hxxps://nzfeca[.]com/

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nzfeca.com/
Sample260625-c1ry5agz21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4684	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268283952124142"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{80011197-DF78-40A7-A610-87AA8F7335BC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
264	msedge.exe
264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1716	1892	msedge.exe	86
PID 1892 wrote to memory of 4684	1892	msedge.exe	87
PID 1892 wrote to memory of 1580	1892	msedge.exe	88
PID 1892 wrote to memory of 1580	1892	msedge.exe	88
PID 1892 wrote to memory of 1580	1892	msedge.exe	88
PID 1892 wrote to memory of 4692	1892	msedge.exe	89
PID 1892 wrote to memory of 4692	1892	msedge.exe	89
PID 1892 wrote to memory of 2924	1892	msedge.exe	90
PID 1892 wrote to memory of 2396	1892	msedge.exe	91
PID 1892 wrote to memory of 2924	1892	msedge.exe	90
PID 1892 wrote to memory of 2924	1892	msedge.exe	90
PID 1892 wrote to memory of 2396	1892	msedge.exe	91
PID 1892 wrote to memory of 2396	1892	msedge.exe	91
PID 1892 wrote to memory of 5104	1892	msedge.exe	93
PID 1892 wrote to memory of 5104	1892	msedge.exe	93
PID 1892 wrote to memory of 5104	1892	msedge.exe	93
PID 1892 wrote to memory of 2528	1892	msedge.exe	94
PID 1892 wrote to memory of 2528	1892	msedge.exe	94
PID 1892 wrote to memory of 2528	1892	msedge.exe	94
PID 1892 wrote to memory of 4184	1892	msedge.exe	99
PID 1892 wrote to memory of 1868	1892	msedge.exe	100
PID 1892 wrote to memory of 4184	1892	msedge.exe	99
PID 1892 wrote to memory of 1868	1892	msedge.exe	100
PID 1892 wrote to memory of 3288	1892	msedge.exe	102
PID 1892 wrote to memory of 1456	1892	msedge.exe	116
PID 1892 wrote to memory of 5036	1892	msedge.exe	117
PID 1892 wrote to memory of 4764	1892	msedge.exe	118
PID 1892 wrote to memory of 5052	1892	msedge.exe	121
PID 1892 wrote to memory of 5052	1892	msedge.exe	121
PID 1892 wrote to memory of 264	1892	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nzfeca.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff91d21c188,0x7ff91d21c194,0x7ff91d21c1a0
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,12159809753423370345,17959569966623078443,524288 --field-trial-handle=2224,i,1731611173245126382,4520801832279502780,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,16998930759237685031,11493748642901275447,262144 --field-trial-handle=2224,i,1731611173245126382,4520801832279502780,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1372,i,10047392939918010057,2021785324806344119,524288 --field-trial-handle=2224,i,1731611173245126382,4520801832279502780,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,2306376563435158027,1442713384460867849,2097152 --field-trial-handle=2224,i,1731611173245126382,4520801832279502780,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,15016525867983991966,3682277611807742590,2097152 --field-trial-handle=2224,i,1731611173245126382,4520801832279502780,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,11247063055966517030,16636070179303177102,2097152 --field-trial-handle=2224,i,1731611173245126382,4520801832279502780,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,8148042424017525106,12240319216527694929,2097152 --field-trial-handle=2224,i,1731611173245126382,4520801832279502780,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,829912792481272839,9825791134878844900,524288 --field-trial-handle=2224,i,1731611173245126382,4520801832279502780,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,6904729723383704653,2434795874302452050,524288 --field-trial-handle=2224,i,1731611173245126382,4520801832279502780,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,6666612638892646791,732211763517297078,524288 --field-trial-handle=2224,i,1731611173245126382,4520801832279502780,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,6666612638892646791,732211763517297078,524288 --field-trial-handle=2224,i,1731611173245126382,4520801832279502780,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,6536916754045121275,12804664299166340474,524288 --field-trial-handle=2224,i,1731611173245126382,4520801832279502780,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,18366193915638067635,17599218326297718370,524288 --field-trial-handle=2224,i,1731611173245126382,4520801832279502780,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,13151641522443664895,209380980422999335,524288 --field-trial-handle=2224,i,1731611173245126382,4520801832279502780,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,4359598821168238117,18424298030841521417,524288 --field-trial-handle=2224,i,1731611173245126382,4520801832279502780,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,4783449393924052597,17421698790131538075,262144 --field-trial-handle=2224,i,1731611173245126382,4520801832279502780,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

75161e1f-cee3-4345-8eb9-eb3a45c85467.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\75161e1f-cee3-4345-8eb9-eb3a45c85467.tmp
Size 30KB
SHA256 26f1f850c7c3e39227a0c14860f486b3a9263d1ca789f4b93bc49474d3b78b6c
MD5 23fc278afc4673107c380b29ac4129d5
SHA1 60970572c90796394a15940b64adfff5a6386d8e
SHA512 696eec5d821fc6b3827578068361ffe466cc01115b62c02ce102c50b70cd00b3379ae07d5beeb16a4a1e1148c8fb7b12ecfc948895517090d5ce288c6a156750
SSDEEP 768:ga8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opd3roAkDUnk:ga8iJPNWvx76ru1jahALocdknUk
TLSH
T189D20B3B680CCB7E4F844E9CEC266F966DD801CB6B948D5447FA884C03C77EA512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 32KB
SHA256 51b0b462be92a5ade147c3619f54d666f155aca3101692fa0e16a66cd86049c8
MD5 6fcb65e0c9aae47bc710c3d983fd800a
SHA1 74fcdc16aee51a353918619d941aa7d195f0ec0b
SHA512 0f2963555f6c21bccce259f07c4ce41afdb88db1840c80de5d9ffbcaf0fb1382683123c8afd8ff13a3abbdb4e8227369403916a08feb0f1f54443f83fd8a7083
SSDEEP 768:m31YluyS4YQI2Z2LUhTUWE7nhy49bfQV5lvQL8cNvUh:LlNS4YQVZphTUxhDDwQL8f
TLSH
T185E2F1626DF18E57A6103B6B70815834417456F81FBD36F9EB24A8AC1B1E40437FAC9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d17d334ff69b435430d668d2c9b21f48d59438c4a737691e5770068e3ef4e921
