hxxp://www[.]eleven-app[.]99jobs[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.eleven-app.99jobs.com
Sample260706-pp6pcsfs4s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1608	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278146908570869"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{6ADBB1FE-7217-427D-AA30-753FA914D0E3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1904	2088	msedge.exe	86
PID 2088 wrote to memory of 1608	2088	msedge.exe	87
PID 2088 wrote to memory of 3336	2088	msedge.exe	88
PID 2088 wrote to memory of 3336	2088	msedge.exe	88
PID 2088 wrote to memory of 2324	2088	msedge.exe	89
PID 2088 wrote to memory of 3336	2088	msedge.exe	88
PID 2088 wrote to memory of 2324	2088	msedge.exe	89
PID 2088 wrote to memory of 4612	2088	msedge.exe	91
PID 2088 wrote to memory of 4612	2088	msedge.exe	91
PID 2088 wrote to memory of 4612	2088	msedge.exe	91
PID 2088 wrote to memory of 3252	2088	msedge.exe	92
PID 2088 wrote to memory of 3252	2088	msedge.exe	92
PID 2088 wrote to memory of 3252	2088	msedge.exe	92
PID 2088 wrote to memory of 3332	2088	msedge.exe	93
PID 2088 wrote to memory of 3332	2088	msedge.exe	93
PID 2088 wrote to memory of 3332	2088	msedge.exe	93
PID 2088 wrote to memory of 2756	2088	msedge.exe	94
PID 2088 wrote to memory of 2756	2088	msedge.exe	94
PID 2088 wrote to memory of 2756	2088	msedge.exe	94
PID 2088 wrote to memory of 4552	2088	msedge.exe	98
PID 2088 wrote to memory of 4552	2088	msedge.exe	98
PID 2088 wrote to memory of 4552	2088	msedge.exe	98
PID 2088 wrote to memory of 3640	2088	msedge.exe	102
PID 2088 wrote to memory of 3640	2088	msedge.exe	102
PID 2088 wrote to memory of 3688	2088	msedge.exe	101
PID 2088 wrote to memory of 3688	2088	msedge.exe	101
PID 2088 wrote to memory of 3864	2088	msedge.exe	105
PID 2088 wrote to memory of 396	2088	msedge.exe	112
PID 2088 wrote to memory of 3184	2088	msedge.exe	113
PID 2088 wrote to memory of 4364	2088	msedge.exe	114
PID 2088 wrote to memory of 1884	2088	msedge.exe	116
PID 2088 wrote to memory of 1884	2088	msedge.exe	116
PID 2088 wrote to memory of 3444	2088	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.eleven-app.99jobs.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffdc880c188,0x7ffdc880c194,0x7ffdc880c1a0
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,14770926110413952723,11524490237409830180,524288 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,806066831434637621,7884348331102316172,262144 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,10064524841155409413,8595458163590129411,524288 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,7144330436927986723,6947662140658189525,2097152 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,7920278540954447846,12439003762322521110,2097152 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,13613063213329351256,16776867209002428648,2097152 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,5242738694144077583,11119882295187640599,2097152 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5080,i,17933298528146884270,8652695458075642123,2097152 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,9949965077152750559,15386635921183512832,524288 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3384,i,48883090911838803,10732944916290898074,524288 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,8601699623159187691,7173295349703188261,524288 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,8601699623159187691,7173295349703188261,524288 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,11504783003952278551,114664747925401717,524288 