hxxp://afqehgohw[.]com

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://afqehgohw.com
Sample260701-eptppafz41

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2856	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273524534400030"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{158BA79E-0248-454E-9BA6-9166F819115D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5832	msedge.exe
5832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4636	4116	msedge.exe	85
PID 4116 wrote to memory of 2856	4116	msedge.exe	86
PID 4116 wrote to memory of 3220	4116	msedge.exe	87
PID 4116 wrote to memory of 3804	4116	msedge.exe	88
PID 4116 wrote to memory of 3220	4116	msedge.exe	87
PID 4116 wrote to memory of 3220	4116	msedge.exe	87
PID 4116 wrote to memory of 3804	4116	msedge.exe	88
PID 4116 wrote to memory of 1676	4116	msedge.exe	90
PID 4116 wrote to memory of 1676	4116	msedge.exe	90
PID 4116 wrote to memory of 4440	4116	msedge.exe	91
PID 4116 wrote to memory of 1676	4116	msedge.exe	90
PID 4116 wrote to memory of 4440	4116	msedge.exe	91
PID 4116 wrote to memory of 4440	4116	msedge.exe	91
PID 4116 wrote to memory of 4580	4116	msedge.exe	92
PID 4116 wrote to memory of 3056	4116	msedge.exe	93
PID 4116 wrote to memory of 4580	4116	msedge.exe	92
PID 4116 wrote to memory of 4580	4116	msedge.exe	92
PID 4116 wrote to memory of 3056	4116	msedge.exe	93
PID 4116 wrote to memory of 3056	4116	msedge.exe	93
PID 4116 wrote to memory of 400	4116	msedge.exe	97
PID 4116 wrote to memory of 400	4116	msedge.exe	97
PID 4116 wrote to memory of 400	4116	msedge.exe	97
PID 4116 wrote to memory of 3648	4116	msedge.exe	100
PID 4116 wrote to memory of 3648	4116	msedge.exe	100
PID 4116 wrote to memory of 3292	4116	msedge.exe	101
PID 4116 wrote to memory of 3292	4116	msedge.exe	101
PID 4116 wrote to memory of 1256	4116	msedge.exe	103
PID 4116 wrote to memory of 5616	4116	msedge.exe	117
PID 4116 wrote to memory of 5624	4116	msedge.exe	118
PID 4116 wrote to memory of 5632	4116	msedge.exe	119
PID 4116 wrote to memory of 5176	4116	msedge.exe	122
PID 4116 wrote to memory of 5176	4116	msedge.exe	122
PID 4116 wrote to memory of 5832	4116	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://afqehgohw.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffc12efc188,0x7ffc12efc194,0x7ffc12efc1a0
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,2072192490311682473,12782465178743624688,524288 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,11531186728599157798,15324485681301783055,262144 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,16053582035756488662,14739504910327375678,524288 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,8222684240585190016,3444351619062057308,2097152 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,4644240869801344426,812552226329386337,2097152 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,4266036972991752495,10267066510127569432,2097152 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,9698446506263265062,16576703795907081096,2097152 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3716,i,16207041908880770615,11789476679515544419,2097152 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,2342593388962480956,400925307706755542,524288 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,1259353777054532213,4237333226027775906,524288 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,497045001535964806,15528996730079317810,524288 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,497045001535964806,15528996730079317810,524288 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,3854799021802046586,6527701271292729250,524288 