hxxp://redjezelfps[.]info

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://redjezelfps.info
Sample260703-rwallsaz71

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3460	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275627330809812"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{CDE8EE85-AD4C-4C25-A79D-A64B96172700}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 4448	1820	msedge.exe	85
PID 1820 wrote to memory of 3460	1820	msedge.exe	87
PID 1820 wrote to memory of 2824	1820	msedge.exe	88
PID 1820 wrote to memory of 2824	1820	msedge.exe	88
PID 1820 wrote to memory of 2824	1820	msedge.exe	88
PID 1820 wrote to memory of 3532	1820	msedge.exe	89
PID 1820 wrote to memory of 3532	1820	msedge.exe	89
PID 1820 wrote to memory of 2212	1820	msedge.exe	90
PID 1820 wrote to memory of 2212	1820	msedge.exe	90
PID 1820 wrote to memory of 2212	1820	msedge.exe	90
PID 1820 wrote to memory of 4472	1820	msedge.exe	91
PID 1820 wrote to memory of 4472	1820	msedge.exe	91
PID 1820 wrote to memory of 4472	1820	msedge.exe	91
PID 1820 wrote to memory of 2792	1820	msedge.exe	92
PID 1820 wrote to memory of 2792	1820	msedge.exe	92
PID 1820 wrote to memory of 2792	1820	msedge.exe	92
PID 1820 wrote to memory of 2300	1820	msedge.exe	93
PID 1820 wrote to memory of 2300	1820	msedge.exe	93
PID 1820 wrote to memory of 2300	1820	msedge.exe	93
PID 1820 wrote to memory of 1492	1820	msedge.exe	97
PID 1820 wrote to memory of 1492	1820	msedge.exe	97
PID 1820 wrote to memory of 1492	1820	msedge.exe	97
PID 1820 wrote to memory of 3964	1820	msedge.exe	98
PID 1820 wrote to memory of 3964	1820	msedge.exe	98
PID 1820 wrote to memory of 1140	1820	msedge.exe	99
PID 1820 wrote to memory of 1140	1820	msedge.exe	99
PID 1820 wrote to memory of 1324	1820	msedge.exe	101
PID 1820 wrote to memory of 436	1820	msedge.exe	110
PID 1820 wrote to memory of 2080	1820	msedge.exe	111
PID 1820 wrote to memory of 4844	1820	msedge.exe	112
PID 1820 wrote to memory of 2708	1820	msedge.exe	113
PID 1820 wrote to memory of 2708	1820	msedge.exe	113
PID 1820 wrote to memory of 2864	1820	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://redjezelfps.info
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa306cc188,0x7ffa306cc194,0x7ffa306cc1a0
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,10874415710473151295,4197729304502426221,524288 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,14181102120184297666,91260666856485433,262144 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,3875587661198273630,12047996585363769146,524288 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,9994101871595567614,5968090505148711400,2097152 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,12208239219187418047,8623413784846807066,2097152 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,18009544768324285007,17316375364849382675,2097152 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,5163920232863306915,2000618945804837463,2097152 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:2
