hxxps://zrqyvogbb[.]cc[.]rs6[.]net/tn[.]jsp?f=001Cc6AXeJVeJ94JQf04DitfoP4a3FP9GPJzC2dCJ1vQTJUk6Nf9P1ps9yLiya4cdY9M2JzDm-xjyGJ-EYiOOMbG4iUfmmoq0m69GuWAm2ZdxD7tiShWQd7Nxyjzihf69JpGeqawU09zKLtY4ULA8rj-w8Uam1Fexiz&c=3xWz79pDckmcS-k-vZGCrbrXtr0E5WKS4OtSHGgksI1xp30o2CeE7w==&ch=3lJJDxcAGirH12FHrOpFwYygo17bNdz1mI2co65dro4b0jdsPwF5MA==

Resubmissions

19/06/2026, 20:01

260619-yrzs9sbs8k3

19/06/2026, 20:01

260619-yrs1qabs7r3

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/06/2026, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://zrqyvogbb.cc.rs6.net/tn.jsp?f=001Cc6AXeJVeJ94JQf04DitfoP4a3FP9GPJzC2dCJ1vQTJUk6Nf9P1ps9yLiya4cdY9M2JzDm-xjyGJ-EYiOOMbG4iUfmmoq0m69GuWAm2ZdxD7tiShWQd7Nxyjzihf69JpGeqawU09zKLtY4ULA8rj-w8Uam1Fexiz&c=3xWz79pDckmcS-k-vZGCrbrXtr0E5WKS4OtSHGgksI1xp30o2CeE7w==&ch=3lJJDxcAGirH12FHrOpFwYygo17bNdz1mI2co65dro4b0jdsPwF5MA==
Sample260619-yrzs9sbs8k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3816	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134263729276058379"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{6FE9E073-8E31-43BE-8FFF-9670C8F7B7C0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe
364	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1572	364	msedge.exe	88
PID 364 wrote to memory of 3816	364	msedge.exe	89
PID 364 wrote to memory of 2356	364	msedge.exe	90
PID 364 wrote to memory of 2356	364	msedge.exe	90
PID 364 wrote to memory of 2356	364	msedge.exe	90
PID 364 wrote to memory of 4324	364	msedge.exe	91
PID 364 wrote to memory of 4324	364	msedge.exe	91
PID 364 wrote to memory of 5016	364	msedge.exe	92
PID 364 wrote to memory of 2652	364	msedge.exe	93
PID 364 wrote to memory of 5016	364	msedge.exe	92
PID 364 wrote to memory of 5016	364	msedge.exe	92
PID 364 wrote to memory of 2652	364	msedge.exe	93
PID 364 wrote to memory of 2652	364	msedge.exe	93
PID 364 wrote to memory of 4596	364	msedge.exe	95
PID 364 wrote to memory of 4596	364	msedge.exe	95
PID 364 wrote to memory of 4596	364	msedge.exe	95
PID 364 wrote to memory of 1260	364	msedge.exe	96
PID 364 wrote to memory of 1260	364	msedge.exe	96
PID 364 wrote to memory of 1260	364	msedge.exe	96
PID 364 wrote to memory of 552	364	msedge.exe	98
PID 364 wrote to memory of 552	364	msedge.exe	98
PID 364 wrote to memory of 552	364	msedge.exe	98
PID 364 wrote to memory of 4180	364	msedge.exe	99
PID 364 wrote to memory of 4180	364	msedge.exe	99
PID 364 wrote to memory of 4876	364	msedge.exe	100
PID 364 wrote to memory of 4876	364	msedge.exe	100
PID 364 wrote to memory of 3892	364	msedge.exe	104
PID 364 wrote to memory of 4584	364	msedge.exe	111
PID 364 wrote to memory of 1936	364	msedge.exe	112
PID 364 wrote to memory of 2372	364	msedge.exe	113
PID 364 wrote to memory of 3892	364	msedge.exe	115
PID 364 wrote to memory of 3892	364	msedge.exe	115
PID 364 wrote to memory of 5016	364	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://zrqyvogbb.cc.rs6.net/tn.jsp?f=001Cc6AXeJVeJ94JQf04DitfoP4a3FP9GPJzC2dCJ1vQTJUk6Nf9P1ps9yLiya4cdY9M2JzDm-xjyGJ-EYiOOMbG4iUfmmoq0m69GuWAm2ZdxD7tiShWQd7Nxyjzihf69JpGeqawU09zKLtY4ULA8rj-w8Uam1Fexiz&c=3xWz79pDckmcS-k-vZGCrbrXtr0E5WKS4OtSHGgksI1xp30o2CeE7w==&ch=3lJJDxcAGirH12FHrOpFwYygo17bNdz1mI2co65dro4b0jdsPwF5MA==
