hxxps://en[.]hitbot[.]cc/assets/download/HitBotStudio/HitBotStudio[.]zip

Resubmissions

30/09/2026, 12:31

260930-pp6pcsvv3p3

30/09/2026, 12:29

260930-pn13gsvzdt3

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://en.hitbot.cc/assets/download/HitBotStudio/HitBotStudio.zip
Sample260930-pp6pcsvv3p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1228	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{78C4DC46-FF56-48D5-890F-0C038A017AA7}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{5087D779-0D26-4186-B1AC-0BF02F7A4C99}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3780	msedge.exe
3780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 1620	3352	msedge.exe	85
PID 3352 wrote to memory of 1228	3352	msedge.exe	88
PID 3352 wrote to memory of 3504	3352	msedge.exe	89
PID 3352 wrote to memory of 3504	3352	msedge.exe	89
PID 3352 wrote to memory of 3504	3352	msedge.exe	89
PID 3352 wrote to memory of 4736	3352	msedge.exe	91
PID 3352 wrote to memory of 4736	3352	msedge.exe	91
PID 3352 wrote to memory of 1460	3352	msedge.exe	93
PID 3352 wrote to memory of 1460	3352	msedge.exe	93
PID 3352 wrote to memory of 1460	3352	msedge.exe	93
PID 3352 wrote to memory of 3300	3352	msedge.exe	92
PID 3352 wrote to memory of 3300	3352	msedge.exe	92
PID 3352 wrote to memory of 3300	3352	msedge.exe	92
PID 3352 wrote to memory of 1848	3352	msedge.exe	94
PID 3352 wrote to memory of 1848	3352	msedge.exe	94
PID 3352 wrote to memory of 1848	3352	msedge.exe	94
PID 3352 wrote to memory of 1044	3352	msedge.exe	95
PID 3352 wrote to memory of 1044	3352	msedge.exe	95
PID 3352 wrote to memory of 1044	3352	msedge.exe	95
PID 3352 wrote to memory of 3084	3352	msedge.exe	103
PID 3352 wrote to memory of 3084	3352	msedge.exe	103
PID 3352 wrote to memory of 2232	3352	msedge.exe	104
PID 3352 wrote to memory of 2232	3352	msedge.exe	104
PID 3352 wrote to memory of 1328	3352	msedge.exe	107
PID 3352 wrote to memory of 1508	3352	msedge.exe	113
PID 3352 wrote to memory of 2576	3352	msedge.exe	114
PID 3352 wrote to memory of 1508	3352	msedge.exe	113
PID 3352 wrote to memory of 1884	3352	msedge.exe	116
PID 3352 wrote to memory of 3704	3352	msedge.exe	117
PID 3352 wrote to memory of 1028	3352	msedge.exe	118
PID 3352 wrote to memory of 860	3352	msedge.exe	121
PID 3352 wrote to memory of 860	3352	msedge.exe	121
PID 3352 wrote to memory of 3780	3352	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://en.hitbot.cc/assets/download/HitBotStudio/HitBotStudio.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffe432bc188,0x7ffe432bc194,0x7ffe432bc1a0
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,14768483504028478457,6145999944773861116,524288 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,17630697509508263184,10619318145467837717,262144 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,14870025961622388518,13922317665188940061,524288 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,1584208956038861332,2058338302966638297,2097152 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,6691343597764455625,5767230662058968082,2097152 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,7352308446658022980,5490101728212345639,2097152 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,18190444715268136680,15576624118984394888,2097152 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,11267587048340124094,1161147367863371673,524288 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,14180777913087818712,17991178141815622209,524288 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,13814988977284703127,12142382580674756472,524288 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,13814988977284703127,12142382580674756472,524288 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,4439228082603973971,14034886346749402306,524288 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,15502299964247886925,10517860306245430028,524288 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,15967167052487235122,18262278266059800750,524288 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,499470601685886562,3916271134108512207,524288 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1616,i,15518745415031194464,12799225083688471181,524288 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,17647983917255760339,2673992999938617354,524288 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5168,i,12646675328543479854,675158170696073989,262144 --field-trial-handle=2232,i,5182506549657311075,736307880841275876,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

