hxxp://nel[.]heroku[.]com

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://nel.heroku.com
Sample260710-e5lc9aet7t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
836	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281315019103623"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{86F9499E-0D43-441E-B69A-0B108426B996}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
436	msedge.exe
436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4808	4688	msedge.exe	86
PID 4688 wrote to memory of 836	4688	msedge.exe	87
PID 4688 wrote to memory of 2692	4688	msedge.exe	88
PID 4688 wrote to memory of 2692	4688	msedge.exe	88
PID 4688 wrote to memory of 2692	4688	msedge.exe	88
PID 4688 wrote to memory of 4792	4688	msedge.exe	89
PID 4688 wrote to memory of 4792	4688	msedge.exe	89
PID 4688 wrote to memory of 212	4688	msedge.exe	91
PID 4688 wrote to memory of 116	4688	msedge.exe	92
PID 4688 wrote to memory of 212	4688	msedge.exe	91
PID 4688 wrote to memory of 212	4688	msedge.exe	91
PID 4688 wrote to memory of 116	4688	msedge.exe	92
PID 4688 wrote to memory of 116	4688	msedge.exe	92
PID 4688 wrote to memory of 4432	4688	msedge.exe	93
PID 4688 wrote to memory of 1892	4688	msedge.exe	94
PID 4688 wrote to memory of 4432	4688	msedge.exe	93
PID 4688 wrote to memory of 4432	4688	msedge.exe	93
PID 4688 wrote to memory of 1892	4688	msedge.exe	94
PID 4688 wrote to memory of 1892	4688	msedge.exe	94
PID 4688 wrote to memory of 2536	4688	msedge.exe	95
PID 4688 wrote to memory of 2536	4688	msedge.exe	95
PID 4688 wrote to memory of 2536	4688	msedge.exe	95
PID 4688 wrote to memory of 4192	4688	msedge.exe	98
PID 4688 wrote to memory of 436	4688	msedge.exe	99
PID 4688 wrote to memory of 4192	4688	msedge.exe	98
PID 4688 wrote to memory of 436	4688	msedge.exe	99
PID 4688 wrote to memory of 3308	4688	msedge.exe	102
PID 4688 wrote to memory of 4104	4688	msedge.exe	114
PID 4688 wrote to memory of 4104	4688	msedge.exe	114
PID 4688 wrote to memory of 4104	4688	msedge.exe	114
PID 4688 wrote to memory of 5020	4688	msedge.exe	117
PID 4688 wrote to memory of 1260	4688	msedge.exe	118
PID 4688 wrote to memory of 2044	4688	msedge.exe	119
PID 4688 wrote to memory of 3952	4688	msedge.exe	121
PID 4688 wrote to memory of 3952	4688	msedge.exe	121
PID 4688 wrote to memory of 436	4688	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://nel.heroku.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffbfb32c188,0x7ffbfb32c194,0x7ffbfb32c1a0
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,16632062350795446770,7771621344390073484,524288 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - System Time Discovery
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,17474735572100864706,17252694060490696057,262144 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,10643664665651007809,13709062842409641919,524288 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,17095566802943046457,12215809143900376649,2097152 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,17563861897517503200,17099182427463330013,2097152 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,9045376335187188125,16111532140407787791,2097152 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,11541569533961430409,7140326703141804789,2097152 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:2
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4440,i,15462700290000270450,16715365869337818191,2097152 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,17893020112691045413,9746101493205083797,524288 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,7501792962013712821,16118845814950746569,524288 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,6353284638700383606,17580218133075985080,524288 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,6353284638700383606,17580218133075985080,524288 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6452,i,11742708427474401719,2050851656731473724,2097152 