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,2013198551687388539,565523731338623138,524288 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,2172197598921386341,84411726519266719,524288 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,9626137594096141034,15868407595641393649,524288 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,17607017155685844740,12284385336443480856,262144 --field-trial-handle=2300,i,3319339291096331786,14008297083933725317,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3b5feef9f365b5d50cef7e231fe313cbdcb8120f3be8092c92f7bba691a3cbf1
MD5 001545c635c6acfa3bd3749976409937
SHA1 900e292b56f77806b685743a45d17cf5c4a966a3
SHA512 3fa241a6e71020df1f48132ec1ccccddcb819888fbcfc4ef2d6781d960571e4a596ce6c6d4711b054aaaccaaaa791e698749a2b0bc559d0b4609476f58270848
TLSH
T13A6139850BA2F46AEBEB31B0F0DA03077D31809A06775FD6028C8DBD690DB15FD657A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a738.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a738.TMP
Size 3KB
SHA256 7c7526504085dde9c34eb44503c4a0361ddf16ebba800cf2750161dafbfedb64
MD5 649f8b8429b40070e76e256dd4e6478a
SHA1 40fbdc7cb182afa80218820e44889f3e45b6b3f2
SHA512 7c8f7a354d66f13b5aa73168b95ee9cf1be066463ae2273c39d2d19a1e2e3e2537c455db629aed312a3dc77bd91374f51de98156dc4e43fb4ea996560968c8cd
TLSH
T16B615B850B62F469EBEB30B0F0DA03077D31909A06774FD6028C8D7D590DB15FD657A8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 e12bb9b802e110f7610bfc36d9346ca138dab19dc64b7e2025163ae42f4b6e7d
MD5 c083cf2a7bf56f5994b9340aff42665b
SHA1 523831e3fed1c6cd61c49329ff793dca9cc55eb1
SHA512 d2f15ae8a5980e64aa376d7f8a064de419867f99c92d19982ef5a94ab9b2ee2cd71d9fe7027c14d898cff4e794155217d7a988b5f72c2d30f61c973f3bf3c94d
TLSH
T124117DB3C3E585AE890156F06A24AE2BCE2D0605431C7C5995D4EF2B93E3075E00295F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b076e70d-b999-4407-94b3-78b53cad406b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b076e70d-b999-4407-94b3-78b53cad406b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6264836b87e6b3088d6ae4d79bccb35fc8a779ac411fd7b6b740300120daf03c
MD5 b5543a267b88555f492d90b31c47ecfa
SHA1 2f14cca795baa151daafcd6367e63de9b20fb1d5
SHA512 8b44573e86fdc0ecc8118385456cd6ef2969bf53d8a40cd5c3ea4293603d70ffe800efd2a49d7fe000bf864c30f39729e834a4b937a38a67407c16142480c6e2
SSDEEP 192:sxZvR/VyM/jK1Ml8MkEJ/fvsBksfhIdpCuHr86+WNGYwKNusIgrJ:sxZvppMEJ/fvsuQKFHZG49
TLSH
T1C552E8526A34597BCCCBD209FA55BF53D6F50472A2900E44AAFCCA1C05E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fc41b02b86bc6150f46dd0a6f22845a4c8e269aa12994197e8a9e5ef8a53c8e4
MD5 0e196b5bcfe05b63ff7f708e0964cac9
SHA1 a605ea55a714b95571544d3c36a5b59940f18776
SHA512 f8e9e287f717d8ec98898ad9d16ffd321da21d4d0e3f87ed7628123e09bf69b833a2cf93bc6ba087a6bbe643a116ca066d9193ba17cf46f399fb91d479f15f93
SSDEEP 192:sxZvR/VyM/jK1Ml8UQdkEJ/fvsyksghIdp4uHr86+WNGYwbw8sIg5EJ:sxZvppq2EJ/fvsRDKTHZGA+
TLSH
T1EE52F752AA345977CCDBD209FA51BF53D6F50472A2900E44AAFCCA1C05E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2e9e5938f8824099ff9bae8774f1c96972ccfe42f9ec5b93e6874a6741440f57
MD5 eb539b2ae86a68be1e1c92db309616da
SHA1 26a1e5d84b285ebf2d1de27518672fafd3e4e4dd
SHA512 324d5896cdb967148dfa971cffc037677388542d3ef9aefdc7e624388cae3eabdc4c89ede928dda0aa4d3a4ac0c1be3daba98c3fab949cd89bf46e60b632007b
SSDEEP 768:n44jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dOrohdcBaoG:n44jeXmWvmKLEu1jacPLZQdFMHG
TLSH
T1CCD20A3B284CCF7E4F844E5CED26AE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 55e7fddfdb2b850de81b96f55cf9ff32c4fc075d055050e7abfd9fc6d58d0d1a
