hxxp://sos-piecesvolet[.]com

Resubmissions

30/09/2026, 14:38

260930-rz4zmawcmb3

30/09/2026, 14:36

260930-ryjx3asyhx3

Analysis

user interaction
yes
max time kernel
142s
max time network
144s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/09/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://sos-piecesvolet.com
Sample260930-ryjx3asyhx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2545564138-786060179-1728272436-1000\{2CB4CBBE-9748-400C-AC41-30CA6BCC3C31}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 2952	5116	msedge.exe	84
PID 5116 wrote to memory of 4516	5116	msedge.exe	86
PID 5116 wrote to memory of 4000	5116	msedge.exe	87
PID 5116 wrote to memory of 4516	5116	msedge.exe	86
PID 5116 wrote to memory of 4516	5116	msedge.exe	86
PID 5116 wrote to memory of 3776	5116	msedge.exe	88
PID 5116 wrote to memory of 3776	5116	msedge.exe	88
PID 5116 wrote to memory of 4368	5116	msedge.exe	89
PID 5116 wrote to memory of 4368	5116	msedge.exe	89
PID 5116 wrote to memory of 1456	5116	msedge.exe	90
PID 5116 wrote to memory of 4368	5116	msedge.exe	89
PID 5116 wrote to memory of 1456	5116	msedge.exe	90
PID 5116 wrote to memory of 1456	5116	msedge.exe	90
PID 5116 wrote to memory of 1816	5116	msedge.exe	91
PID 5116 wrote to memory of 1816	5116	msedge.exe	91
PID 5116 wrote to memory of 1816	5116	msedge.exe	91
PID 5116 wrote to memory of 1804	5116	msedge.exe	92
PID 5116 wrote to memory of 1804	5116	msedge.exe	92
PID 5116 wrote to memory of 1804	5116	msedge.exe	92
PID 5116 wrote to memory of 3296	5116	msedge.exe	96
PID 5116 wrote to memory of 3296	5116	msedge.exe	96
PID 5116 wrote to memory of 3296	5116	msedge.exe	96
PID 5116 wrote to memory of 1404	5116	msedge.exe	97
PID 5116 wrote to memory of 1260	5116	msedge.exe	98
PID 5116 wrote to memory of 1260	5116	msedge.exe	98
PID 5116 wrote to memory of 1404	5116	msedge.exe	97
PID 5116 wrote to memory of 4768	5116	msedge.exe	100
PID 5116 wrote to memory of 1500	5116	msedge.exe	109
PID 5116 wrote to memory of 2364	5116	msedge.exe	110
PID 5116 wrote to memory of 1200	5116	msedge.exe	111
PID 5116 wrote to memory of 3392	5116	msedge.exe	112
PID 5116 wrote to memory of 3392	5116	msedge.exe	112
PID 5116 wrote to memory of 3392	5116	msedge.exe	112
PID 5116 wrote to memory of 3396	5116	msedge.exe	113
PID 5116 wrote to memory of 3396	5116	msedge.exe	113
PID 5116 wrote to memory of 2176	5116	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://sos-piecesvolet.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7ff8e622c188,0x7ff8e622c194,0x7ff8e622c1a0