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,2301651561414588042,10662221893266966627,524288 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,16347179731690155871,11783508490079157407,524288 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,3074107691172644366,13692641710710457548,524288 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5052,i,1448950020782212222,14476131666290066657,262144 --field-trial-handle=2340,i,15476691842270765068,1054039779792018439,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

3b77cde7-1a1f-4f4c-9317-924b1a2f23d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3b77cde7-1a1f-4f4c-9317-924b1a2f23d8.tmp
Size 30KB
SHA256 94848fcf6783d513b5f04b26dc9320868930f002d5309de063b0af4afcb49353
MD5 f4b1c3a9eb6b812dc87fedd7f60887e6
SHA1 36b8cd09b073f0ca9e0217ec353bc661f3dbc39d
SHA512 c46fbba01828c038cd060f83933ee359be4d7214b3af858a795c4f9c78cf15f62b0fafad646268b4564bd0264f4eadfbbce52158f0a8c800fc31940f5f6a6695
SSDEEP 768:cm8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdjrojkyUn9:cm8iJPNWvx76ru1jahALocdQVU9
TLSH
T140D2FA3B680CCB7E4F844E9CEC266F966DD801CB6B944D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 50d5942bdb7843d2d1216787874b81bc2d144f4854f28d933e9ce4f0fbf67d0a
MD5 e893055e42f7456b41945127aa7657d2
SHA1 15e084912e104735c08fcb513b4a6a6aacb6fe4c
SHA512 a9ce2a3879c424e39c0cb791c7376549002c670141e18e3d5cbc33b87d6712d04dc4b36e17537d6d3be9dc52ca444dfd4bb5b6b2c85c9b4def7c9a2b4cc2a519
SSDEEP 96:JU51B+lLpDHMM4v8MVYJjbR10hikoL7+FzK:JvrQMs8MVYJjbRq0JL7+Fm
TLSH
T13C81C51842A274A1EBF019F0E4C61625767D47DF071F5D4208A8CFBD6EAA394B2B178B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ecdc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ecdc.TMP
Size 3KB
SHA256 52197acc8d25ee28e3cf4417af410f7edc1b6df6953a46708ba09433697af432
MD5 8dcbb1f8d42dce011066a83db4999e09
SHA1 a6392045e1d76160621d32819004584b3c1a61ee
SHA512 102999f07253953bdccbd89d6eb24365411f463a04f43148be21d87b2b9d8e9604d802b83a66d84b949c74e8a1b16f8a18271f360bb9362c1f420f1ce2fc79d4
TLSH
T14071812842A23461EBF41AF0E4C31205B47E47DF0B0F0D45189C9FBDAE89364B17178B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 871cc2a202c6675706802140d9c9b82d9ecd288f4a684cac3cd79a21fb8eadbe
MD5 bfb34ec106c1e42c083227b4b956e49b
SHA1 d84d18b60028ef8e4c0e40d148111ccfb2b0e68c
SHA512 6bbdc410f3c8f9ebe148fbaea159320f7087c8a86ca5151de0c54c93e54ddf5d21a2f3bf670a6f779cdd1eaf4da7f8d7c315e6a13bce416ce091aeba7feec777
TLSH
T1C75158F757B1896EDA2299F09E14EF1BDE5C0125432C797689D0AE13D3A3462E005B4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dfa749310deb2fcdc1a8797b7a9ba6acd0ce60011d7c93ff51544f68adeecd2e
MD5 7df61fcda28f300012975d3ef5e1ab18
SHA1 142401c37d63b0dde3e1f389583e5b4cda63e976
SHA512 b1eeeba2002cf22cb9b38f030ce61c21b98b29c68956ef63fcb2c7e4878073fd60a7ed90e706fd2015549de7ea6b2f44b307f95a0c836c8ce70171e42efe44e8
SSDEEP 192:sxZVVDRIdyM/jK1Ml8MkYR/f40sjLoVk0IdpkV2HW6+WNTV/2/Y4rVVCEcV+ELn9:sxZTaMS/fFsj8q1HbM/Qn9
TLSH
T1B052D8526A345A7BCCDBD209F945BF53D6F51472E2900E44A9FCCA0C05E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 53546e24714d10e3b2acad83dda181c7ce79e5806eafaf9a29dab4ef766c9eff
MD5 31afed167496c583ff8a3984c4678a21
SHA1 5711b81259429ffe585ac1d0fef7da7d93b93783
SHA512 1dab7708729c40d0c6395095c3f19b28bbeb45684bc6c4098a5575f4b6e1c0d34e39b5b38d91546f1f2468b4d4a2f314ca8cc740ee7588dc95239ee7f9d778c2
SSDEEP 192:sxZVVDRIdyM/jK1Ml8UQYskYR/f40sYhLoXVk0IdpmV2HW6+WNTV/2/Y4rzOVjE5:sxZTaqSS/fFsOCq7HbM/xIne
TLSH
T15952D656AA345A77CCDBD209F941BF53D6F514B2E2900E44A9FCCA0C05E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a23e5a4d448065ab64b28bc2e7a480b1f8b605d1a36986b6f1426dac39966bd4
