hxxps://base[.]celery-soil[.]com/2AtpptlUsbrZZmecchecktpackage_id=31&ut_source=pricing-indv-summary&locale=DTS/

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://base.celery-soil.com/2AtpptlUsbrZZmecchecktpackage_id=31&ut_source=pricing-indv-summary&locale=DTS/
Sample260916-sheh3ssarf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4972	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340448439363281"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{B1ECCFDF-6604-47CB-A624-4F221158A891}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
788	msedge.exe
788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 772	2004	msedge.exe	87
PID 2004 wrote to memory of 4972	2004	msedge.exe	89
PID 2004 wrote to memory of 1816	2004	msedge.exe	90
PID 2004 wrote to memory of 1816	2004	msedge.exe	90
PID 2004 wrote to memory of 1816	2004	msedge.exe	90
PID 2004 wrote to memory of 1228	2004	msedge.exe	91
PID 2004 wrote to memory of 1228	2004	msedge.exe	91
PID 2004 wrote to memory of 3512	2004	msedge.exe	93
PID 2004 wrote to memory of 1564	2004	msedge.exe	94
PID 2004 wrote to memory of 3512	2004	msedge.exe	93
PID 2004 wrote to memory of 3512	2004	msedge.exe	93
PID 2004 wrote to memory of 1564	2004	msedge.exe	94
PID 2004 wrote to memory of 1564	2004	msedge.exe	94
PID 2004 wrote to memory of 688	2004	msedge.exe	95
PID 2004 wrote to memory of 688	2004	msedge.exe	95
PID 2004 wrote to memory of 688	2004	msedge.exe	95
PID 2004 wrote to memory of 1972	2004	msedge.exe	96
PID 2004 wrote to memory of 1972	2004	msedge.exe	96
PID 2004 wrote to memory of 1972	2004	msedge.exe	96
PID 2004 wrote to memory of 5076	2004	msedge.exe	100
PID 2004 wrote to memory of 2588	2004	msedge.exe	101
PID 2004 wrote to memory of 5076	2004	msedge.exe	100
PID 2004 wrote to memory of 2588	2004	msedge.exe	101
PID 2004 wrote to memory of 1500	2004	msedge.exe	103
PID 2004 wrote to memory of 2876	2004	msedge.exe	110
PID 2004 wrote to memory of 2776	2004	msedge.exe	111
PID 2004 wrote to memory of 3060	2004	msedge.exe	112
PID 2004 wrote to memory of 3952	2004	msedge.exe	113
PID 2004 wrote to memory of 3952	2004	msedge.exe	113
PID 2004 wrote to memory of 4380	2004	msedge.exe	115
PID 2004 wrote to memory of 4380	2004	msedge.exe	115
PID 2004 wrote to memory of 788	2004	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://base.celery-soil.com/2AtpptlUsbrZZmecchecktpackage_id=31&ut_source=pricing-indv-summary&locale=DTS/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff86622c188,0x7ff86622c194,0x7ff86622c1a0