MD5 e1baa70947f591352edb4e903f3b9f4c
SHA1 9abe7eb9fb6507bf453d6134fd3a2590e4f149cf
SHA512 4f9109aa7f674200745adaa708168d621915bf50a7803cf3a8743f4cbac23e1116a3af548e7d4dbf33270bde8880c007144c97db21dc36a157c3895d8e79702a
TLSH
T175714C4211553C77EBDA06F1F4CD4209B9F1CEA50E531FD5155CB8BD9827B23409AA0B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5903cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5903cf.TMP
Size 3KB
SHA256 b87c4d00b0e072ce2eeee603232c265c1932f4f9a6b48c4762fe3a3e5575eb2f
MD5 81d25463f3ac1c8345aa632f7975f6e4
SHA1 5a9b4576476a78116d0f9720477abb07eb6dbce9
SHA512 e3a583fc0c2305c042a7245d4f48d0fd98976e11aa75dacfcfa801b442a6e6c5d0ed066821ebdc822eb7da6a9b27d0c7437a06c5c026e4c17f36e56b7841f0fd
TLSH
T12E714C4611567C77EBDA0AF1F4CD4209B8F1CEA50E531FD6155CB8BD9827B23809A60B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5898d6b6f4a1a01384d3ff1e939de1fd97a95216c68053d8017647a4d9ed30e6
MD5 12a4738478b219ceb78edf15adeec3b3
SHA1 813d8bf7452edc666a42e4d715f1fc5da08b0b9a
SHA512 58ff43a4532176a3f1528e1798668fbb34cfe8cc49578019bee92759746ac53fb407a37f5b63a6e3e32ada653be6820730f5eb79dde98d382f6a1b274efa672c
TLSH
T183416BF7C3D9C61D890516F0AA24BE1ACF1D196443283D2AC9E4FF5BA3E2471E111A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ccbeb616b35fad353544dd2f4eafc9a176bb6cb827bb261df413e93720d69563
MD5 72622ca4b9d1b3ca0119b8926800fb4f
SHA1 7671bb9ca5cc088d4c37bf8013dda982c1cdb744
SHA512 22cc2bf3eb28c8cf91aef13f0dd75056a9841f53ad1886248597de9ca15e8904bbd109d3d64640f9f475493568f87b31ec626c5ac9364f3acfcddbb3102143e5
SSDEEP 192:sxZRRJyM/jK1Ml8MkF/fAszguIdpFBHW6+WNqKx/Y4CFenIgrJ:sxZRTMF/fAszg/LHbh/x9
TLSH
T13342D952AA389A77CCDBD209FA55BF53D6F50472A2900D44A9FCDA0C04E6FED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 127268d625cddcc7168f82c3476d23c9a4367006efb90ed3c5a9783564f52f4f
MD5 14ceda079b2954db8dab4d61610eec1b
SHA1 63dceefa3085dbc1d717d0aa4403b3b8fdc7873e
SHA512 d9754fc624afbbf46587628deaa44ffb8df42ea9d4cf1958a6bd201657e67cc52697e63fd0b05f10fbb35fe100c05f30b7016d7bbba11b509a0b195e2e028a33
SSDEEP 192:sxZRRJyM/jK1Ml8UQAkF/fAsvpuIdpbBHW6+WNqB2XY4sqenIg5zJ:sxZRTqTF/fAsvp/NHbdXs/
TLSH
T1D752C8526A349A77CCDBD20DFA55BF93D6F51472A2900D44A9FCCA0C04E6EDD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 526972459da5594c475a38e627a5a8e304c70d9398c1e8e242ebaba00e080e1e
MD5 ba71783d4ad840ca2090ead04f0efe90
SHA1 a5805a04bb4fb7e559be0cd21badb6a95544a91c
SHA512 fde130ec250a81752b6764c0a7bdc06c0784c0a1a5b39c90ad5e3c6c90708febee8fe5180097b1be0609a4a38694b149c6e551cc05df0c95272aa53a35167559
SSDEEP 96:KgvmbPVdd+PtklFv+K9LFR+p3v8B/fs4AKdGK5uKaMy6gYKpSs:DvmbPVddItkfvvLFRU3v8B/fpwF3T
TLSH
T1C4B1630172BA23813C7F1718D1D2975BAA9231633019E52F3BED11B24E66E190EFDDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9303f6d1-e4aa-4246-b161-4b5bfb63e071.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9303f6d1-e4aa-4246-b161-4b5bfb63e071.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 56b373cf74dfce35bd3a2cdf6ee84822a0a5a19e1cdc74204d185a04f3cc61d8