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5012,i,3261231556973489222,8992107805738295385,2097152 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,11790526861075769290,5289390425272017458,524288 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,17117387614544039786,10149250601970939293,524288 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,6223696823213361383,16157325024931302360,524288 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,6223696823213361383,16157325024931302360,524288 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,12844613888886809029,9122242413344821980,524288 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,13430838558960302372,18358273631725965747,524288 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,2224915735653377828,10977548115797145961,524288 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,13319093459310426510,5333085269366007730,524288 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,1956387789349090847,1212369169838970640,262144 --field-trial-handle=2312,i,8066313203653728616,18272222089017733635,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ddef50ef090134b2a82852919a1d8e8d021049b3b0d2546d38cf2ee34be33f64
MD5 9b6d568fdddcecb0ef8ea06bfd8e9c63
SHA1 eb5804d64b8799bebd60a5e71c735e16349c00df
SHA512 5f1e5c52b87da79acbd56d3fae0d6bd02a5d4d4dc0bebcc71c20c15d43489afce01fdd088b804176f4362e6a88b2f6d8053831be3e4c96befecbfa94af389a69
TLSH
T13561B5183E924B51F3320973E4E91275357C51B88D33DE55C290B47D9617B21AFE94CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58702a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58702a.TMP
Size 3KB
SHA256 8d08f56735c7303795816cf03b91c929925804c1e9799ff18ff6a0da7e096177
MD5 c9d905fd15e5e1225b156e585209aa8b
SHA1 4aafc547e0c0671d1f5cfbf9f31eb2caeefc6604
SHA512 40d99ffb6ae07cd9760e47e35c48a4a2e289d9acda37752d2e1565c2158c12728a3e4cbc5e7b917f25bf2942ebe7184efa523ca0a2ec3741f46e433af7d1942e
TLSH
T1FC6194183E924B51F3320933E4E91276357C41B88D33DE55C290B47D9A27B21AFE94CB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4a7dd9d9de2b983572363469cf34eca3b46575c1879d6ba942aa4800c9cd1778
MD5 1bf532fc6b9897b86f2611cc67cc3d5d
SHA1 eb6eb61f19b51e6a58719a74aea1a905c628937b
SHA512 5091654326a6456f12588900778833a4421c104c80c3e9869d657d4122e0403fbb12b967f2f60ec5bb556b4891a68beacc87700a49b68d1b6540a5dd8622fb2a
TLSH
T14E2198F387E1C66E890513F09A28AE1BCE1D0515431C3D5989E4AF1BD7E3475E102A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b40b8dc426aa8e373147e475bb57fe34cfe87d1e248276bd0f9dd1f6e8a98f73
MD5 94764c0cd6208e45ce8aed0c18b6e537
SHA1 ba2cd5a3ecb7e643351ad850f0f400010137ba49
SHA512 cb2d3c8f4f830fe4d0fa61f0a449ebc59ffb28b3a00545e2632a33be746ee96bf4a049fc0ad8ad156902c13978f14181797b4ab134c49699b131cb5d597417b5
SSDEEP 192:sxZ9EaRIyM/jK1Ml8MknZ/fHExs1VbZMIdp3lZHW6+WNabn/YLevBgIgrJ:sxZKayMZ/fkxs1dzjHb4/q9
TLSH
T14352F9126A34597BCCDBD209BA55BF63D6F91472E2540D44AAFCCA0C04E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d044e09169332f233c05b57f5b88a228a1e9daeb5cd1d4d723b0c9629031fec5
MD5 7a03bc385ebe4a433e1f01fd9a07bcad
SHA1 bb7ed6e43788543f3ee9b76eb2fa7374bcfd951c
SHA512 8992c39db6007e8e54b75606d278e32fca40afb0d391b7fbbd9ad0b432a079e1aa62219051d31fe1ed8691eb1539ee1d884c1cde420268ccd9cb787ab03430fe
SSDEEP 192:sxZ9EaRIyM/jK1Ml8UQcknZ/fHExs9VpZMIdpdlZHW6+WNabn/YLmHiPgIg5CJ:sxZKayqnZ/fkxs9fz5Hb4/Rx8
TLSH
T1AE52F8166A34597BCCDBD209BA51BF63E6F95472D2540E44AAFCCA0C01E3BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4e25c632fc4c415e64826793095c70044b66f9d9c9567a3dd2a45cd93cc6c1d5
MD5 482224db6652359da5cfc82f49bfc20e
SHA1 e3b18d114be6ffd6ace37f71d27b76388d9a7cd0
SHA512 8597b47cef8c57d13efb34f018b52a23ed09b0d5a7d5b24739573f2c3b353023b3a0ae737f85298199a4ea6572e6a02a510e56276466f52771edd6d114bba013
SSDEEP 768:9ts6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJN2roya:9ts6pD1WvxzWju1jahILIsNNya
TLSH