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x288,0x7ffdf83bc188,0x7ffdf83bc194,0x7ffdf83bc1a0
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,14822962028738004407,1590916319423113951,524288 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,15066552825662753318,15970767694433611463,262144 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,11613508648705431599,16090731588115241870,524288 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,4104080904118637310,14814168197699220840,2097152 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,15812779386838428681,9281930344747008291,2097152 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,10277364426377409945,14097378668062294834,2097152 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,2225640205494559990,12521324572512297643,2097152 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5040,i,6949884049374284070,6211455461546488572,2097152 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,8827722182048844313,14544793613361698010,524288 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,9456938461226412049,12350081561335949235,524288 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,7864577051738210671,7524960461605809680,524288 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,7864577051738210671,7524960461605809680,524288 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,17871241373008660077,6404978627324269834,524288 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,2058259069332740851,5081601669241601679,524288 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,1296957319580445871,16291819744176926746,524288 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,3899530802060674737,3060555817020499493,524288 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6132,i,15790494537477241010,10207442568086495350,262144 --field-trial-handle=2240,i,12682424915264186134,6778834092131165640,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 5aba9d0ab4f693973f0c5d4aab3d272e28dbee0c306a8ab9260328b6c2f95877
MD5 b05a426a7f87a107a2f13aabfc50da0e
SHA1 fbe290a278b36887eee8d28f9850e4ff2b455018
SHA512 9a6615854997ac3ad1163abd8522764637293f16bf1e8af1ef26bbaa66936560402a831eb395db0ad18233686477024f2a0bb737baf814c5194e61d4c11c33d9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T1ABB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 db81b665242a81383ff83bb64e7c4f101c01465df6a2f0ed964960fda2bacf7b
MD5 e645cdb46904d381941f8edd31aae46e
SHA1 58d6ab588673398712dd56418b0e7543639a8211
SHA512 e7a5725d854f5bdafd657ab7861946b37aad68134a1fd57aedaa0b8344d68ec32faea2f1773401857f37f082167a3ccd8d32f34eea1389a296ac958b1763cfb7
SSDEEP 96:/gajG5ZMo8mkdkWoNeHI/KFjLX3q9u/wQMBEtI:YcG5ZMu8HI/kLK9u/3tI
TLSH
T1ADB1A7245B89456DFB604F71EAFB8E22E3ACC1C1279F4E53E18155B97B2A7A3091303C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c4a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c4a3.TMP
Size 3KB
SHA256 a1e4f9fce833da4710961434bd003c1ccea232d6367300e1ae7bbc5e1a3f24bf
MD5 a6c1551819ec369a3a018bf56511fe89
SHA1 a1b98e213f0c3f8728938147ba9d0978e1b8e56b
SHA512 8a38b3e5c915145fddeab2b2c7c650a0aed55b9e9664017e859f495a80211782c0c3bf622d81d85e704cd818eaead66528b58924ec8080ddfc3219e33e0efdc5
