96342e39958856275d2af6d6addab52f36d891d3dcd230e6970909d723688cba

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SazRobat/Moshtary2/botsData/NamoLandbot/source/BotSazTrox/admin/index.html
Size 1KB
Sample260916-w72lpace26
SHA256 96342e39958856275d2af6d6addab52f36d891d3dcd230e6970909d723688cba
MD5 8fd551ba3fe0732392428f738ef6db37
SHA1 64c772498930e310dae1ad2dda9cb12fba83a2dc
SHA512 a1e9db2aabb5c09f71f3af32eea16bd629c9016e19bd5c62a1b373b1d0e2995aee96c26040bd1ec60f0d941b4b40765aec000ae4ded29fdef0e9ad858b3af80d
TLSH
T1CC31453DA0922D099537563CFB81E244F92A410352460BA07A5D60DBBFED17A97E7FC8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1128	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340575586471462"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{B72E3CCC-079A-459E-898B-DBE98047F934}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 3056	1044	msedge.exe	86
PID 1044 wrote to memory of 1128	1044	msedge.exe	87
PID 1044 wrote to memory of 2228	1044	msedge.exe	88
PID 1044 wrote to memory of 2228	1044	msedge.exe	88
PID 1044 wrote to memory of 2228	1044	msedge.exe	88
PID 1044 wrote to memory of 2580	1044	msedge.exe	90
PID 1044 wrote to memory of 2580	1044	msedge.exe	90
PID 1044 wrote to memory of 3448	1044	msedge.exe	91
PID 1044 wrote to memory of 3448	1044	msedge.exe	91
PID 1044 wrote to memory of 4544	1044	msedge.exe	92
PID 1044 wrote to memory of 3448	1044	msedge.exe	91
PID 1044 wrote to memory of 4544	1044	msedge.exe	92
PID 1044 wrote to memory of 4544	1044	msedge.exe	92
PID 1044 wrote to memory of 4908	1044	msedge.exe	93
PID 1044 wrote to memory of 4908	1044	msedge.exe	93
PID 1044 wrote to memory of 4908	1044	msedge.exe	93
PID 1044 wrote to memory of 4456	1044	msedge.exe	94
PID 1044 wrote to memory of 4456	1044	msedge.exe	94
PID 1044 wrote to memory of 4456	1044	msedge.exe	94
PID 1044 wrote to memory of 2768	1044	msedge.exe	97
PID 1044 wrote to memory of 2768	1044	msedge.exe	97
PID 1044 wrote to memory of 2376	1044	msedge.exe	98
PID 1044 wrote to memory of 2376	1044	msedge.exe	98
PID 1044 wrote to memory of 4768	1044	msedge.exe	100
PID 1044 wrote to memory of 1536	1044	msedge.exe	106
PID 1044 wrote to memory of 664	1044	msedge.exe	107
PID 1044 wrote to memory of 3832	1044	msedge.exe	108
PID 1044 wrote to memory of 4532	1044	msedge.exe	110
PID 1044 wrote to memory of 4532	1044	msedge.exe	110
PID 1044 wrote to memory of 2124	1044	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\SazRobat\Moshtary2\botsData\NamoLandbot\source\BotSazTrox\admin\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x260,0x7ffa352cc188,0x7ffa352cc194,0x7ffa352cc1a0
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,8105042854916285886,10927575395103956534,524288 --field-trial-handle=2124,i,7129828803928359608,1038045452631738603,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,15289099509046035992,14539398533664906820,262144 --field-trial-handle=2124,i,7129828803928359608,1038045452631738603,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,17845460441719675140,13668709829413240932,524288 --field-trial-handle=2124,i,7129828803928359608,1038045452631738603,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,10559520158805893824,8845976195185384195,2097152 --field-trial-handle=2124,i,7129828803928359608,1038045452631738603,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,17325943685594159597,868193108506287987,2097152 --field-trial-handle=2124,i,7129828803928359608,1038045452631738603,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,7972596657487223709,2308772791802987515,2097152 --field-trial-handle=2124,i,7129828803928359608,1038045452631738603,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,3978575626021339429,16937194836390090131,2097152 --field-trial-handle=2124,i,7129828803928359608,1038045452631738603,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,17244622254279702610,16825613605582266515,524288 --field-trial-handle=2124,i,7129828803928359608,1038045452631738603,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,8309982372611421165,1494863823705120293,524288 --field-trial-handle=2124,i,7129828803928359608,1038045452631738603,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,1600815996156720252,18060224209699033857,524288 --field-trial-handle=2124,i,7129828803928359608,1038045452631738603,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,1600815996156720252,18060224209699033857,524288 --field-trial-handle=2124,i,7129828803928359608,1038045452631738603,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,14161461103396024684,8569343957829417142,524288 --field-trial-handle=2124,i,7129828803928359608,1038045452631738603,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,13953555307635260407,4430921988885481708,524288 --field-trial-handle=2124,i,7129828803928359608,1038045452631738603,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,8860174376258188181,15141807327193136319,524288 --field-trial-handle=2124,i,7129828803928359608,1038045452631738603,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,4788379135131565405,10302569475031779523,524288 --field-trial-handle=2124,i,7129828803928359608,1038045452631738603,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5996,i,9612717675148965269,13408217680249275274,262144 --field-trial-handle=2124,i,7129828803928359608,1038045452631738603,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

9d488220-9a27-4bfe-a240-01f552dbb19b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9d488220-9a27-4bfe-a240-01f552dbb19b.tmp
Size 10KB
SHA256 5fd121689d8d0ffbbba63f7f0007e2cddd57e82f639b28d8b2f6c8ca01564b07
MD5 c946c2de0fcef95a88d73695a923d05b
SHA1 ee5f70581e7277d99b5cb2709be78a5692ffb23d
SHA512 1ffb6f4a5b56cdda57c2d04396514a91c28948fc22fdfeb8c90f98cce9b583f1347827c1e8bb71f25c51f61a61a1a6be7f55e7bd23ddf8944ce506950b1616b8
SSDEEP 192:sxZ0ReWa/fJsNZoIdpdaHW6+WNGYg1lXIg5GJ:sxZ0ba/fJsNZZQHbGpg
TLSH
T10522A6566E28697B8CC6E20DBB15BF53E6F9503291D11E48A6FCC72C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 25a225de8c70aaddd106d23ddb587498992ab5f4eef1f0d801b47fac6d6f4996
MD5 598f0350cf8d7798afcb7736bfae9c8b
SHA1 8d1c4e0ab7cb68f4b6c7ae5f70c71d89154a61fe
SHA512 85950dde9dfa75a3097f269e697ca6a32a58e1eb54bbaf8159f4f4fc8dc8a0e09578d269e1f7ee13f4bf7d0a73a69475e29c4836ecdbc9fa8851ffeb72d78538
TLSH
T1A861A48014808CF5F7AC713C93DB2487B236DFF950871E820769EF399787B9951E0190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59205f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59205f.TMP
Size 3KB
SHA256 ac4fc5c95345b36b595c9e8bcb1e3a4760a82436df48b4e1eff9dff5ed2160d9
MD5 f86f2397dde105f25a7f022227c3b91c
SHA1 9a237001cd1b2f55b85405e09d7e1c895acc7c2e
