hxxps://tarongaa[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tarongaa.com
Sample260701-rrae2sf14p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2992	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273895164038069"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{E54EF670-FBC5-4750-A809-D3E798F04794}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1304	msedge.exe
1304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 4168	2040	msedge.exe	86
PID 2040 wrote to memory of 2992	2040	msedge.exe	88
PID 2040 wrote to memory of 4000	2040	msedge.exe	89
PID 2040 wrote to memory of 2164	2040	msedge.exe	90
PID 2040 wrote to memory of 4000	2040	msedge.exe	89
PID 2040 wrote to memory of 4000	2040	msedge.exe	89
PID 2040 wrote to memory of 2164	2040	msedge.exe	90
PID 2040 wrote to memory of 4820	2040	msedge.exe	91
PID 2040 wrote to memory of 4820	2040	msedge.exe	91
PID 2040 wrote to memory of 4820	2040	msedge.exe	91
PID 2040 wrote to memory of 1776	2040	msedge.exe	92
PID 2040 wrote to memory of 1776	2040	msedge.exe	92
PID 2040 wrote to memory of 1776	2040	msedge.exe	92
PID 2040 wrote to memory of 1884	2040	msedge.exe	93
PID 2040 wrote to memory of 2496	2040	msedge.exe	94
PID 2040 wrote to memory of 1884	2040	msedge.exe	93
PID 2040 wrote to memory of 1884	2040	msedge.exe	93
PID 2040 wrote to memory of 2496	2040	msedge.exe	94
PID 2040 wrote to memory of 2496	2040	msedge.exe	94
PID 2040 wrote to memory of 4876	2040	msedge.exe	98
PID 2040 wrote to memory of 2652	2040	msedge.exe	99
PID 2040 wrote to memory of 4876	2040	msedge.exe	98
PID 2040 wrote to memory of 2652	2040	msedge.exe	99
PID 2040 wrote to memory of 4432	2040	msedge.exe	101
PID 2040 wrote to memory of 2504	2040	msedge.exe	102
PID 2040 wrote to memory of 2504	2040	msedge.exe	102
PID 2040 wrote to memory of 2504	2040	msedge.exe	102
PID 2040 wrote to memory of 2160	2040	msedge.exe	104
PID 2040 wrote to memory of 2160	2040	msedge.exe	104
PID 2040 wrote to memory of 2160	2040	msedge.exe	104
PID 2040 wrote to memory of 4044	2040	msedge.exe	108
PID 2040 wrote to memory of 4628	2040	msedge.exe	109
PID 2040 wrote to memory of 632	2040	msedge.exe	110
PID 2040 wrote to memory of 2784	2040	msedge.exe	112
PID 2040 wrote to memory of 2784	2040	msedge.exe	112
PID 2040 wrote to memory of 1304	2040	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tarongaa.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa09cac188,0x7ffa09cac194,0x7ffa09cac1a0
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,13814775499287311441,1122112178767308680,524288 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,299426567289958363,1415909350734543388,262144 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,14833791812984978058,15531184510556167119,524288 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,2294512174014795074,3071870127592452734,2097152 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,11523879759667727268,18293028163567571484,2097152 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,11591140581337050500,579138613519962738,2097152 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,5420563970600803338,10856896582219934215,2097152 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,3908136682863062676,16974895810844026065,524288 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,4227919030914979594,7040406557109247459,524288 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,8439081428320257335,296534484846473622,524288 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,8439081428320257335,296534484846473622,524288 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6208,i,17459945307354928908,9569352048816939481,2097152 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4192,i,8504429244110269877,13838363018455750895,2097152 