TLSH
T10061F82503020A5CF3319372E6F35E65F9FC85D51B6F8E4A7096297E7639B63481143C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 75b263be277dc506bdca1cbf126c2c98bf31c47c12c19eaef89efe131771e04b
MD5 3ea8cdb7f7f458254fce72aee4e2c515
SHA1 594f87be6bc0ef8ab2982944889f18e473a3c5c9
SHA512 b9555388258ca2113e9fa1481f72ce2b222b8e6f7175fffac24e243596a2b50d221f829c6ced593b157fcbb1f44a859507d6f906a4c1d2771f76b3e8c84ec72f
SSDEEP 96:DzODPDSDeDD+DCDTDAD0zBDrVGj6ADcD0DND0DqDHDkmkD8DIDGD8A:DKDPDSDeDqDCDTDAD01D5Gj6ADcD0DNl
TLSH
T157B18DF7C7DC835DE82692F0AA662E27CE5D0954535C3C0AC6D8EF5AA3F2860D28164D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3aa74642f727bc96e4b7f69308b152833ea43aa1b501b5f9c37093fe04986ed1
MD5 421736496888fb45c4ee04d814c452a0
SHA1 dfe75fef8b8045e3c42d5dda51b4e12541240391
SHA512 6495a49d9d7014cf73770a0c641090fc982aac33e57ddb99b9d4c811825fe8a579a2ccddb59efdea4dd3dbcfb81aeba86c87f1fc2dad691b93e19bc87509780f
SSDEEP 192:sxZKRVyM/jK1Ml8MkX/fOsdIfDdIdpebHW6+WNtnU8/YHWGqFIgrJ:sxZKNMX/fOsdIfDeQHbT/D9
TLSH
T12F52E816AA349977CCDBD209B955BF53D6F51572A2A00E48A9FCCA0C04E6BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2d114e0f145e8781e461884d19a94995780bb1ce68ff723962bd522ed930bf75
MD5 6a5cece47d1871cbc31318c1903cd51c
SHA1 9e439a61e5766df6320a7a6f240f2d8bbd131e6a
SHA512 80ceff674547a21b1978eeb45cdb47ff5a1450c694ea216427c746a9e8179e19e300012a552d66641b78297a7e006a334143e39c6097f0692d860159893429f3
SSDEEP 192:sxZKRVyM/jK1Ml8UQZkX/fOsDKfDOIdpAaHW6+WNtDQXYH4hjFIg5NJ:sxZKvqaX/fOsDKfDfHHbaXhB
TLSH
T19452E912AA349977CCDBD209B955BF53D6F51572A2A00E48A9FCCA0C04E6BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0143b5480762ce1497fd0364e5f44ffc34a96c4e26f377556a6923f0a8bb8f23
MD5 ddb897e51a1aa6defe756b3bf19b289f
SHA1 800866613ac0b731bb7c389a6adb26f9cd455513
SHA512 7d227eb65db5b343139b212ac4e5c5dad90231dbceaff898d6430f5d5a3dac9c2efca3ce9219b4a70e59c5b065050bc358d8f98cdaef242d1b220add81d7a3e1
SSDEEP 192:sxZKRVyM/jK1Ml8MkX/fOsDIfDOIdpeaHW6+WNtnU8/YHWGqFIg5vJ:sxZKvMX/fOsDIfDfhHbT/D/
TLSH
T10652E912AA349977CCDBD209F955BF53D6F50572A2A00E48A9FCCA0C04E6BED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2c4be47e93512b5398f9d44a4bdb4679adc772422c259895d6aafa06089d24cf
MD5 5db9ceb471e2e2970e277f79c89fdf74
SHA1 14a2919e590d0a401b4068a5ec1e1c2cdb30c568
SHA512 1741b6063d8d07388ed7e0f84ebb27df28529cf3e9e11cb2426647cc9d36c5a4518ca4307e63775acb0c509e28c99c09d07329a9024bef6c8f6f85b270cace26
SSDEEP 768:wjUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RLroV00/:wjUZYTMWvg0Pou1ja7eLZmR4x/
TLSH
T1C2D20B2B280CCB7E4F844E5DEC2A6F963ED801CB5A984D5447EA894C03CB7EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 98e34433b04e9095d7a40fc695960f17eeedc41d105570476e687faa423c0581
MD5 b08c73092d2d299ab8c897dd7224883f
SHA1 a1bc0a0660282ffaf4116035641d7a34dd157a8a
SHA512 952ca39dea7a73fe5ad83c7ef85be776a7d45028707ceb0a635f947ea7d888af5c207e41ab0ff4be02647e4a029b579a3bfacfedc7e099c32cd56855b8993984
SSDEEP 96:KA1eK2AkWcKjCGm7mKM47iQKDKq25mKy4L:EGbdzHFC
TLSH