MD5 154b85ccfc62670f3f2de4491fef431a
SHA1 dcc92ceaefe755b534596fac28fe980236a8205e
SHA512 bb690b3329d37dc0891cc7c299ba28518c5a9c1f5ce0f72935c495f3f8d7efbbe11bca07b50d3bcbd7e068146661abf3d97ddae72604f9e67f7cc5a06e3e85a8
SSDEEP 96:KgpiKKwySioKLCCWRyKCsmYp8IamqwWuzjgwwK4lgSwcgwDyYdg:Q5vvppYp8IamqXuzcwElgSPgwDyYdg
TLSH
T159B11101717F06422D7E690D92B08B674781B1A37068E83B7FA911754F2AE264EFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5973bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5973bf.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 12202df9fdb415f823dc1fe9643777a1818f9cafa6f5b9b00bf259ac7056b9c8
MD5 cc1f4a3299343c7fafa6795d60764c2a
SHA1 0c80a451b909ca58c6f50ead4174d25c029c00cb
SHA512 eaf6dcb7f5d33afcfe1e73634aacb389cc912f6f8f6be9f0dbc720eafd75262e21bbbb3c65c6027dd616ef0351e33b2c7f9b68a297390b7e740f703c9461aaaf
SSDEEP 384:9tNn/s3n9SfsNGUdbTrUk/rqZTmX0IidKzva0xRW:9j+9UKAZTm78Kzacg
TLSH
T1C1929C722C786D6A4DE39489F5473B279FB881B7E7852F90D1EC2B0C05CA39C630B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cf0e9f321c08941d379fdc31501dba517b6b7d49b381f33befb8105e0c5ab1d2
MD5 f21941f85ab65276c11ee8e16b70f7e5
SHA1 85da8dc6ea547814d15e41a804747d42930b1a4b
SHA512 6cb2a5ec5e7e03ac573fc959fbebbe8dd59559f33f9bdd800970d7a2d052edbcb90a154aa43f044bbada45d02a817668f76eea614695655ee7773602556522b2
SSDEEP 384:2iF1tNn/s3n9SPzsNL8TUNTUlIlobTjUk/rqyTmX0IidKzva0xRW:dF1j+9kKwgUAyTm78Kzacg
TLSH
T1CDC229F208D7493ADD9E4B47B73E2E138EBCC163B6415A90B3C85A0CCD862BFD206905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 11b9f87f7cbcd82c18dc766f00124ad26c2990a8cbb6673546d9a1a68aca2818
MD5 457ce46fe401f4668684a02bcf45e4d6
SHA1 7c32e9ca0c1cb097ea6be62ba2d5750f4deb267e
SHA512 7f8672e93681db36902208bf66a5058c26fce292d1157a7b698f2622bfcad74d8719412ff66d5582da20deaf2d4959cc0eaf9d765b77d5f816b757fc2748f70b
SSDEEP 96:ZqONk3QsjpfmUTmDK5ih/cIPURHl8h4otop5Vb5DV3BhPwivh50xy0SFYKQAxsYY:gONz6kDfQmiUyV9VxZ9036TQiil5U6
TLSH
T13A02FA3568786CBB8EB3AE46F48777275FA5212BEA852F84D9E81B1C04D724C1307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d1fcd3e3ffa249b6880bf92c184f7080db9296ad9994823f192b1e8f6f130ab8
MD5 f628a7e35c32132d166493ad5b62857d
SHA1 9828d68e6eea21077adbf10c2c8af3c9fc608a9d
SHA512 b46b9644c0f8e8b4b4e385fd7e93104649b98b3128e1a0677f9b80585b1e9368c5753e653baa919a24ff801397164055a9897e9d34d50a79b6a80a644531cf84
SSDEEP 192:fZONrA6k1XQmiUyVSVxfs9036r1EYpcRilqlmU6:BONE6OL09/rqpTmU6
TLSH
T15E123A7268B8BC7B5D93A841F48736235FA59127DF896F91C5DC2B1C05DB298130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0ba73c7e6f70b84c3daced2dbd3bf6575536bcaeed8b09e1591abb6869cd8251
MD5 ad551e38dca16fe515d4509b87029323
SHA1 2877c04437788f27839c4636fb2c53b69a1466d4
SHA512 a7bd102c24e705c2e7f4c7fd56db5781e96e6431cca3255adf5cd3d44914e29187476c36632fce753cfc5f0783769e70226110ad26d3ba49dd267802a0fa04ba
SSDEEP 384:LtNn/s3n9SfsNGUobTrUk/rqZTmX0IidKzva0xRW:Lj+9UnAZTm78Kzacg
TLSH
T145928DB22C786D6A4DE39489F5473B279FB88177E7852F90D1EC6B0C05CA39C630B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f8b40d3-628c-4341-b24b-06e4ed0bed0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7f8b40d3-628c-4341-b24b-06e4ed0bed0a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5e900da2fe02fa36c604a40c6a47d8c3e9dd6445176f176b7ce344c621d6f0a4
MD5 0d153d182393bd1ebf56e104c74dca03
SHA1 1c7b0bb966d256e005a343e72248641d713c09cc
SHA512 1a5e4211367cb8719279e7e20cd2ce75cc0883ec5d57cc7253d0951efd0f745cdec96119951b8e7f04344bee0c753dc3090c6123c8a49199906413fac52a4521
TLSH
T118412B58B6F91148B3736F5AAFF6A86D487EB9371F06D45D00010E4F0672A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download