38b500b8-27f3-46d6-8e88-c45f171b40c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\38b500b8-27f3-46d6-8e88-c45f171b40c8.tmp
Size 18KB
SHA256 6bb3dea255c85174fdcf5dcc273299bd58eb6cb28eefbf87879cae8c1310a3b3
MD5 50e0544ae465bde42834225941eb3888
SHA1 cb621950ef828bb7c6649e4cca481c1d2ba5b76a
SHA512 3e67a88f0ef6690340d88d4a0008fabb407df96dc5d8b6a1194faf989b3148d9e05b2862b72f0fbefdb489560cc9ceb844af50b162ad0d40663a7e637e1df90b
SSDEEP 384:tZcIhsN7jMrYc4ZfZcHX58ET8AJeXXSStgOIwZOyEZo1:1hM5xnCaNiSXszi
TLSH
T117828C32A9B8AD7B1CE7E145F08A32039FB89067E6C96F94D5FC5B1D009E599030BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
MD5 6ce50f5d79ab86d6489a63e08ead9ec4
SHA1 d52fb22446c08230d0edc8374b1dcaed1af585ea
SHA512 fd66aaada3f82de40a9236f167ecb23bc285a49f72374f567e078118a8bdb229e4fadc26c639553cfacaa7d7ba44e0419f17b4bb4a9a8999b51bdd037a28783a
TLSH
T189D02BF4E69455E4D441283C11130304314CC4001C033010C46141D21D8D7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 02cf6c2debe9573f3713554c359339f3deb6fa4abd8c14fc6d2577e42ce2d830
MD5 eec56aca3717cde66f2f4d578de1d4d9
SHA1 965ee07ac77588f49d8c4fdf547b37349747a74f
SHA512 90d05594a407bba8ca844c3df6d127aec4c8ecb87f3d2106da447965d8445c3863cdc5a376c90818be642f5dbacedbbb845f24cc640f422e049733d24470df99
TLSH
T163D02BF4A6D459E4D841283C11130304314CC4001C037111C46141D20D8E7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1b81788e7c00ef848a9158498d594221d6be3dd4e72fcb7ce50ea2b46faa0ff1
MD5 eba265cf25f835f3edc5e7cbcdfdc6f2
SHA1 5831063404d71947b596064317476cefef0f3457
SHA512 232a33d664bdf790f968e24b93f59a11b7b2c60de925c1a9ff23f98b109cbd959ecd680bc28fb4d6c534c309d4fcedb979bc3a05b10c8a2724de532a0ac6e4a6
TLSH
T15A71AA83679CE275CB1804BA48C348CA7A3ED3F8D5478F4A5B94D839AB4334976F0227
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a946.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a946.TMP
Size 2KB
SHA256 46c26773f499e1f1463f542ba5f8459ade04ad3442ef7660aeb386ea4d582a19
MD5 5db90861de7880e0c9697001ed0c1b48
SHA1 faa32d61ff3ca85360d0374f5eca1dd001980daa
SHA512 a76cf672dca8b6fd32fbc7eaa8d3b242ce837007c72a3ac63d0c8f1db2e279d4095fb3e4a097b957728a04790a65a70a319e3979ec8a60bcc133044a52899978
TLSH
T171517383A78CC675CB5804BB48C388CBB538C7F8D44B8F4A5B94C8795742309B2E0234
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 318952bcf5262cbd5ffc9794364ca99059b86e748c2f9014d0cc996c32aed4f5
MD5 a125f401ce93e01a4afe6bbfafc8cc77
SHA1 80c05ea8d670c154825b0afaf5169e63335178dd
SHA512 71ea60328a08020f40d319e17a80f1f6990682ca10ea2cf185725f379ecae7c1b625b2537436c2cde9eb98d11079f19d1f52f34e19ac6d1b94ed9f49477300a2
TLSH
T1B041BDF787E4952D89215AF0AA15AE1BCF9D0914472C3D39C9D09E1BD3E347AE100A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 75fc1937fee00928a060a928bf8324f1a7850a54720a7ce0f66e7e28e4512c68