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,1118671060367443301,8886031560247249777,524288 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,9644976693046873557,3540736627465467169,524288 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,4236329151997244867,10417706221527938243,524288 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,11906952610635757844,18296558734354296416,524288 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,7171566682954882390,12777918659642289921,262144 --field-trial-handle=2880,i,1492377509697434513,6229419876189068106,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 5180aeaf92f32e3fad63a77e5797729badf5257ef90416770fc3b523688161ac
MD5 f017ed7d647d0c0898eae65621ff4e4a
SHA1 d731523b859bd48ca0799e0582ce69637c40229b
SHA512 7a20c0c5cf287ade71264554550da0f85a7dbc8702043dc9dcec83422105719ea77020cc49c3988fcfe0ca605e63d932172e0adca9e3ce6c306ae5437c41e168
SSDEEP 96:0K7BU+hBt2uPPF6WjnU3cIcIVqB29lyV6:0Ktbl9PPF6WbUmenl66
TLSH
T128914071075D1DE0D32C07F1C9E2EE483B3946C5FB5B5E3284305A3A9B227AA264AE08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe592b1d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592b1d.TMP
Size 2KB
SHA256 f1a3dd47d2cf1c1cd754172a955bc170c7d792bc4c0861e858b1899377f32fb5
MD5 b9581be6a3653b657db3833e7b8f7f47
SHA1 560acd06531cd6f6dde4bb4e9d39d82ec2bbc8fe
SHA512 43829dbf7699f902af2818d87afa775735a3e61c549b09ecde0551f0eff778e3d24b723706790a6612cb8a107451c55a1da0eac71e77b3170a5ebdde1b4452df
TLSH
T18A51A47047AE28E0D32D06F0C8E3C6993B3583C5FB4B5F3205701F36AA267A90626F18
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 657ba12236549aa1660975c84b879a587c253c0d05a078fc467e382cf99ef239
MD5 8f6fac3165c7396ad5aa72c9b5782c97
SHA1 06b5a5152c3e9f40190d83c6823ac5713171bbbf
SHA512 a899280c4eee1cd5a3e970cf330348d0675db3b25b3804995637284d46878eead4c3739709374317f3d27a486ece2d9e8bbb308dab951cddd4ad79260e4ffa30
TLSH
T137617EF6C7F4456DCC2196F46A292E2BCE5D0A1883283C6E85E8AF1B93E2061D111A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5aff4241d03c16ac9c27efbb363472b11d81b20636e25321f5d6bce3b62fd07e
MD5 48682f128279b5d080920274ccab782f
SHA1 b6335857f724b637ec1880c901635c2e72c94d5c
SHA512 ad577b2d9c3cf487ccbdf10f1db7f08a5805da96924ee007d6ecbd53de2f20192712d9df907e9bd49042783e47b186ab5973e4ab217a4a1d45c6d598d0715194
SSDEEP 192:sxZVwqRIyyM/jK1Ml8MkYp/f4Bs2lgZVac7Idp9VwHW6+WNSVIp/Y9IeBVV4wQM6:sxZlXMS/fUs2lSQUHbV/19
TLSH
T12752E7126A349977CCDBD209FA55BF53D6F9157292900E44AAFCCA0C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a8a8a43f4c23d752174bf653cc1ba7e8808637483a09a229e0b1a84f954dc7a0
MD5 44a4fc04d011515e9a59551ef9e049a3
SHA1 9565fc95702c07f5d40ca08ae4f2c142f32a03e2
SHA512 7cd1a16ca3317a0a4027d33432279d77462382334f92593ca05362596942d8474d8a402bcbd38f730813ca3030f9afab39142a4fd75656a4c474610f2c974915
SSDEEP 192:sxZVwqRIyyM/jK1Ml8MkYp/f4BsY8lgZVMNc7Idp9VdHW6+WNSVIp/Y9IeBVV4w0:sxZlBMS/fUsRlSKnRHbV/1L
TLSH
T11252E7126A349977CCDBD209FA55BB53D6F9147292900E44AAFCCA0C05E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0ec494eb571ef61100b2cc57c2b99a247ee1bccb551d89090ab280f2af3d8f31
MD5 a4345442ed13328df5d3c77096fee4e0
SHA1 c0de38a20fb0cd4201867e4cee35be424cdeea7b
SHA512 beda1d7e97cfae1f6c8a315f34f69d6c0ae44a03df4db5070960f4a074a1973bbb92a43a42de942b957d62f776d4733f8a4ca7a3aa5e44138fbc94c5510c43bc
SSDEEP 192:sxZVwqRIyyM/jK1Ml8UQYXkYp/f4BsY8lgQ/BVMNc7IdpbVdHW6+WNSVIptVE2/x:sxZlBqJS/fUsRllBKnPHbVt/zN
TLSH
T1C652D7526A3499B7CCDBD209F955BB53E6F5147392900E44AAFCCA0C01E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 25fc50c8e5d841dcb83e0b75e9306a73fc789797b218c69b3f7c70839607b814
MD5 7f034acaf32af5d51f19eb3bed9ef39e
SHA1 68b76dad8e5291c76e409e6497184d6af22869d8
SHA512 9f66881dde0bebf80fe1bbf0ecdf809b49ca7daee7c3388dfb65299f861ca1bab7a4b6614a07a827b7053aa637665c375edb97a135113623af25e0eedaaa9f7b