T17ED2FB3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 901063127159d8567b097c5ca2c9f059708549f4d3997936c6acfabe14657833
MD5 961e4c691ea1b71ba0b612c56955d359
SHA1 e6fa83a86ccbb6bac667c45ce7dbda806d5e1e04
SHA512 371eaf05858812d7611dd3347919fb4c3b1a06fe5cc1992bf0e8a91cab7a0e1e3ebe36efc19f5d2392b266043c2c55439e61266ce865a65c122f3768b3b3b131
SSDEEP 96:KUAAKteP+y52KakSa2oKDilBgBRBkBQBiB7:iiy9PUBgBRBkBQBiB7
TLSH
T12EA1160632BB12433C3E2958A294C7279746B1B33158B82B7BA851724EE7E344DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590c4b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590c4b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 372cd917b2c9b0c68318d0e7883f06b97ae2373a82585ae930ea53ff2a3daf1b
MD5 aa615164c20590646736516f218f106a
SHA1 13c4c24ce0d83101bcabef999978adb04abf02cf
SHA512 3209e84efb749b551cbea70f6afa5b2e910a65d851e19acce0548fb9b46df8f2938211254d245594c92d14c0d93242372162cc502dbb189b045313fbe5c98358
SSDEEP 384:KtNn/s3n9SfsNK7kZ+FKzJZa91ONMGgzJrDCOObjI9G6w7OC:Kj+9U54sPO5EhDC29Mz
TLSH
T103928D3268289DB74DF2A154F987392B8FF8417BD6862F84D4EC6F0D01DB6AC1316D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 e4681a34b6f7dcc0e41dda0bfe3411c42a340ebc94589ae2924155aa587d6ff2
MD5 e339dc36ff33cba979e46e99cfd3db71
SHA1 de39c20da240a0203843822badf22e2a07808ede
SHA512 816d21601f540b7cbd34664eb06e99d92972e4e01cc50dda7459af865ec09c21dae910c5fdef6d70da60180e66a8f4e6ffcca1e1fba21578e860b0fbccd936aa
SSDEEP 384:gjiF1tNn/s3n9S/zsNS8TUNTUlIlgkZ+FKzJZa91ONMGgzJrICOObjI9G6w7OC:gOF1j+9kfwg64sPO5EhIC29Mz
TLSH
T13EA26C335858CE7B9DF69A84FA4B362B8FF541BBC5862E84E6DC9E0C01DB1AC1306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0a309ba326dc010c906c01bd8209c15a4e1a6b4b149e17e205ef56f982ff25dc
MD5 8b4fe1c681a5f7dc7eb6ddbddcc10ac9
SHA1 23cd89a54cbcbc001357aed3e9caf7ebd7903bd5
SHA512 9fe02d2a086f3903c67726e92851f6ed0a9b519d6156298d79efb782fc9a27ba1d62875537c34a8eb9b9df8f31fad22c66c53cafe4bbf2ced16cd0a38b8c7289
SSDEEP 192:qON86O7+3hQmiUy/hGttb0oO2bKh2hgGG+RU6:qON861CGt91ONMBFRU6
TLSH
T18802E8356C386CB79EF2AE05F68777275FA5112BE9962F80D6E81E0C00D765C2346C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 60c8a023f525d1888d367d5e5b0fd0939487d1b75429ee8cf56f6ed5c2df73f9
MD5 3153eef2c30620bc3e8034137bcfe218
SHA1 6f43b38af68836ff3fcbebad5cb5a45f90ddd7c3
SHA512 3c78f18f0c6f848a92ec07556b1db2a2f74c9673c6d84a5a019935253d236180b6e9b9262500db87c52f1151b6424fd84cacd8501e929c4ddcf0f8f7d8aef3ca
SSDEEP 384:YtNn/s3n9SfsNKgkZ+FKzJZa91ONMGgzJrDCOObjI9G6w7OC:Yj+9U64sPO5EhDC29Mz
TLSH
T19A928D3268289D7749F2E144F987392B8FF8417BD6862F84D4EC6F0D01DB5AC1316D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 63071b4b0d3e4fbeb343229b3639530f69dc381f47862d20fa3e304b30c06f4a
MD5 3dc97b3cd9831d82910b16371e0fed90
SHA1 19f071b63ecb3a18dac433609f6ae257e8d9fec0
SHA512 108b37cf2af2b3f049ff21be4a20e030f734374564c63b970ff34b48f2b0d46c4c8c9ea3f8e1fc9a0c379eb6fedf3c3b6f605a13148fcbe639c5e7e2f258d065
SSDEEP 192:SONb6O7+3+QmiUyhhbttb0oO2bKh2GkF0SJrOcNmqvWU6:SONb682bt91ONMGgzJrfCU6
TLSH
T1BD122B3668389C775DF2A141F98735238EB5412BEE8A6F80D5DC2E1C01EF6AC234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 030d0675de43da6e611b289df3c876eb8b372092cb366f80b41f22e59300cbf4
MD5 64cb928281e0c0820814430ff4eaeda1
SHA1 c9fec96c88cb21d290be6a0c1ce8a25b4a28874c
SHA512 320250edbc7f5f38b0195fe4917bca15a93886959ed381ed1339d52d0424ddd13f56a3f2fa7ac2fff570460b26025bf9230ace50b75a361d53dbf7053394fb3f
TLSH
T1CC412658BAED1158B3B7BF56ABF6A86D487ABD372E06955D10010E4F0A72F00C8A1733
MD5 SHA1 SHA512 TLSH

Submit Download