da4ebcc7edc0733cd6620a900f4fe702df92a181b96d590f73c04c9ea2119ae6

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PusatCs/2/bdua/index.html
Size 7KB
Sample260910-qcf4lscp2t
SHA256 da4ebcc7edc0733cd6620a900f4fe702df92a181b96d590f73c04c9ea2119ae6
MD5 a1f118617c7064e5a381ab6b101c4b4e
SHA1 8d2c26320d53982424f85b62fa0a184bf02c4b49
SHA512 873eb561e6bb3b600b3d0df0a744e87d2907ab898dc25c261f20712b48810487acf2ebf366ed110de4c8d2e49037dea22207ec33663013753fd1d4ef6d1efb93
SSDEEP 96:cicEWQQUaFEGPUWb6T/1/OHVBHVX4MLsJocvsQfNW2jYu:cicMQUWn6T/1/OnqM3cU2Uu
TLSH
T102F1A7199C45C44A5032D3E5B671E998E735810F6302CD65B6FC1AA3BFB4AE44C23FD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2296	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335192202028713"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{B397AC2A-11E3-4270-AA86-2DA4C808202F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 412	4932	msedge.exe	87
PID 4932 wrote to memory of 2296	4932	msedge.exe	88
PID 4932 wrote to memory of 4620	4932	msedge.exe	89
PID 4932 wrote to memory of 4620	4932	msedge.exe	89
PID 4932 wrote to memory of 4620	4932	msedge.exe	89
PID 4932 wrote to memory of 4884	4932	msedge.exe	90
PID 4932 wrote to memory of 4884	4932	msedge.exe	90
PID 4932 wrote to memory of 3800	4932	msedge.exe	92
PID 4932 wrote to memory of 3800	4932	msedge.exe	92
PID 4932 wrote to memory of 3800	4932	msedge.exe	92
PID 4932 wrote to memory of 2276	4932	msedge.exe	93
PID 4932 wrote to memory of 2276	4932	msedge.exe	93
PID 4932 wrote to memory of 2276	4932	msedge.exe	93
PID 4932 wrote to memory of 4592	4932	msedge.exe	94
PID 4932 wrote to memory of 4592	4932	msedge.exe	94
PID 4932 wrote to memory of 4592	4932	msedge.exe	94
PID 4932 wrote to memory of 1832	4932	msedge.exe	95
PID 4932 wrote to memory of 1832	4932	msedge.exe	95
PID 4932 wrote to memory of 1832	4932	msedge.exe	95
PID 4932 wrote to memory of 2184	4932	msedge.exe	99
PID 4932 wrote to memory of 2612	4932	msedge.exe	100
PID 4932 wrote to memory of 2184	4932	msedge.exe	99
PID 4932 wrote to memory of 2612	4932	msedge.exe	100
PID 4932 wrote to memory of 4568	4932	msedge.exe	102
PID 4932 wrote to memory of 5024	4932	msedge.exe	111
PID 4932 wrote to memory of 1084	4932	msedge.exe	112
PID 4932 wrote to memory of 2316	4932	msedge.exe	113
PID 4932 wrote to memory of 4736	4932	msedge.exe	115
PID 4932 wrote to memory of 4736	4932	msedge.exe	115
PID 4932 wrote to memory of 4028	4932	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\PusatCs\2\bdua\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffaf729c188,0x7ffaf729c194,0x7ffaf729c1a0
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,13496770799274655132,12514265515240941871,524288 --field-trial-handle=2288,i,7539793701556401047,18250676114567657549,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,17664648472994878651,2639474351419439849,262144 --field-trial-handle=2288,i,7539793701556401047,18250676114567657549,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,15278752799982672018,10923642181328856254,524288 --field-trial-handle=2288,i,7539793701556401047,18250676114567657549,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,14411897349467566305,12612987835191608594,2097152 --field-trial-handle=2288,i,7539793701556401047,18250676114567657549,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,4843300641482264036,17867436327758439124,2097152 --field-trial-handle=2288,i,7539793701556401047,18250676114567657549,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,13332795992575529681,17561885614622014650,2097152 --field-trial-handle=2288,i,7539793701556401047,18250676114567657549,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,11605859436426475049,15715956220499365469,2097152 --field-trial-handle=2288,i,7539793701556401047,18250676114567657549,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:2
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,13144844228997434824,16241023483500948715,524288 --field-trial-handle=2288,i,7539793701556401047,18250676114567657549,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,6499370013639518975,4759729005445466318,524288 --field-trial-handle=2288,i,7539793701556401047,18250676114567657549,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,9291339500298592307,3768143323482639395,524288 --field-trial-handle=2288,i,7539793701556401047,18250676114567657549,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,9291339500298592307,3768143323482639395,524288 --field-trial-handle=2288,i,7539793701556401047,18250676114567657549,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,16796978131298097434,13293788249598140657,524288 --field-trial-handle=2288,i,7539793701556401047,18250676114567657549,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,8988138893763993874,3958294832583081922,524288 --field-trial-handle=2288,i,7539793701556401047,18250676114567657549,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,13847773289518995894,7564484768651560387,524288 --field-trial-handle=2288,i,7539793701556401047,18250676114567657549,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,15930977118259994404,11158817453567980163,524288 --field-trial-handle=2288,i,7539793701556401047,18250676114567657549,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,2852620213512620169,15968365564932197974,262144 --field-trial-handle=2288,i,7539793701556401047,18250676114567657549,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 25559293c954898f2da344ed5fe3faf3c076ca2a1868befb99178bedacb3d026
MD5 7921e958d547711c39f2211be9d582e9
SHA1 d327f17351a129da59733ef73c24b256addb1b88
SHA512 29c83b34cc319b93140a7156f0e4fd32fca94b626b32f9aa46eb5471603b5bab4338ee0313db91199b04ee0ff93fc3dd5d552299e129f6c1cd750f4211244525
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T117B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 be6083ea9399667da7b8b6c99e569e8041b215ea56920dadbab04fb353ea9ca5
MD5 0e407357d2cbc6e91019eefcebec1c6b
SHA1 99b89c75b1a80e4f66303091cf8acdc6e6a94918
SHA512 f80228b01e1e9afc419f7ea55b15e792890c719e045d5e307954ffe6a967c95e03fd0584d3d5505c33b7d16e3a22d5b317f9d4ebc96e9cc800f2a31eb70710f7