MD5 69d357ae14b636f2ee2d4662a5c57c99
SHA1 e0110587c018a381504435e4fe69f5d29978cf57
SHA512 28d8812afa654914ececec83a4a8dbfbc3458f0958b56ee61361fd3ca8302a5fd4521d9451fc889493f566cf4051d54cae66fae6b2704a5c3e862e3ac89e548c
SSDEEP 192:sxZSRoWx/fWsk2Idp9qHW6+WNX8V/Yr5qJIgrJ:sxZSBx/fWsk3oHbs/p9
TLSH
T1E822C7526E28A97F8CC7D20DFA15BF13E6F9507255D50E48AAFC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8b25967616e8c6fdbc5e2e587a44f2a07cb68b4209c87690378115609ff72c8d
MD5 8f4511dfb199b1d2987dae8df53a573a
SHA1 2adc99a2c3fd27a11a7aa72d64f8a8c01690d41e
SHA512 83c65ae2119fa7826099529e973e8f45c8ba90528c8a3b1a217a5999b3022e0a1826d6301a10acf2a56a2e81b97facba01aadef0f4486e38c8e69a4023123b56
SSDEEP 192:sxZSRoWx/fWsG2IdpvqHW6+WNX8V/YrBxqJIg5ipJ:sxZSBx/fWsG3CHbs/uYUT
TLSH
T15322C8527E28A97F8CC7D20DFA15BF53E6F9507251951E48AAFC8A1C05F7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2ab9a13a5161f3408c8b779fbf02720ac028cee2349b760ed0ceac0861ad90f5
MD5 e59504e9691d8bf5250f5dfbf39cb9ab
SHA1 b6cf8e3c1cb5aace951f902a45417562845a6f75
SHA512 e3fd9086ee3b5e8772ef98e802f2b2fbe130edbc519dfbfb66549742d8a3d79f2635d85f85d19963019f794d69ff4cfecdad861bf29e2fd127a20555056f3edf
SSDEEP 192:sxZSRoWx/fWsf2Idp9qHW6+WNX8V/Yr5qJIg5iLJ:sxZSBx/fWsf3oHbs/pUd
TLSH
T1CB22C7526E28A97F8CC7D209FA15BF53E6F9507251D51E48AAFC861C05EBACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 deffc898bd05c6a3c6955da9ed006013faa6e3ffe4f2934ba240daf0cd063ba5
MD5 0d72872997dc9ec6502bf8bf9ee056fe
SHA1 6f2a3c2759cf53ec287cde36447aa35abfcd9971
SHA512 2c204814ad54c221f9d0004a557b2c39566f73795ff3dd84d9eff12067a3d98c8a5528540f8bdc040b09f106bf7600d7d4b445204e75883864de424bd61b5d63
SSDEEP 192:sxZSRoWx/fWsG2Idp9qHW6+WNX8V/YrBbqJIg5ipJ:sxZSBx/fWsG3oHbs/ueUT
TLSH
T14022C7526E28A97F8CC7E209FA15BF53E6F9507251D50E48A6FCCA1C05E7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 50cc7d5d543f667e7a8e5866e54a341c215e9adeaec79ee4ce233d64910fc6c6
MD5 d5ae5bea8c19c6e942fccd3d2988162f
SHA1 a24009d1a699206a08173b5addc781dbb39faddb
SHA512 c58830a14b87e6035522212cba150ad917ad4df36ea6be4d7ac44cd8d34583328b41bde8ee1d512263159c1744127d55708d5cf989d87b1e5e13b3e21845fb68
SSDEEP 768:luy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbqroRhj:luy4J/DWvbtBhu1jajiLm0bBbj
TLSH
T1DFC2FA3B644CCA7E4FC00A9DED5E6FD73E9802C79A948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6ba87d29186ea6937ef8c6302a7ff40ed9b0ca986cc38bb412b2c420568ea5ec
MD5 2d23ee114323d23738e628ef75d5f58d
SHA1 f808c77427090ced555bd02e16eccbfebcc5fdb3
SHA512 da669dfc8807d9ad115630a3f0ae047a9befac2d4b9903e079be41fc0dee4a266f4e46a1c04a043f2059658cbc287eb10855fc4e210d33af458e0f0c3d95996a
SSDEEP 48:KIDI1Ks04jyLBQ9xbfj8bP6nISJ8K9p1D8xhsYarhhyLcLq2EVlmb1YNISzmK9j0:KIDCKs0+yuwKbKO/0AKlev
TLSH