SHA512 14855959fe2d7e153f002d52f4d23fb3b7ec26a87931ee799b1e3e96e852fb9e9a472a9b094a09d489f9343bc0161111e40f8a3b87ad71332ce412535347cf24
TLSH
T11E61A48014808CF5F7AC713C93EB2487B236DFF950871E52076AEF399787B9951E0190
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 40a28816af47e948af6fde053d268e155097a3ea45bb88fb32df69ffbd43c612
MD5 70635c228aee16745b6b167986c81790
SHA1 e62a4a90df2ad17d61f6db0361feee0afe4f875b
SHA512 1b1bd416e7cd2c5a4afabf1f5da62135f1bfba53a77b66d50ecce69138870ce0c565f03816c442e2d654e03c0656f36b227ffd69998ed10362b29b77731dd266
TLSH
T1AB117DB3C3D5856E8D1156F05A28AE2BDE1D0506421C7C1985D4EF2BD3F3475E00295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d46a0bc8e448a8491e3989b797943fa600a81ed0403a1027dec78c0e92fd8a30
MD5 ce9b1d156cb91dec4a20acbc4f0290eb
SHA1 bc5ea1d2d52de0c08f16078637dd2dcd52e91541
SHA512 056409dd593d175dcc3cf8105d0eb0a0f7e36730829fd9e3ecbaf58cbe5d31a6b11b8ba0a1f5adef2ba36db54d2dc5eeac297505fda52befebb82e01a13d8863
SSDEEP 192:sxZ0ReWa/fJs2oIdpdaHW6+WNGYgUlXIgrJ:sxZ0ba/fJs2ZQHbGG9
TLSH
T1E012A7156E28A97B8CC7E21DBB15BF53E6F9503291D11E48AAFC861C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8aeecc003be26c879084b8f8415b8feee0ee89296a5b190a10bc119ad5cb36e6
MD5 1111852fdfa4aa916f2aa26bc12826f6
SHA1 9ef56bb1482adb5d42bcd165fce9576375f4387a
SHA512 a0ab1b809cf67b1ecbc1b4ec6292799e27d3257ee0b49082f74449952b6a6d891e9c220a17dbf85d4ff4b346218984d5a4f3d0adcdc510d29792183072e52176
SSDEEP 192:sxZ0ReWa/fJsNZoIdpHaHW6+WNGYgTlXIg5GJ:sxZ0ba/fJsNZZ6HbG7g
TLSH
T1D022B6566E28697B8CC7E20DBB15BF53E6F9503291D11E48A6FC872C05E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 f6c3405cb9d0d4296666d3f9dfab758ca04665d58d6996adee403fb274e14627
MD5 fb58272c0f52e2e1c0b5ea40f5293fb3
SHA1 9ece5ce3fcda1c9abd90a510d4e16cd6e290dde8
SHA512 ff1bcee3b86e2e2e58bfc0f7623466acd071ae912bee07727eab41985faa4640b437179537ff76038f402321e58751e2a8d929095bf976d16feb5a2d6ab1099c
SSDEEP 192:sxZ0ReWa/fJsNIoIdpdaHW6+WNGYgUlXIg5kJ:sxZ0ba/fJsNIZQHbGGi
TLSH
T17F22B8166E28A97B8CC7E21DBB15BF53D6FD503291D11E48A6FC862C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 52735b78a6ece40ea5ca0b96799f66d17df690872ca45b0138a2a01268346dfd
MD5 fd4ffbeb747e7ee176f307888569ec8a
SHA1 d2f61d78b0e56438d38ab59c8b08be9e506bc0e1
SHA512 f5100b7504fa3c0b8b55d3618cd9077c5d7074a8065910355cc6f321742aad32895f7b51a27fcb6119219f3703e268f81fb6d547b6dcba040956f25a14bb881d
SSDEEP 768:EdichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzfroOeI:EdichfPWvPZplu1jan+LKgzMtI
TLSH
T1E7C2F93B644CCA7E4FC01E9DDD1A6F977EA802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6521baed8aa021b45755e46bf6e159bc3e8829af921df2f5b7a74181a8da25ed
MD5 95acfff1439c504eeefc233ae10fbcc1
SHA1 347b2acbf85d915e25ee13df40143b1597dca9f3
SHA512 c5b74d2f4386db8e6ac697bd788f71047200992a35c92964c7ed570ef60a9ea22383fd9ea30d9fc26c83056ad701110ae091fa803e4a1ae7663a620b57392350
SSDEEP 48:K0QTNQTsQThQT9QTPQT7QT/QTgbQTTQTmQTzISQT1QTgK9QT11QTXQTgxQTlQTwM:KoN+KmMqGFKKWsZpSK6QSqN
TLSH
T1B491641172FF135538BD654C82659B1E124231B33224FA2B7BBC14B6AE6AE045DFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59bf10.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59bf10.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 50f5e8d2655f0debc382954bfe385849b36bcc4ed37897aa2ecd22d5fe8b0be8
MD5 7a1cb10bfbe53ec182f354bc8254a38f
SHA1 311f1a42daf99507d22deaf374cdd556b1207e9f