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,7098929037313750959,9177897212953489023,524288 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,15054602018437125912,12560951009932353849,262144 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,15692527695032330177,10853959001088246071,524288 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,2790416655600555722,13405785747933082285,2097152 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,10840018365046437855,9857792954194922267,2097152 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,10733760561682049784,11069084449155588804,2097152 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,16608996727304519406,13802559221629326307,2097152 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,12994078611683661044,8107959393255264171,524288 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,6719948841599945454,1092088353012009267,524288 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,13505633172320072408,8304812076173489532,524288 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,13505633172320072408,8304812076173489532,524288 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,14941055291312143320,2568979015771423062,524288 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,14683553553593648696,17774857883880233407,524288 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,2805577243880482001,18176400720586639863,524288 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,11167846642659417673,13442758123043291666,524288 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,8327073333694945400,11521758315433319090,524288 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6160,i,13301068849671025288,7877617953814544086,262144 --field-trial-handle=2256,i,9030930714401143909,16619906940105389957,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2807d713-282d-438f-a342-d25ddc2080f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2807d713-282d-438f-a342-d25ddc2080f5.tmp
Size 18KB
SHA256 436efb9090352cd40cf68dbb475e2dd839eb0283d7a792e604ceb5cc7ae95606
MD5 e78e972d12f3c25bf9ae8615b7bd5cc6
SHA1 15347331df269d80d3d4e2dc32acad90cca2932d
SHA512 d84a0e97a6cdbd9a93d9c19cfc7818e0386696963d6425333dd59a400a340e225b4f4d44be7714c1d4468f62a33ff99cea208e24d24b5a36f53ef3fbe09e0ab2
SSDEEP 384:WJZcIPsNhYMbZTqh//z8ExUXQ07sa+VYBlwox:gPOi/D8Q07hgf2
TLSH
T150827C757C78AC7A59F39285B4473A238FB4807BA7C92F54D6ECAF1D01DA2981306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 97a5f287650ef57369e2e6662283f02500c9499340cabc870614ade31b91fe33
MD5 48a280c4d9cf88968f42cd0de3ac4e85
SHA1 460b59caa84cd8e78a596985982c691cb3ae71ca
SHA512 14aa69993672ddcbdce362838c929e463015efd3aaa2e1dabbf77cf0b19b7c754145e7d71d0c0404b5be799c524adc1a072f8e42f4f7686f4cbb3f9ac612ed6e
TLSH
T107618050BFD078A1F7A87FB9DFD7048336B3A7C01AA7ED40A080D8F95E067905060354
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fb62.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fb62.TMP
Size 3KB
SHA256 0a7302bd73b9d4b6ec1748bc508d85e3f1c53d694d71e588f27890d31b2cc2f3
MD5 975cd31cc8d85cb98d3b1506a3cfcd8d
SHA1 f6a68053bf1c7c1a131bc728af0d6cd6938d6002
SHA512 f29bdabda4542c22c3c04eeac638414199a1d0a12a258487a590704bf93fa2e1a57d3ec8f5aa27b4884cf7e1322ab2122274ef422c40b18ca6af7721fd39c5cf
TLSH
T1DA618F90BFD078A1FBA87FB9DFE7048336B3A7C01AA7ED41A080D8F95E067905060354