T13991254530B7020539BE368D80F69B2E2241B6737019F52BBFBD40A18E2BE141DFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2dc01f8-4a6c-4535-826a-d97941f3afdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a2dc01f8-4a6c-4535-826a-d97941f3afdf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3b2e112e06701ebc37d08ab5133d62282a7f9903a99e231ad6c0ce7ce02b7311
MD5 bca86bfba41ca63dc906b0ac1d49237b
SHA1 d70af10a1d707ae0b15c3ceb54f3abf1d2f552bd
SHA512 9df7290f6bbc00debea208d1554df35d00ff34186ad1f4d54f723dc98e2588b98975126dc2d3ee293d84b7553c10361a0188efc18e230d88597751b7b732a798
SSDEEP 192:1ONA6wlDgQmiUyqyW4X58gZDjzorAJaDltFwoU6:1ONA6kgcW4X58ET8AJqgoU6
TLSH
T1F002E739F9787C7B8EF2AD09F48627139FE5112BE6552F84C6E80A2C00DB65C130AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 264dd79c1dd68f16332051b01805c0a0e4ab70b5aaf2298749309d653879b74b
MD5 d9229160d437e74d8fe2b9d77cd8834a
SHA1 df3baaf6fad317c8b35ba0995dba34073d245d2b
SHA512 24460a52f679a811f97ae9a31a20e3da7c3b3b8e92bda65f64b1b006d1c66a0320f78dec145676ccf47485c8e944f8ebb03723e69990676b017d177778310574
SSDEEP 384:SZcIhsN7uMrYc4ZfZcHX58ET8AJeXXSStgOIwZOyEZo1:ghL5xnCaNiSXszi
TLSH
T15B828C32A9B8AD7B1CE7E145F08A32039FB89067E6C96F9495FC5B1D009E599030BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cc0835cf5695a832e3dfae22472ccb0e7eba980cf15f48070916393ebc5b7c8f
MD5 9bc946f433358f2bf9365a90b0dd7533
SHA1 7eb2474ceea13bb2a0128d0d440fc790f780db73
SHA512 8230abdae6f79d7db437da128edbb6c8d6b6f26c448389ce4b3b174d7c37d10d63aee71c77bf488a7fcac94ca145f9657d9dff05c36e29a1395a548ee9c80504
SSDEEP 384:aiFiZcIYzsNF8TUNTUlIluMrYc4ZftcHX58ET8AJeXXVStgOIwZOyEZo1:RFQkkwgI5xPCaNlSXszi
TLSH
T19FC23CF254E7893AD9AE9747E77D2E028EBCC053F5856A50B3984A1CCC5A1BFC30AD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c2a8d1f4071e1341f26225d60ea53e8881887121d22f24796a7f75f02f14c5ea
MD5 d0baed97f1d9f3574b5df07c7c39a04b
SHA1 dc65b8f1189b06b2ed37a19863af2db08b7c63a0
SHA512 22704c4311a402b178f3f240d4dab16d978b5877649376a1684ae4391d90d1c51a253a88560207d10bd6bb5756416d9c89c8d34db240124438544ace18705aa7
SSDEEP 192:1ONW6wlDJQmiUyrMyM4X58gZDjzorAJeXxNUve0qUU6:1ONW6knSM4X58ET8AJeXX/SU6
TLSH
T1C012F736F9A8BC2B4DE2A445B08632039EE55127EA896F90D6EC1A2C01DF65C530E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab287787-2ee6-4d17-8bfb-874157345036.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ab287787-2ee6-4d17-8bfb-874157345036.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9bc00c573f203cf30d46590a00bb8a15cafbcc4d7e047ae3db2432f3e77309a3
MD5 7420d4b35dc82d0236b509dd79308c86
SHA1 1e2efbf7c6a0bbebdafa0a2022a9026fec4699f5
SHA512 a870dc2c4b4f794ffc9bd58cf9ce0a9ca18372ca99160182aba470dbf6a81d6ffb190dea50eae2acd8e107f655383f609d4fde750779c51c9d57181d293d11f1
TLSH
T12E412658B6FE0108B3B7BE4AAFF6A56E447FB9732F06849D00110D4F0666B40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download