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,11526020560033115623,15941054489451379686,262144 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,16898268429849676510,15848893349838328260,524288 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,14119507373684114423,17176077615323019124,524288 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,13411464646671032109,10842056884787629394,2097152 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,4001937760528225074,901477491695271533,2097152 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,2662799208039724367,15984592505847901369,2097152 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,13481687118340560853,13367034635446025477,2097152 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3668,i,922163000446664881,18200804230274606258,2097152 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,6726766323958379372,18334361146491059085,524288 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,15827674769611119739,17494790466530244424,524288 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,12502136796422866097,17127436147078361581,524288 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,12502136796422866097,17127436147078361581,524288 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,15772863630947952143,17297028986644564701,524288 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,11297465364073976538,16064532406435652289,524288 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,8957850856776661090,2831829218673336032,524288 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5404,i,9326707097168595793,4467997185338109143,2097152 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,15030100209207510913,17101993000311345821,524288 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=808,i,10361636400594015288,14148466264194516433,262144 --field-trial-handle=2388,i,9762835501860118464,3831038379263637328,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
MD5 e74d8b44e8d40662fd1b1b255738f7f7
SHA1 274571a893d99afe45f887bf62213edcdf6ce25a
SHA512 fdd52b8ff528e9564308a28f53b7774dc738711d7dccce592af97c88bf2722ddb380e7bf76101bce36a685c115e53c6bb3d415de6eecc3c382b674f304fb5a40
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T1B2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92f39ded88b03938d3e4b31017f79311f5bc476c5138786ec4f3009cd32ff139
MD5 0b83970fe3fd024a24ea8bf3342ff0a8
SHA1 35a7f987344c0c20270d574fa6e2734323c3f536
SHA512 545b31bd30e0851289b44ac1dda15dca61ace62dbb4d5b1c4e74f2d22ea35a9e2a2d3cba2fdd8e96b50718338b8e67fe8df33e56c299ce64b0d2ad3791f5dad8
TLSH
T185D02BF4EA8C59B1E023343523118306724D901038032543E0A0024404C116112B8060
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e1e58bb256017b393bca96e6e9c71ecd35b375ec6ee8132b1cc75af6a8d14aa
MD5 9b1b3a6862389c8c4cc6ad25c3726c27
SHA1 c9b5b1c71a70ded3544f25381fc33b96c6707883
SHA512 670c15825c2a49c7ed683325c3e5582c6cbef6f391e12bb6fa389b9384e11fd9c5e5b263f1055acbbe43dceb21ab17df76c3cde93a82dc8810aa552de2f2b11e
TLSH
T105D02BF4EACC5DB1E023343523108306724D901038036643E0A0024404C21A112B8060
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 2c0f18733db38624ebc108077a0588eee88f933a1517921f3d295cfd331c29fc
MD5 330a84b75af35170b487ea94dc4933af
SHA1 d752393918bffdcdc52fabed0dbd1b9fe0a3fb9f