MD5 3ed530d675a18adc5d7e95bac4471d5d
SHA1 2dcc4814207294e857ccf5e7c9eeca8a05eccc73
SHA512 73b472eb30a177531da1c443d3cfdd7a4726c6a8b1c548a830dbbc28e3f4aafe24c3d2059a39aa5c9cab413600f8c0bf82c3466321abccd550e574cff2dc725a
SSDEEP 384:ZtNn/s3n9SfsNm35uqTwNymkBgk5omn15wbAjEeW:Zj+9UPuqXXomn12bfeW
TLSH
T1D6927D3398781D262DE39889B14B321B5FB5C567E7C93FA4D0EC8B0C45EA3D8131A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3e071e4a0f22beac95397ead45c977abbb6fffbde882fa64c14e219b8e260b70
MD5 ad5e96a766af0114a987f96e9c695b56
SHA1 97520b1fc50fe5757ba36c1ec739c1d19573e4b4
SHA512 16d92a297bcff080c65713b1b538cfb7ed622efd989b021db27500a2f3ab83bb767a720d791284ac37b121eb2f0ca14fbbd5278beb4a98d077076567979fb50d
SSDEEP 384:jiF1tNn/s3n9SlzsNm8TUNTUlIli5uqTwNdmkBgkeomn15wbAjEeW:OF1j+96zwg8uqcMomn12bfeW
TLSH
T14BC229F248E74836DDAE4B47B37E2D165EBDC167B6852A50B3D84A0CCC962BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f81d80cbc5fd6b043201e5ed4d2aeec14c7f60f223036d19df2078ddba033479
MD5 0953e6a25848c136b708e8a62f3aa87b
SHA1 a526bd7a698acf1f124203e4fa3e467911711222
SHA512 0b6b48c9cbae91fd4812b3f447d6fdce6f4462e2c561e88c896f598695dd48c14ed7f3cb413466aa04c8a3c96b58356aacefe36c3ffc9cf0fa5720fd391edc1a
SSDEEP 384:QtNn/s3n9SfsNmi5uqTwNymkBgk5omn15wbAjEeW:Qj+9U4uqXXomn12bfeW
TLSH
T1A2927D3358781D265DE39889B14B321B6FB5C167E7C93FA4D1EC8F0C45EA3D8131AA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5698d1c6f24450ecdd770716cb3de7b36914e96f43132e6aff55906893d1ef1f
MD5 64fb0e2b58ae964be34962914741d0c2
SHA1 246c6dfd16a805cf07b62081c7b749f452562d8a
SHA512 d80fc6fed476bb86d81b0d094b37231b925d2d2f676f51b33f2835a03af88f7d3d6269ca8f98aa1ead6070ac67aac4bbb28e5d6f7dd39092b32dc89a5c6707f3
SSDEEP 96:ZqONkWQsjpfmUTmDK5ih/cIPURHl8h4otop5Z5DPBhPwivh50xy0SFYK+AxADqQb:gONS6kDfQmiUyr5Z903SQiaFjU6
TLSH
T1CC02F83568782CABDEA3AE05F48737275FE5212BEAC52FD4D5E81A0C44D724C1306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a9a4d95640fa2f2de875b6e011ae2462c23f8e653aa6f4ad630c2d8c7bfecf82
MD5 934df0209beaf5a2b61053ff4c42602a
SHA1 7cb8eae57ebbd31c4932ed1e117f2f8237179306
SHA512 902c8f771c6467f2860b8cf029af858a54270e64316a9e1ea4546396fa57cf8fb17350600d84399d5d151a178a5237a7129f25f008633765dd076ad4cf148109
SSDEEP 96:rqONkDQsjpfmUTzK5ih/cIPURHl8h4otop5ZTgDPBgPwivh50xy0SFYK+AxADERd:uONv6kiQmiUy5W5y903M6NkhcRrqr7U6
TLSH
T17C122B3268B86C6B9DE39955F08736175EA58227EBC97F91D5DC2B0C04EF79C130B422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

382b7cda-2285-408f-a144-eb4de3ffc9b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\382b7cda-2285-408f-a144-eb4de3ffc9b7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 745e89cf1b9871a66cfa16eb475ef29fc65f9c3abc197018fbcc7da020e34a1c
MD5 070c73a74838fc6d4916609e559ea3dc
SHA1 f34ed5fa5c5785951a1a8f465658635d19322b4b
SHA512 7116be77b7d97dbb49f0b67509a565462c21e95db5110f8de0cf41c5564d26f244ba8f22c00017107e3c896c5aba4677177abc3026f30d6f751234453c32989f
TLSH
T18441DC58B6E91144B3776F9A9FF6A86E447FB8772F07945D10110E4E0A62B40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download