SSDEEP 768:GXcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNproPg6N:GXcv21wWvu+Z+u1jaeFLeRNCPd
TLSH
T190D21A2B280CCB7E4F841E9CED2AAF866DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8821eff55b84b34eb0cbfdba72b620263d7822f47985ad6c9dfe09a366751675
MD5 91b4cda74ede2db2918195c7e20c3cf3
SHA1 83f0fc36398f47b843e8844e7a746a1d4f3d77bd
SHA512 b675977b6f72106c32bb9775c09865ff6fc5e644f78713114bc4f142eb8ab9b8aa4b63d054567df0aed9f9d9171b4d2dbc5e2086641051473d68ba022df2e1c1
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDygQKVWKsDMpdLBB9WV6wgF9K48gr9cTrC1:mTr7sDMpdLBB4V6BFX8grSTrC1BGg
TLSH
T12A91864A703B0693387E684CA361957A4E8231A37458E8BF7FB810614F27E559DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9b8d07b5ee44b7ef2ae27fff2f00f05d5b9fa1edba5c692b5d7271c228920f15
MD5 502773fd8767b7fb3ed3fe779b572387
SHA1 a473a769f67ba7a3014a3393197af71d52025161
SHA512 05c3d62d5a09680196b10f8ba388e1782b9e1692246a6e4879c65a8caf27573bdf7187e8e7efa8f1981d73ea9b65829e9be048fe344966244adc44e9953e351b
SSDEEP 384:EtNn/s3n9SvzsNREevOziiiT2e+CfOESJrJ6X0IidKzv6FxR5:Ej+9IrUTBnOEShJ678Kz2v
TLSH
T171B207F258E70976C99E4747B73E2E175E7CC167B2452E50B3C82A0CCD8A2BFE206516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5eb3ec289ca814b90049012b82cc0d1af7a0877104bc0adf7fc0b18fe2fc5f3b
MD5 d2eac11493cd502076338434029695bb
SHA1 9920f23538a44426b106b3e1cf237056cb454fee
SHA512 a78a17bc354442cd6405d9dfdc92b78d4743d8c66fc09d854c3846e283326420053e0d2f2bc2813ae086faba623c1fb52b494fd7b590d0e51f5415498bd7d9e5
SSDEEP 384:ytNn/s3n9SfsNREevOzii5T2e+CfOESJrm6X0IidKzv6FxR5:yj+9Ur7TBnOEShm678Kz2v
TLSH
T10B928D7269381DAA4DD29584F54B3B1B9FB88277E3862F90D1DC2F0C06DB79C230A516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 cd5edbc8be051a678b4b0baa5fe756202abb6f362a32bb7c784badafd5d58563
MD5 4232286820e2fb4667e9e1fbefa90471
SHA1 802e9765fa9279721729244e775541a97b61a619
SHA512 a3a902ba9618b564e685f82a711c40be9db84a1f089682cd96c2f4702698cccff652a4d778af0df09934a903f092a922f78c7402d4ca828d75035162bd5a25fe
SSDEEP 384:htNn/s3n9SfsNRPevOziiWye+CfOESJrm6X0IidKzv6FxR5:hj+9UGolnOEShm678Kz2v
TLSH
T1A6927D3269781DAA4ED25584F54B3A1B9FB88277E3862F94D1DC2F0C06DF79C230A516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9d3e62a2d6e8e01b0fdd25b889a76bf7fab132484a8d9340716060ddbb5de80c
MD5 0601eedcb1d8855a88b40d7308740404
SHA1 45e7b5fa1828e6e8e54c2aa0b96fd6bf63b09c26
SHA512 e46bdbf7623715862765441dcc289c3adaf2f98411300e41d5d67d8ce84abe21a50d75c13c23a7d52792b9b47fd39f3816333613d0cdc25acffda7d640f1f355
SSDEEP 192:JONys6v+YLNQmiUyVNVSZh+CGSOImWusiI4U6:JONys6vz/NZh+CfOuOU6
TLSH
T10C02FA35AD682C6B9FB2AE45F58737175FA8213BE6953F80D9D82F1C01D774C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2e9f89a1b60277e6abebdff62d882e8d5d1971758444a2242c1fe22b2f683733
MD5 b9fa9f70935bd3822e2d7a5cd286ad46
SHA1 d767250a9247e127f86fccac2097ce0c0673b17e
SHA512 2afd905eb04cb6832ddad0bba82e98d40dce46fc4480ea70e6be1c9b573812f38ad72059c37ea72be6163c87fab493ef29151aa6b496e50cf8d51dad3699596d
SSDEEP 192:fKONrY6v+YLtRQmiUyVyVSfmh+CGSOImqnSJrBCHiOqxU6:SONs6vz9Auh+CfOESJrG6U6
TLSH
T141122B72A8785C6B5EE2A544F48736179EA85137EB893F90D5DC3F1C02DF79C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d517cc0-71a9-474f-aa8e-2063a08a5626.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d517cc0-71a9-474f-aa8e-2063a08a5626.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b22cfd7dba35f9dcf8d12037f656da087388405ebc62e8ebd1dad4f9ab2bc2fe
MD5 21b5c3177c1c1de6e3d56405814f4ef5
SHA1 bde6e95d6737fd22d1a25bae6f50b108f23e23ee
SHA512 d3774d7c780f4da30008eeaf2d48226c78d5722bfaffba4edcef91f1a68cf4537487b38d345678fb1d2a0e32c55ebc83090a5215b5be03b0a5034bccc1d08dfe
TLSH
T14B41D698ABFD1148B3776F5AABF6986D547F78772F4A909D10110E4E0A62B00CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download