TLSH
T1A5712ADD3322D492D3600E30F7EF0293B9F181880A8F6D52F208597D6A0AB6F427B538
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ca11.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ca11.TMP
Size 3KB
SHA256 76910236c587f3333131d42b75f1b3bef63e61a1e3cc8d6773bea74a8561140c
MD5 bf1c88389aa35f8da6f38bd8268d8435
SHA1 3024c43dec751f8b9ad47937b58529b8a0091775
SHA512 8675235f26d1c61ee3d6023e7bf34d8d2998bd5f2c8a882c0f13b7de241f5863e93727f43fc6e937b89b4a78fe3e462c44dfb74c864a9c8eb7e698708b879f41
TLSH
T196711BDD3322D452D3200E30F7DF0693B9F241980A8F6D56F118597D6909B6F467B538
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e5722dd53f2e1896812731294ec434256053cf4dfe43ae952d6c6c95146aca2c
MD5 e520c0b7244300a55a4de999a6b0d3c4
SHA1 7d199cf46f28107dcee2de5d05a95c19d18b9adc
SHA512 6c1056d4b4bb476230f6e2931dfd441dd3532e7e1b238d9363694d49b76867aaa2923740b9050a804292534dd29b787ae87d68e95061a6949c13955233c0f4f1
TLSH
T1B911AFF3C7E5866E891156F05A24AE2BCE1D0506432C7D1A89E4FF27A3F3475E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bdaeccc7086cf55115355d3793a35abf60c23bdebecd712b9b7005679e85968c
MD5 c2c07e86ad624a199e2aeb602aecebb0
SHA1 59884e2bfc1ebb0e31604c378ef61ce05fe6c599
SHA512 550771ec3ee84ddef7f314900d20bca365ed4a361f034c5d7e3171b306947cf9a6848fb90f1828673fa0a4788b3b59a39332c89fa2d89e752e9bc5f90a43f52b
SSDEEP 192:sxZyRE/yM/jK1Ml8MWi/f7s35mIdpd4HW6+WNGYwKSh3gIgrJ:sxZyEui/f7s35HCHbGW9
TLSH
T191420911AA34A97BCCDBD209B955BF93D6F5447296900E44A9FCDA0C04E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ecbd00955950a1b878e86cd9137785f82aa9c362c810f716371c2cc2bca2e234
MD5 5426788b2ccd293503242850de7d14ed
SHA1 3f33b9841b6064cd39cddf74c3e20f3f4899367c
SHA512 0fa7f16a176e1fc9694eb5db6091709cc7907cb5fd6eddf33f565be05d4c1d10fcfe0ce28a5be7df740053191a8ce5363fc78e887991eaf17169cc097ad07e2f
SSDEEP 192:sxZyRE/yM/jK1Ml8UQwWi/f7sMqmIdpH4HW6+WNGYw/SCxgIg5PLJ:sxZyEqLi/f7sMqHYHbG6b
TLSH
T1B4520915AA34997BCCDBD209F941BF93D6F5447296900E44AAFCDA1C04E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d2da12e6eac6b14249fe33fe55641524e4ac2080a98bceb9d4be1c81fe17af37
MD5 efc4b0818529859b8cbd103c2245ecac
SHA1 9dd78e6eb7f1e5f3db1f2c9cff5ac8345af07173
SHA512 9a74e680792c6acbce7bc5990563ab3b407af04e370a414094f3533540707df37c7ca67b476805aa1eabe1e94a9cc76081ed5d9d501861fb661f78a656976cb5
SSDEEP 768:Zq4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d+rohRcxaX:Zq4jeXmWvmKLEu1jacPLZQdVMu
TLSH
T1D5D20A3B284CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7348cb02aabb13ad637d67ab05faedc4b2819c0a28537a96e325f13e8e59c897
MD5 d21aa806cffcec3bfdacbe2dfc5c569e
SHA1 cf6a7dab5525460b0d2df1ac1499b46d71daa53f
SHA512 f55410597d1ac9a2e9155be22683b0044b83e032a24a9719cbe00cb07f4add17467a888464c9b1e85e57c25c404b2e5cf3fe022d1c6e1e4ea585ef811c7f2e4c
SSDEEP 48:K0CFI9K+IgXyp6IfKP6AjcTy2cCixBWxsIMOxKj4b8x/0h67:K0CF6K+Iq66UKP6UDuK0wL
TLSH
T10B914002717B52413C7E2948A690975A1B4272633518B9AB7FA800B71F37F784CFE8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596577.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596577.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2f48ddcfaa34b0bed7eecb66a1385240e5b4e90c52ca8e45b2ba8b8e2d0ff872