SHA512 cf65ee80fa3389fca1a61eb8276c68aa9bbdd726925a7d5e26535d2ba957919ce37c47cdb8c95c56623d91247a734ed9013089f7817e9bd10a317b0505a4e957
SSDEEP 96:tTL1SqB/kwe23OP8n9inB/k4PhB2JKdrplyB:GqB/kwedP09iBRPftlyB
TLSH
T12B8186018688DE98EB58D3B285D71B673273E68061535A1E0F6CD5386FBA7A98A40F03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e2716b83adaf449ae31f0a6e455374a3ec762763b158ec51ed928c7cf66241ed
MD5 a05b9677e8724998de7025f1049cc3a0
SHA1 faf7c44c98eda4eddc27e1215ada4c90636997c7
SHA512 4acfd634582f4a49fe9d0ec1a09d32af151c56e5d59f9992b0ad5c21a4a7e3ee0697e1ea2ac9a6351795f21f1d2bd64aa10fe204f8a441f441adb24296e9681b
TLSH
T1ED7197418688EE98EB58D3B285D317973237E68021431E5E0E6CD438AFF639EDA44E03
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591524.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591524.TMP
Size 3KB
SHA256 e71eb9fba3ae7ab7f3d9bb1c2aeeb225e9f2e43984dc63a44b3ccf357c4646b9
MD5 08b0a981540c8d2bba2a1a972698bf8d
SHA1 8b9839aeaccf7f3c8f868998347ea8b1991c5b41
SHA512 25151e82fb593e8081ad67a0e8b5b7617ba98cc6722212543f0c9e9af16d2a620ec8ab2524275eb2cc1a1299cb16b82c728f5c14c94fb1a96b00f0ae4d41f1d5
TLSH
T1D061C4419A48EE90DBA8C3B186D723873637E69451476E0D1DACD5789FFA3AEDD80C03
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 0a5431b2cfbfa680789bf9f26eecc2cfcc24695907b393f4676b522c1ae0f3f6
MD5 ad5fab8d2bf6fac197a7b970d8f9707a
SHA1 8058a44039bc7eeffdce84e6fcb8fb0c7b530660
SHA512 071f42ddf5157875bbd3bea7403e269e414037f1590ebe3f64ccdff33e2b3e529d4bc043178a98051fdc39256312598064cef8b6b28b5c638658c4a8b1817acd
SSDEEP 192:DZ+iae0vZeCSrJsi1eTbjGBb17KgdcVlBddlTYIjj+:DZ+iae0vZeCSrJsi1eTbjGBb17KgdcVg
TLSH
T1A1F1EFE7C3E4863CD90259F09A146E1BDE2D0D58936D3C9EC8E8BE0B67E24B0D31165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 03e00e60b087c567318f229abd17a3abc2b34e2b9377cc91d6b245a4b572cb23
MD5 f997953206f019f5986adff763dd6be7
SHA1 42bb2024e8dd4660ef9f85964669fe828fcebc76
SHA512 dead035c94cdb4d119b108c7bb0e01d3e8249c304a04ef2f21b41cce7bf184829706ad112d8cfa3c8ecd101d5aba6d050878489ea4bbe1c36e1daa6f3109df59
SSDEEP 192:sxZMRAWg/fTsSeIdpllTHW6+WNtpx8XYrV3F2Ig5D8J:sxZMBg/fTsSPTHb6XR9g
TLSH
T1FB32C7526E38697B8CDBD21DBA55BF53E6F9503291D01E8CEAFC861C05E66CD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 1247da82a1d4f7591d097ca7843e528a0d9fdb93a229bb48ca83e539928ecf19
MD5 0ab23dff6f02260bb6cccd4cb7441402
SHA1 9ae0a3443051fe1231d2db299685a454028ad16a
SHA512 3e71d7c3382b2d196c00ef3a80056bc87c4d08083391955f910b3a7b8bf250e5fa01095e310b817232eb71cd7cccb22c7a0b3f302bf0cb88d0aaeca2db3a41fa
SSDEEP 192:sxZPRAWg/fTsJdIdpHoHW6+WNtIc/YrV0F2IgrJ:sxZPBg/fTsJeIHbV/a9
TLSH
T14B22A7516E28A97B8CDBD21DBB15BB53E6F91031A1D15E88EAFC861C04E76DD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 16793f62b268397ee11c36514851031fe35e87d6455199cc9821b283bf2470c5
MD5 76916af9693db71178a2ffe3d9bc7a37
SHA1 132a8568c2be61f5b371ffdeeafb147f8ee9ce63