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0f03581a1819316f21c8807cbd2cfe3810dffc0f47b7426ac145778b9c069fc1
MD5 44fae174ce7ea52fb2118590038317e9
SHA1 a499319ae176fc9493f80fb43c256d741978ae76
SHA512 e05572e9358b3b47612185108216c0045db4e919e7ce3e3dc8d913bdaa49bf010925a01deaaca7a14adf6bf8babc63326171495f1cc3ec6a3b9759e81094cdf5
TLSH
T1FC31BEB2C7E4C66DCA1102F1A6247E2BCE2D0905421C3C1AC9D9EF5BA3D3075E11154F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 eaabab2501ca253b5425c22efa422606acb556ecc1c3a9f6871007656f66cf27
MD5 3b5a9b0ff48c29e16d89a4579eeb9bc3
SHA1 fd9cfb53efb0190d91bc033e5d8f770051ecbca0
SHA512 a35cff51675204f6ac42f821e346816de61f952eed3bf5fbe9fa4efe5001c7f231c9199a859afa3a120c6a2ff9f7fdb88a339f868505db997e88e04849e73e28
SSDEEP 192:sxZcRXWD/fes6DIdpuwHW6+WNmh+/Y36XcoIgrJ:sxZcsD/fes6crHbx/Xh9
TLSH
T14E22B7126E38A97B8CC7E20DBA25BF53E6F91032A1D11E54EAFC861C05E66CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e275184d0049e564072dad6c48ebf443d73a0393bc4200606bb9dfa81d511c94
MD5 794bb64111dbcb867617de5aa55e0b77
SHA1 173231aaea7423a356505353c98cee4b7aef642b
SHA512 750ac48f97cd599f8cc0023a0e8c71cc59cdfc6a6f2162c563c52506f3e41017ff5d2b0e39b1c7be674071c805d864699bbc38eddd5d9af824e586ea37be9329
SSDEEP 192:sxZcRXWD/fes5DIdpuwHW6+WNmh+/Y36hcoIg5WJ:sxZcsD/fes5crHbx/XDM
TLSH
T1B322B7567E28697B8CC7E209BA25BF53E6F95032A1D11E54EAFC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5794570ee67d2be2507468c069af37d0e7d5a0c6eb87105296a81d78c7dc2088
MD5 48d70112fae2c00159d781d800019e11
SHA1 3fd0478cc7405866713ac12c1a2072fb8f5e4d51
SHA512 2d30f20fe7d4c6450f1e730e286b1674c990cdbce2cc9a4fde4f6c2631e8ec5a61a8b7cd87dc1b04536fad5d6de34e468ecf73d3300b2955dd2f9972326d3ec3
SSDEEP 192:sxZcRXWD/fesyDIdpuwHW6+WNmh+/Y36XcoIg50J:sxZcsD/fesycrHbx/Xhe
TLSH
T1FF22B6567E38A97B8CC7E209BA25BF53E6F91032A1D51E54EAFC861C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8c8fe97ee95aea1b3f5bcdf1e5f6f6b43c17f1f9101dd1d22f8fd8b54fec59bd
MD5 dc51dc6b5ba7b37dc7f3bb2027453876
SHA1 c1dbb2dacc24e7e73e1887521bb66d581638eeb2
SHA512 3960a9842464cf2e2e1af82380b220ddfd574eb345ba70496d98a1701efaad7383af889b7096f7ee4fde78cc14ddb8b09e8a548926a5d5927d88ea1c498fe5b1
SSDEEP 192:sxZcRXWD/fes5DIdpwwHW6+WNmh+/Y36UcoIg5WJ:sxZcsD/fes5chHbx/XcM
TLSH
T1AB22A7567E28697B8CC7E20DBA25BF53E6F95032A1D11E54EAFC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4b8bf829b16164a6fc4ad89f8dcf3dbed3bffb0e88ae96cce7051c9534ff1c65
MD5 c9c0dfeee8346767b4248d2fe97dcc00
SHA1 43236b607a0d78fdaae8fd9cd304c13ef2786c48
SHA512 bf27a5ee10464112ed1f446f7eec3f7abd63bdf824331c9262e27c5480f9c1e171b1427a4d2103320a38d04a52ae98d348c5e182ac8f6a47eecf4e0d4d88b19c
SSDEEP 768:7zKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/wroYY:7zKlm7QWvUYe0u1ja8/L/E/bYY
TLSH
T1FFC20A3B640CCB7E4FC04A9DDC5A6F976EA802C7A6588D4047FA994C02C77EE91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a72fd64-b3c2-400f-9382-a279d278a8cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9a72fd64-b3c2-400f-9382-a279d278a8cf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 11e19d2c4ddb1718c7234230d19dfcf0765d89598c355dfecc541d56b0fb7a63