MD5 e274edd4275cf62effc2d3e07963cde5
SHA1 5665e744d98ea1d2ed783f794a8765b297b98d72
SHA512 c0e474b4581f45c07a9bc88e67fc0cfa9e583ca3eacd07a61bf8a82f0493a02d945f867f98ce4ee4aa429cae1c3ed95c3aa825f6bb7efc032617f670ffb59eef
SSDEEP 384:zZcIhsNNvBLAqoxf+G8WYWXpF9xuvzxV+MhdpTBwos:rh0Li5xD94184pT+j
TLSH
T141826D7168687CB75CE7A141F48B33134EF89027AED8AF84D6ED7B1D009A6A9131AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 2684c2d6ba3b0ed21ddf379e7b83365658123fc9842dda9589b99525bbeb90e7
MD5 b7709ea7acba63d70e997d4a1cc7bbd4
SHA1 ba5ba48c5c2dc1682dc25c639fb720d572260a87
SHA512 e9636e8ff6001133280655e4e33ec3161037f4442c8758881f94e60dbc101b8abc91a1287f4bbecfeb9f73057af3241991a103c47228cc7d6e4d93274f5ac632
SSDEEP 384:hiFiZcIHsNX8TUNTUlIlABLAqoxf+G8WYWXTF9xuvzxV+MhdpTBwos:IFQHywgGLi5xB94184pT+j
TLSH
T1BBA24D725858ADBBADF7A681F84A32138EF48067DED4FB90E7DD6F1D0097198130AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5516602d743127eb59362f92a0a54a6f1d60a2d3928dabfe82f8cfc1bf8fe538
MD5 4ef81e7520238a7c71a109a817bfdf45
SHA1 f503fa22ef53f7fb5b5203aeabdfe447fe4e379f
SHA512 0c020d86d388d22949dbdd967d1ab52251a95396333e289f949af0f50885785463186575474d8635ef3b259a22492e0198d8d78d8e0837b4fe10704d6be72486
SSDEEP 192:EONC6hZ0QmiUyfHpc/+jV0jzorWYt5wOZHiU6:EONC6oQpu+G8WYc2CU6
TLSH
T15F02F935A8686C7B8EE2AE45F48777235FE5112BADA56F84DAEC1B1C00C775C2306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b135ba9c97e8daff529a32521518dc57456a5e1731248676d0fe2333f0fc31ec
MD5 f819b77936ff3a5e3815419fe4c37f89
SHA1 7d27b33cc258a3a35e1f988e1a2dbceb705ee76b
SHA512 0eb08d7ef7000a58ffb152b635fcf53f6842730e83cae68e21b12d2ce7e6187567f2dcb2f72d9e55780d7ad173dc2d26a5815e577d9ef9ad69233ebb8292a947
SSDEEP 192:YONY6hZBQmiUyuHDc/+jV0jzorWYWXj5cOqoqrU6:YONY6L/Du+G8WYWXe99U6
TLSH
T1D512FB36A868BC6B5DD3B945F48732134EE5511BEE95BF84D6EC2B1C00DF66C134AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ec04e26a16ece19e122748175cdde13ab174f6721abadca215e598604f668ea0
MD5 a3e68a3b18584b7e3cedebe94fccb5f6
SHA1 838d8717992d9395e1fbe2d8398f580320fc585d
SHA512 f9da17683e70acf327c1287a7bd1a116a2ea128462861e736aac1044077df071aea7fa074635849b0a4d152ec7782c5b60c5c96bdeda6a27e493ec960e3d32b5
SSDEEP 384:0ZcIhsNNABLAqoxf+G8WYWXpF9xuvzxV+MhdpTBwos:yhvLi5xD94184pT+j
TLSH
T175827D7168687CB75CE7A141F48B33134EF89027AFD8AF84D6ED7B1D009A6A9131AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2855602-b092-40f4-9269-7a6daa68bacf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a2855602-b092-40f4-9269-7a6daa68bacf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 abed8a7bda24755a230837e4949da4a536dab70eeda5486a87ec1f586940ccb4
MD5 f4b128fb2f3bf22c95206df364a628ba
SHA1 e59d34101c401cf8c88d672f624d38fee2f8beba
SHA512 8820e8dac02160919ce105ba8fb77402bdaf6a1be8e455120ef87b1807ebffb4c8da192b091ceea70fb39eff279c848205c87063a92617c8065a7b54d2f2c049
TLSH
T136411858A6F91148B3B77F1AABF6B86D487FB9772E4684AD10110D4F0A26F40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download