SHA512 5522c26d56c5e8c06d3ecee8948be23ecc774a4939afe65f100c90e7ed40c78c038daae5e0f661752fdb4dbf25d258933da4e568488e9ac0d0be1eb62934f70c
SSDEEP 192:sxZPRAWg/fTsldIdpHoHW6+WNtIc/YrV0F2Ig52J:sxZPBg/fTsleIHbV/aI
TLSH
T10822B7516E28A97B8CDBD21DBB15BB53E6F91031A1D15E88EAFC861C04E66DD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9fc5c35a7ce11bbaaee6102b123ee9474f4640db3bb154a2c100ccc6ba485fab
MD5 aba1be98bf5ca90bf3d1020701c89054
SHA1 1fe4a2db9987085dfec91bac3e7b84475d134f28
SHA512 1a751ffc9c86d0f5517ab80fa5e112a734dddd98defeb7ab5a3c6a9a4ebf0aa7da551fca6c019592f9eda624d2e1e54993f572d099e552f0aa287e6df403b9a4
SSDEEP 192:sxZMRAWg/fTsSeIdpHlTHW6+WNtpx8XYrVmF2Ig5D8J:sxZMBg/fTsSPRHb6Xm9g
TLSH
T11422B7516E28697B8CCBD219BB55BF53E6F95032A1D11E88EAFC861C05E66CD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3c27313510797122a384e7574a98449df5471a0fda68e482bb187f7b81cb8642
MD5 552da30b5f3b1d03949fb1a1cdc3df2c
SHA1 a653656252ac7b6e195bde1873fd789dfbcdc01c
SHA512 2ecb2a226376b2e18081907100c7e02830c50fa3e14203a71191eddb41b4d306439f3a1cc2f4465275fd05306dc3a28cef73f90b7a5f51d13297b24a85df9965
SSDEEP 192:sxZPRAWg/fTsSdIdpHoHW6+WNtIc/YrVrF2Ig5cJ:sxZPBg/fTsSeIHbV/ly
TLSH
T16A22B7516E28697B8CDBD21DBB15BF53E6F95032A1D11E88EAFC861C05E76CD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7d59d533050c5ff7e88db8b7d4120533660a983bec87e35669a3bad30fefdc64
MD5 4502a67ee5f8fb94d73603d34aa187be
SHA1 e68c9ccdcddba1608e2d48b5f3cc049834d02d7b
SHA512 3fb963b7dbe5f2b38ec586a91ec00bd6cbdacd1ea1a3338b6daa576d9ce0f399c5580686200af76b4c7db5ff10f7e98fd7805bb2ea521da8e7f2d26504fd1d07
SSDEEP 768:Jia0JX3Wv/xh98F1+UoAYDCx9Tuqh0VfUC9xbog/OVWmLlEy3z6ro7r0av:Jia0JX3Wv/xh9u1jaHmLKAzxx
TLSH
T17FC2EB3B284CCB7E4FC01A5DDC5A6F977E9802C7A6548E8047FA984C02D77EA61274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 41722540916ebdecbbc40c57f82577eaa82591702fec381452c1ae4740865968
MD5 676d06650ceb735bd679470b8b2b70db
SHA1 ddb217e97d03b98d318bdad66e3990577281a5b4
SHA512 ad1c30d9f70683a39de9a28c34586f860f68397439b40351c1e4db169f1061acf04528799af68c237f33def6d4afeacf88682d496354f3ab725d5cfbf0eb4e70
SSDEEP 48:KMCIfK3K0nyJgI7KdKcryZgIzKlyseUVUUU7U/UVUrULUhz:KMC4K3KuqggKdKKqgAKly+z
TLSH
T15691B21171FF0240387D292985B8876F865276A37128EF6A7FBC10A6CE66D084DFCCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a2ed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a2ed.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 21cf84b078e5021070e7cc59064795980a3bb877a09f8834b9a2c2131ac59e1a
MD5 48990166bdfc3c38e59f2e30c4d6fb35
SHA1 d512dc579874caf54dc5dd2ce25bb12458082920
SHA512 b3fbb2f8f3beff65640b32a859d5a308ebb97e401ca4e566b1ce898c1fd0718a348f3544747ab4ca21daa6c1619f51308b0152e4ba0bf01de7886cca66f7230a
SSDEEP 384:TiFiZcIQAsNY8TUNTUlIlkZCZdIap1Nse2gMuOoJuDfitgOIwZOynLwod:+FQDVwg/seIn/iXsAMC
TLSH
T1C8C218F248D7987ADCAE5B43B77D2E028E7CC027B585AA40B7985A1CCC961BFD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5ee4bdb825a9c354f109d10f192d75c28b196889ab7ccff8d6e9bc49a50a956c
