168786CBA5EF2AA45F48637039FBC9537E7C42F84E5E8D70D05CA198070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 47c264a0bc45be850060f78a7421442ed4e8963a7ff4e8e85d32564dd0243226
MD5 10cdf9ccac4f2bb2d6e2a1071066570c
SHA1 cd2dc953f2a1e10b21d14f7afd8f66189e17b346
SHA512 94c69ceef34fc9664607769d1cfc9e5e0f95f593f121632c6146570967cdfe38bfdd89cd9236b018aa2530f26ff8aa483bdb6c5a26b5466a164b0eed0deeea6d
SSDEEP 96:ZqONk6QsjpfmUTmDK5ih/cIPURHl8h4otop5et5DeLBhPwivh50xy0SFYKIAxte0:gONO6kDfQmiUyePe1Z903vZQiN7qU6
TLSH
T12602F93968786C7B8EA3AE09F58637175FA5203BEAD42FC5D9E41B1C00D764C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 458aefabdf3f8751e5e884c49530290195b597eaacc7bba0bd5d89ddf69b4666
MD5 7e7076c637d2c3d706937f78042dd4eb
SHA1 98184444e3f652bbe00f4314c3943490cdcf4b14
SHA512 10c8a653a67176ea8d876291769bdeff4cd1243946d5c9eeda28275a09bf9211b5c4041297c991f201ec5c03cdafbc3cde2a095ec97132726aa201bcaf95e695
SSDEEP 384:VZcIhsNm6C2+jLkqdhdFiOOPrXLpe8C/Fyp:thHNdFiOi9PGyp
TLSH
T1C0928C7168786CBA9EF2FA45F58636039FBC9537E7C42F84A5E8D70D05CA198070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 66d5aa970573667228eb8789319bdf2b54904884a3deba9f799ef677e1375324
MD5 e1cc9a13a3de61cb0158fabe19600a31
SHA1 3a6a26f1e595c0ef4cc554383e8a013905e97b5c
SHA512 73d8b1b54269a7644ba187a38c41469ebd970273a5871cd25c9eba9d9c8ad2c0fa2713db668766eb1252b2aa016fd202eb2ea35929601b1b859c66d0a219538d
SSDEEP 384:ViFiZcIysNm8TUNTUlIl6C2+jLkqdhdGiOOPrXLpe8C/Fyp:cFQyfwgHNdGiOi9PGyp
TLSH
T18FA28D7358A8987FAEF6AF85F55A32038FB84177D6C46F94E6D8DA0C11CB098030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a28a8a96f3e6056f8bee14ae87dd17d9932fa9fbab3e7679df35fbe853f50669
MD5 85c6eb1c1004525922cf03f4b00383f7
SHA1 319a33c3dbb274c633bfeede2d020ca6f0399015
SHA512 8d11cd7fffdf7d36dc5f0a963e19b02bf0898dc4c7f4f12d0ff0ccc95a1fde0a6e51582648d925c03c364e39a987b466082334a425afc4c7084578cf0eb1c105
SSDEEP 192:EzONAK6k+BQmiUyeXe1Ea903vdhdlcRNPqDU6:QONf650J9qdhd6iU6
TLSH
T1E8122A32A468BC7B8EE3A955F48336135F69913BEBC86FC1D9EC1A1C01DB59C130B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdcc1bba-89ab-4072-8ee0-99d73001ff95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fdcc1bba-89ab-4072-8ee0-99d73001ff95.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4bf7a227810f6604a0b507d6184662bf7cce1d974a8a981e25b5ea96c105c8f1
MD5 c0f212249ad1a6642ebe4be41a44c0b6
SHA1 eca82e15476b25762c0291aa26e518511b3262f9
SHA512 715f99693ba59efbc79db5e5e87c8ca515145c95df0dc9363523e3892f78a4100209f6315093ccbd838ea187f6b412c24db4384803026710310c2124a945b2af
TLSH
T161410958B6EA1148B3B76E5AAFF7A85E487FBC771F06D09D00110E4E0632A40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download