MD5 9fef19f4be384d63fd1857cfdd242e1a
SHA1 98ea3cabff34e3fb8db5e03b53dfc997b9b34fa2
SHA512 d7615f9b062819cff2d986ab7c6fc2cbcde568a1b6007cc468636521d14c8e7809fa93d97d146e306710c476c1499c53084bdd0bb4a7d590b3ff5cfa50803043
SSDEEP 384:OZcIPsNh9MbZTqh//z8ExUXQ07sa+VYBlwox:sPdi/D8Q07hgf2
TLSH
T149826C757C78AC7A59E39285B44737238FB48067A7C92F54D6ECAF1D01DA2981306C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 d6ee259dc22eb13f7a9799e7830d666f5ffe09b5297969d0fe8ba1389aa9807c
MD5 9584cd719399eed48b13106c0319b8fd
SHA1 c63a31db0bbeee2ef49d0670745051d2028278da
SHA512 91a476a7e4873a3457dabba2ac2616b287c44cb24d7b732e9dc39cfbf5de803845025b50b48f4776e45df8ae06bc3903b69e61ee0f2df4836194061a54660f7e
SSDEEP 192:NZsNhpQAUbnvQmiU19/14h//jjzorB6ywxW5XQqao8/Cqva+4LcYLWAdBlE:/sNhpMbxTqh//z8ExUXQ07sa+VYBlE
TLSH
T173624C357868AC7B5DA39285B44737239FB0406B9BC92F58D6EC5F1D02DB29C6306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 df71d8821dd09b1d54e003b0206c17e15c5b1e3b0f463ba985eafe4a6c8874cb
MD5 c154eaaae60f6f32abc72506878db724
SHA1 0b833d95e3b0cb161d37df398f140e7664b682e8
SHA512 ff62e4ece9eca6f4cb158ab8251c36ee096fe66bdfacef4e227344f33da0f2a47e455d026c9ed3f26a2d252bb02eef6af283413dab77e1a60667abbc4ce074c3
SSDEEP 192:BONN6JUm0QmiUy4tso//jjzorB6ywxWjBCfaU6:BONN6+mEJso//z8ExHyU6
TLSH
T1EF02C739B8287C7B9AF3AE49B48737239FA4107BA6951F40DAE81F1D01D725C2306D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fc6013c642b54a99b09a57d8c411be4552b53a0f3f9bfeb22d8cdcd2f2a72b0b
MD5 b19d832c48cc3364ea9e581f056c8ed5
SHA1 abd7880707becdf6a55480d2e22e40313b67986e
SHA512 7d5da5614062b3c648bf98291f3c45b410f65289334ea0c01abe8463c4c185abbaf798a3389553e7bc9e9c796b2cf4678310ac3f7345cf36fc16bb36f337257c
SSDEEP 192:BONU6JUHQmiUy8t3Go//jjzorB6ywxW5XQPNx8/CU6:BONU6+p52o//z8ExUXQz7U6
TLSH
T134120A35B878BC7B1EE3A585B08736239EA4413BEB856F90D6EC2F1C02DB15C5306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4a8372dfe9d459d4d075fa6d8549db9dad36fabb7220be4135bfadd7c185d3e1
MD5 50007e26e48f0cf4426e11110db08e06
SHA1 918df26abe7fa518083a918442bad1a498503cb2
SHA512 00ae7616865324fe89e4cb8c3490255d376610923ad8c447973f8867f6192443609e776fea5fdfdfc57343dc6c1fa99acbfddc498c08935c6ea90a19d84ae9a6
SSDEEP 384:+NiFiZcIvhsNz8TUNTUlIlYMbZ1qh//z8ExUXQu7sa+VYBlwox:nFQZewgZi/D8Qu7hgf2
TLSH
T1DDC24BF258D7983AD9AE4783B73E2E128EBCC067B5855A50B3D85A0DCD961BFC302C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4ace6213faa3b735679857a555aacd976731e032d666aae6b5699fbb54bacd67
MD5 4aba4b12ab73e67dba301bb1c2c0618f
SHA1 56f154c85373f945ab54ab72634c9389bdb7d951
SHA512 2f38c3051edded3afcf96c8d50dcc4b2ff13d502b5b4669a470224292f833b478997c341146b7f9ad530818b1de60cd28df418f031659ea95e78795aab7c7f0f
TLSH
T12441E35CAAF91158B3B36F469BF6696D487BB9372F4B949E10010D4F0A22B40C872737
MD5 SHA1 SHA512 TLSH

Submit Download