MD5 0293d76669f7d17d168b004e6f16c12b
SHA1 55584970e7bb0f89c155b3e0c4cbfbf71556102b
SHA512 b8957658355d35da35a714af2a980ef0788a0931b0840c07f8a02c0ed78c166bd7418a9b7c144eb984fc2c727a50778f1beef7be0b38c1be3f00950ec291462b
SSDEEP 192:WONW6L1QmiUyT1NqMgmSuOoI7KdFOQxvXl8U6:WONW6foNqMgRuOoJT18U6
TLSH
T1A902EA74AC68B8779EF36E45B58736139EA8103BE9912F84C6F41E2C01D765C2343D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4491479b3d7289ad5a65c80afd5782edf6180ee36b5f9f9f15b7533437dc9eb1
MD5 2bc1166bedb87dd5e75e42f66cd7ad76
SHA1 573f77857982764978a246244d9eb9a9f717a274
SHA512 f902a4745842af736b295e771889cfbe46a03ae3463da823b013c754eb404195c6d5453064e998324cc747b10c5148a5fb7adbc8f220d9e4c5aebc82012f9640
SSDEEP 384:JZcIhsNokCCZdIapLs1gMuOoJuD4itgOIwZOynLwod:BhUshnYiXsAMC
TLSH
T10A827E725C78ACBB5DFB9681F58637138EB85037E6C96F84C5EC6B1D00EA5A4130BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c0117753517d5f25a90c3e66165e0da576a74378faa38c29934091fe90002ed3
MD5 868161ab653247b7d88b56378bf1d98c
SHA1 a825f363e46a5a7a9691cfc77c0df5311aacba00
SHA512 7470e8688ec03df652704861f47c78ae05c072735fbddc63324f8a4b9659edfebc2410b06410d3a138e7386e452ee97e88d29cd27cd8999c16e429b6432ca046
SSDEEP 384:QZcIhsNokZCZdIapLs1gMuOoJuD4itgOIwZOynLwod:uhdshnYiXsAMC
TLSH
T117827D725C78ACBB5CFBA681F58636139EB85037E6C96F84C5EC6B1D00EA5A4130BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7cc2db0f684f9163499ad227439c5bf1cb6d1a1379799fe857d5bd3e3f722c88
MD5 5925fbe9e2efddad428860098a2a47ee
SHA1 c68be3bbc8aa5183491a8f9ca5f5b953be8ef5c7
SHA512 84411cd6066ff619c3811e4afc96772bdf67cbb3c9ae695944e838d998156bdaf37520d4f98d39a9b3c43903dc87dc2179725c97be43832807c8fd7d98279f96
SSDEEP 384:QZcIWsNokZCZdIapINse2gMuOoJuD4itgOIwZOynLwod:uW0seInYiXsAMC
TLSH
T1D6827D725C78ACBB5CFBA681F58637139EB85027E6C96F84C5EC6B1D00EA5A4130BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 43ff0a9863471771ffc8b7abc03d3a52d4679395164d8f187a8e3d2caf08f13c
MD5 cbca70029492b031bdcfa31792aea300
SHA1 fc84edc67350a0eb9553379f1073da503e42dc11
SHA512 ddf99023191ea3a54074ee7505a2147ac8ac01a93d2dd82863bc85c6ed6555473ef4e28f1678092c5eb714e41bd8ab6a459047af2695b76b0684f323264f87bd
SSDEEP 192:WONZ6L8QmiUyb1NHgmSuOoI7KdFO9DzZ/F0fqZU6:WONZ6IiNHgRuOoJuDgiU6
TLSH
T1C3121B719868FC7B5DE3AA91B58336139E641127EE857F84C5EC1E2C01EF5A8630AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

663d571f-10fc-4aab-8726-2ffde6e93af5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\663d571f-10fc-4aab-8726-2ffde6e93af5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0149b69b2199f737d9adab5a058198d774093e71b29ce01d0df6447f09bd1efd
MD5 ac563e9bc6ddaf26d443cd52abd50725
SHA1 b426b8eeb2953be272d2b2b8fc5508ee740ca99f
SHA512 b786c55ca763a3f43d8758299872eb98c954d448c73234624a3bd4fc26648e6e33446890730fec046c49809aa537453a1b403147068ae992bd601b4736390c88
TLSH
T193412798A6EE1008B3B77E5A9BF6A95D487F78732F0AD55D00110D4E0A23B40D9A2B37
MD5 SHA1 SHA512 TLSH

Submit Download