SHA512 a9938b45349fd6cc55c36ab9e442c52f00d7674e222bb6f6106d2a34bb515a10cc40b7d342fba7c4d0621417e7d4c6c2a4f19195790b3de27684321d04a42403
SSDEEP 384:uZcIxsNqBWGbj5o0aBGYX5Ew8+8jeoHsa+VYvd7UIo4:Mx6MF0GYuw83CoHhgCBX
TLSH
T114826D72ADB4AC774CE7A691F44B3A134FB89027A7C86B9481DC5F1D01DA6981307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 44d2f19c2fe6a84a6128d501b65fee24c4227df8c61a0271ea339f433c848f03
MD5 508caa6b31887cf48a12c98e394afdf6
SHA1 6c83e41414b14da1773fac4daa1a1ef7fa71f62c
SHA512 b8aaaf8b5e3c6e32e2efd6854afab0954aee4c7af563f6b38ddb4108f37cd7cdc79a6918af35327da3c483a680e3c9d396785d274d653ab6c054b37f5d5a50db
SSDEEP 384:KiFiZcIF3sNy8TUNTUlIlcWGbj5o0aBGYX5Ew8+8jFoHsa+VYvd7UIo4:BFQVXwgPMF0GYuw83BoHhgCBX
TLSH
T11BA26C739CA49C7B9CE7AB91F94A36138FF85067D6C8AA9492DC5F1D00DB69C0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 097aa24b589d64fc9b0978e3e89b1206fb62dd990e3af64f297d49b882e6b2b0
MD5 adb3f5cc39685565dc5c2d5bfd49c899
SHA1 ccd3fb7277e5a053d87baa0bb4d7509e6c796263
SHA512 463dd13501ea186d14007939a2a7937644324137ffd1b1e6991b956981a50a1047ba2cb7b51002f6abfb5a9cb4818369c253185fe339ac198411b7fa0c0544f5
SSDEEP 384:BsNqbWGbj5Q0aBGYX5Ew8+8jeoHsa+VYvd7UE:BQMh0GYuw83CoHhgCl
TLSH
T199623A36A8B8AC378DE76691F44B3A139FB8516B96C83F9482DC1F1C01CB69C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9e7262127b752dce422d3ce036fd702428f502158877dda52a35fd194958434e
MD5 8c3ec366ff0a5eb59deb779f1b2dde4c
SHA1 5bec32fa0a51a83493e37715d82a5f1191ce0d41
SHA512 df3458a3e1c89fb88f20aa91bcb9c4cc4067b06b759b5d516014327dc5ffec1880995ab092a80b54b7e262b2df1c5f1bde50b8b9bb418a9bdf2ca960f97a4612
SSDEEP 192:LJONz6DphmqQmiUyrWq8wGYX59ezZCbY+okk7PFU6:lONz619hRwGYX5Ew8+2NU6
TLSH
T15A02E835A8786C7B8DE36E55B44B3A239FA4212FAA902F84D5E81E1D01D768C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 70da19e3fbd557a97351ad133fdcc196c6eecdcd23381f679740e45331fd3bbe
MD5 2114d8d7ccee03d8b699c3476e5946a7
SHA1 717082590ee5d716b4ae971268b3e3224b0e59b4
SHA512 47e648749e1f7376a759ae0620fd9fb32ff2dced6986b9abc6591f259f142f2854f2b1fd870cd58fa51e807187e26893ed0d37362f7561e4a3de9d555b55add4
SSDEEP 384:JZcIxsNqcWGbj5o0aBGYX5Ew8+8jeoHsa+VYvd7UIo4:BxHMF0GYuw83CoHhgCBX
TLSH
T174826D71ADB4AC774CE7A691F5473A138FB89027A7C86B9481EC5F1D01DA6981307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b8df6df600e193ef03b04c4d026d21bcff9a0c337fd29dd290a088513d0c5cef
MD5 3b2224089bf3593b4b6c41925d8c5058
SHA1 67923b73a30aff75f4b8a27d5cd7fe225369fbcc
SHA512 5e1597bfa89802a4bf3e1e2c090a7ec3f8cc816f3e471dac55918e886bff6c1fedd4e6c7064389754477dd8cd4c82e5099f7058f430d49446e3b497a18f2517c
SSDEEP 192:LJONj6DpheqQmiUyWWGwGYX59ezZCbY+gjjdkIIO/5PHU6:lONj61Z6GwGYX5Ew8+8jmoHU6
TLSH
T119120936E878AC7B4DD36991B48739139FA8512BEB847F90D5DC1A1C01DF65C630BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abcc20e0-8553-4b7b-b6c4-0c2822b940fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\abcc20e0-8553-4b7b-b6c4-0c2822b940fc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 91ffdd3b2e773678bd2ebf95ec88e343ed708af0beaf9bdf9d11fabde7e6e59c
MD5 24505e90297f28eb788659968d217f55
SHA1 e7a8bc63a9854370e9f309180d37ecb309681a52
SHA512 d021a8b5dd9a045d66948ae3bc395826f4c948b8a3667d16cea515bb2ab3f020b3b552844f0e1f8cee96798653118775b2e4337744099683370962e3eee95f7d
TLSH
T13541275DABEA1148B3B77F569BF6A86D487ABC372E06C49D00010E4F0A72A41C961B37
MD5 SHA1 SHA512 TLSH

Submit Download