T140D11C5170B7D2123C3D2B0892D59766DE91F1A3701CA4AB7BAD11B18E2BE209DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59304d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59304d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a853b84d5b5d30bdd6a3c5e96a48ac22a07f3b222c3fa2bb84d6dcb73b46adc6
MD5 d4710e6dd5f05ad4cd0ffaad3bf5c789
SHA1 ab3c1fffef42845ffc5b9a6d0f81775190cfa669
SHA512 6a21839d63c9f0d973f0572070598d1679656735b4faa2c089d88fdaafa02296d5cf2ba0e52c7c763205c41ed6d77204d8da53299cd44fc2e7f5a28b7e2867e8
SSDEEP 384:OtNn/s3n9SfsNdKD5l0HzX5od+ndiV+DtJr/0hZ0t9IyfHZ9TS:Oj+9UDs7OOYChshZ2Iyfve
TLSH
T182928D3298649C378EE3A585F44B3A530FB956A7AAC56F8491FC6B0C00DB6FC1317D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 34458bdc2d01b85f805a58f8a8c1365c5d6c936a68a2c602610d2ade391cb7aa
MD5 78cb8bcd4144ac5442d92f8a519af310
SHA1 e9101459534d7960b6ba1afbcacdcd5af27cfb1b
SHA512 e7640b19a3eacbc150916b68899ee79152c1ba4366dfb6512a746edf86e6db94ad1229948378de47aaa87b89c9971bc5a03b3943c0a1f623ba87d599b373ce04
SSDEEP 384:5iF1tNn/s3n9SYzsNn8TUNTUlIlHD5lqHzX5od+ndiV+DtJrxwhZ0t9IyfHZ9TS:QF1j+9fOwghC7OOYCh2hZ2Iyfve
TLSH
T149C23AF288D78836D9AE5747F77E3D024EBDC1A7B5856A40B3985A0CCC961BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7478daeba8efdc84a3f07813f37ea4f1bed4f234f91c027bad03b43f72c629a6
MD5 fb446a82c2c8fa2ea64df58d60ca905c
SHA1 28e6320bfe90ef03265e69c07e5d0f2e46604774
SHA512 317dfd2ee4aed8645b1c0ce6cf2950ef3c9148f9db8374cda6cf3d771ad6d469b919893ad48a1482079cde025dd65a8a2c576df32ed6899669fd5c2895171dda
SSDEEP 192:yONR61VWQmiUy2vgGX5Obd+jA+Fdg3ao+j/aS3jsU6:yONR6WngGX5od+ndiV+masU6
TLSH
T15002E735A8686C77CEF2BE4AB48737135FA51077EA952F84D6EC1B0C009769C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 60ea2c5dbb6513b088d57229202c8a3a6c945111648ea7311e1960d791e80b2d
MD5 ba9b8fc73a8fbfcbe7d3153d5774faea
SHA1 cabd548be50b2fd1efba2e871fbe33076c65aefa
SHA512 cb232800631da185dfb63dbe8e6def5c96e87033d1a010472afe3527faaa812752021e078576250aa6841f50963b19b6963dad30f1d6a4c4abd0927a7eebccf3
SSDEEP 384:OtNn/s3n9SfsNdHD5l0HzX5od+ndiV+DtJr/0hZ0t9IyfHZ9TS:Oj+9UUs7OOYChshZ2Iyfve
TLSH
T139927D3298649C378EE3A585F44B3A531FB956A7AAC96F8491FC6B0C00DB6FC1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 53a2a0cea5d0901c9427d9a9fab6908b174448a71a46f6917317a20878550eb9
MD5 59f3061e58c2bae515ebfffa46c0b38d
SHA1 a5456f3e786075f408fe1d1b1929dd741776a019
SHA512 5857ac2a793d993a1d071bb3e755f53ed887ebe8dff32bd8a5f6f7118703b0e9e74aa1fd4e3320cfc46bae10c582af6ef065264b680acceed67e296a80fc6ecb
SSDEEP 192:fON4616WQmiUykv1GX5Obd+jA+Fdg3ao+d1ySJr6jJAqQ4U6:fON46T/1GX5od+ndiV+DtJrWhU6
TLSH
T162120B32A4686C6B8EE3B545F48735535EE55267EF897FC492EC1B0C01DB6AC130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e7494bd-50c9-4fef-854d-7db0ed5f4f65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6e7494bd-50c9-4fef-854d-7db0ed5f4f65.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8a5e88b0982e83ce636dc3d6ee1aa58c17510c73d2888a7e3d37b559855134c8
MD5 260c67341597bc6d4b1705e16d01931f
SHA1 6bfbea62dd27611e1652aa5022d33c509b6fb632
SHA512 f1dc3e78d322b4f9ad11c298451901e1e4b53d44e309d897ec66b3942e1233f6ceb56abdb964cec4cb558a773affb71a7dc970776d1faaebb15456e5cc8ca6b0
TLSH
T133410B58EAEA1148B3B76F5AAFF7A46D447A7C762F46D05D00110D8F0777A0089A1B37
MD5 SHA1 SHA512 TLSH

Submit Download