MD5 5853a8664b69489145a5310148d70e5b
SHA1 91be8e1583a1528662bcf91db088b961b3e1a8f1
SHA512 e1d70be5b5eeb52e349ccffe9e06dc313f371f528a0b355e92f52de57c4bb3443db3490d2e185a1be3d5727b6441479c9bf8e1f3c425e0c19bf3795a3a112eb3
SSDEEP 96:KQpqKikaubaKEcA2r6WwYY+Wo9lg2+K4Lgk+ce2VUGfHJGXThDw:odRD2r6WwYYZo9m22Lgkte2VUGfHJGXq
TLSH
T121914F16717F06427D3F290CD3588A57AB8171633019E52B37A804E11E67E26AEFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594378.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594378.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d6e89e829f2d1e229ac71716e6a675181e3a710961d7b99f8472a5d8e19879a8
MD5 e42fa0235120bed67c44633fe65a1137
SHA1 8c7b4b0c7ee9cb12f4680dd38315f103485a0717
SHA512 d155543464a4115a197e828d43a9cc400209ecfaf22b9a8602abf7fdb7a4d3250eaa15085a20ce8eeb3e36a829816f8d95279dce4b998693c322cbb6abe81e58
SSDEEP 384:/tNn/s3n9SfsNCxSsimwf++OWYXN+2wFWGOObjI9G6w7xj6:/j+9UzN4HOVNleWG29Mo
TLSH
T130928C32A8289E335EE29655F44B3A179FF4426BD6C52FC8D5DCAF0C05DB6AC130A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 bb92d31b830d6a7f201a39c1d4a5797be6e355313abe659e857f014203f4327b
MD5 13fbff23d0aeae2b25cd07126a15acfb
SHA1 b2dcfdc0df9c09090390cbaba4b6d74ef55c6f77
SHA512 03f7dfda0bb2ebc9fb7b9f9362df41ff5a31d59568412cd4d14f294287a333b7e6caf989a83a3785076e453e1674f183f0b8385dd70d386873338fe9156eb652
SSDEEP 384:3iF1tNn/s3n9SXzsNa8TUNTUlIlqSsimwf++OWYXN+2eFWGOObjI9G6w7xj6:yF1j+9cTwgoN4HOVNlQWG29Mo
TLSH
T14EA25C3398589E7BAEE29B55F44B36178EF441ABCAC56EC4E2DCAF0C01DB5EC0306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7abae5d6365a2585261ce28d7ecb549395911022447b7bcd75bab40521d45668
MD5 9f15c043a0a1db4536b6eaa78f5c8f64
SHA1 b2ab1644b763216c271c16220b6aa65d5d2e62d2
SHA512 ff5850873e827b9436e275b00ba83f1be34cec9355bb23785642ca710438a91b0aa366f59e32807e77aa3552bd2518a71c54d568edeec48a129dfdcaf1987616
SSDEEP 192:EON06hZ0QmiUyBBpc/+jV4O1cYa5wOZW8pU6:EON06o8pu++OWYh2WMU6
TLSH
T11002E935A8686C779EE2AE05F48777235FE4112BE9956F84EAE81B1C00C779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 95eea0a828c23ba9d32709f159c84ce1c6c2ab150bee0085469f6e242b531dc8
MD5 7485159749f07bf4e0de4e952c79bdec
SHA1 922c61a0c89b4d7918041ef26534ff9b00670c41
SHA512 386fceaa3bcbf543cdf69c087238ed9c4f7a2063ac00eb5d4bd609781d4830c9a0f05da78b2f7df55fef1446fd4e2b0db3a73c5b4188b8d3fd99c8ec98bb9eb6
SSDEEP 384:FtNn/s3n9SfsNCqSsimwf++OWYXN+2wFWGOObjI9G6w7xj6:Fj+9UkN4HOVNleWG29Mo
TLSH
T15D928C32A8289E335DE2D655F44B3A179FF4416BD6C52FC8D5ECAF0C05DBAAC130A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e1175e1aa533d2405ebf15f8e802ef97d7466d3c185c4bfff0b9ee1a8746a52b
MD5 d0b1b1368713bf8a0638f8d6d87e9707
SHA1 34b9b9a238a87e4c6dbf3b2750c9176d83fe1583
SHA512 1e99dfa8bbc88f21ecf45a04322433dffc50eeb0b9769f0c08a240c8a7c2370c14e38fd98400e615d268dc4a9d205aec74f73ce1cf605ff8efa30f9ada5de356
SSDEEP 192:AON76hZZQmiUycBwc/+jV4O1cYXN+2X5cOqW9qXU6:AON76Tjwu++OWYXN+2a9WGU6
TLSH
T17C120A366868AC375DE2E645F48736139EE55127EEC57FC4D5DC2F1C04DB6AC230A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31f1c4e7-844e-4673-b577-268eba845a5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\31f1c4e7-844e-4673-b577-268eba845a5e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8f9a62e8543cfcbc997a500d42eb3ab86c1eae6f70a6ea16c8e4e317cd013db3
MD5 e6669f34f4192c0c0292fb2f339c74fc
SHA1 5bfc8855df3655945ea96deb717a5775068937c6
SHA512 cec7655cbb43674e2617cbc07c68a454ce5a1c104653fec8fec9a150bb16c52536eb5865a23b8fef6868bcb19d785bd5251abce5e3ae4ed51c65368abdac6126
TLSH
T1B741F458A6FA0148B3B76E5AAFF664AD547EBC772F1BD55E00010D8F0A26B40C8A1733
MD5 SHA1 SHA512 TLSH

Submit Download