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,7176716236952986985,12869155565209000120,524288 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,5325590594682106895,5378167254163726282,524288 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,1432404496683095001,12438051895371979003,524288 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,17671882342427856854,16291203418600901152,524288 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,7470371469059582448,14090460830795026118,262144 --field-trial-handle=2300,i,13500144162405804307,1855459916504096801,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 373KB
SHA256 a5c27d3298042314d98634f85836ab0c48cbdf572ee676981a852c3e18738d8e
MD5 7eb1501498252ec1a30118a2d3917c94
SHA1 b275a098ab3e050e2b4ac71eac10c238c2365c45
SHA512 8f5831b6bfeaea74aba0d23b684687e0a308f51f1528859535c9df335367b946b6be42500ce637e77baff40795bbf152e24abcfcee227c6d9d0e490412e09d26
SSDEEP 6144:bBJYkBiu4su2hIklCVm8ZiLHBd0R+2jBLX47rD+CNOgtU28xNAoWclJ/lo31jjuQ:bfWV22kvnBSw2FLIPDVNfN8nWclJ/Md9
TLSH
T100842306FA0DD6F4A7A40DDD2990A3E04D1372444CFC4A347B8523B9DDE3AEF4A159AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ec4d32041ae29e7fb327abe265520290bf7516834b1c1ede99a1940ddad6b520
MD5 7ff737bd2285a375b67bf6d07638586e
SHA1 0499db5085e23db00247f5038cf03373e50b7137
SHA512 45145ca617d8c2b6c2ed60a9bb713d66ccec01a36d37314b9956a8f396ecc6c41b5b9f0aabdd32fabe26df578907522591bb53fbd01381d65b3d56dcee1365b8
SSDEEP 48:zYPPhBYk7bLJB4WZBhwFtqnRuJ0X0RMlIhUaFkfrVKDZil1gtR9nXtKuyHjwgakf:z2/Yk7bPVu0ERMlIiaFOrLopXty8gYI
TLSH
T1E591A478ABB21B92DB61617A90F08E08773BC1EEF46F1E3E63805879642E7C205C4D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe597f77.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597f77.TMP
Size 3KB
SHA256 af5ad29bdbebabc936390edc7182cb1080cc9bfd2be537f62e579506b6ee74ce
MD5 e0aaaf57d2f5e3c3b7caf6467225eadf
SHA1 2e7c55304260bbee7212793e9df44c53641cd390
SHA512 7c31458f8709d57f2e0dea403f8f1e2dc322d9f5b9cdfc816be24381379485dfbe0884386170bb4759bed9900c6118c03baa33f5be8437e1442dd687e9e41da9
TLSH
T10C6192B81F720756E366113BE0F0860CBB73C2EEF82B1E3E4390297A650DB940194D07
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a9493ab47b83898938b6ddeaed945b40231d96f2cf22cfb03d82c33162a999b9
MD5 f86ff74db8719edacec0cde87f1a90b9
SHA1 38e055e91930e56047fbe732dee7da2cc3ffdb49
SHA512 980b66dc4da7dded7792fe5b9b753f1c2a9397f5e958c07c62c58eb7b6f0cfc062aab86f187b7ad12e7674c393dd3f714a62f68b99b8741c7c9e99074b0c7793
SSDEEP 192:DQn41jI22D1akj6TG/apaPaZDpHM/l5iJ40x16uTufj:DQn41jI22D1akGTG/apaPaZDpHM/lQJI
TLSH
T155D17AF7C3E4822D992196F5EA24BE1BCE1C0A15631C3C3689D4BE5B93E2071E11275F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f50cf13aef5b16006b205950e7e0d16db379551c471c094e8263b2c4cea5cca2
MD5 75d44c370f619fc9b740696ad806c047
SHA1 d0f6bd658439242928c1255b22d7d2e14fcd9c81
SHA512 edf79cec34cc7a71d4d84d115f66a1320e20d172cd1477de89960da49a9509d05f81d0a1403d4d730d10bcce22bca90e010530de69da67d00dfe8a30d11dc61e
SSDEEP 192:sxZTRryM/jK1Ml8UQakx/f5s9IkLV/IdpyZHW6+WNeb9rh7I/Y9IRxDMIg5JJ:sxZTVqpx/f5s9IkL2+Hbm2/IN
TLSH
T12152C6266A3459B7CDDBD209FA41BB97D6F5157292900E44AFFCCA0C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 162f0228c6a3ae7ece40a14b92dce72f6b2a0d3c74d999fa025e8253d5c1790c
MD5 c3e7c3908cc64114b4b9ab3aaf2f2b14
SHA1 714e5d470984739a590177e340350929357a5647
SHA512 74a14a2e9314c6e014466377162c16ff62d77c92a3ace20820a4bc9eb6954397f0d4d383414f2e50fb65beaa0407993d95a6b74bca87c6e801631e06fce7a69b
SSDEEP 192:sxZTRryM/jK1Ml8Mkx/f5s5IkYJ/IdpIQHW6+WNg9r/Y9IdyDMIgrJ:sxZT7Mx/f5s5IkY6hHbu/19
TLSH
T17342E8166A345977CCDBD209FA55BB53D6F5057293900E44AEFCCA0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7fa9ab50fe9fc1a55413a87819dac917b196e17079812184f098cc9ed97f9353
MD5 40508ad44ff133a1743a9bb86411e08c
SHA1 816ee573725d10dd6885ad7d5c53b6a59eeb98fd
SHA512 1583ffb86211d9151685061295a2445366d52a8de800ce77275adb49fe2714c069a5c71a76cf9ac60d3883a4649fee86cd16ee8ed41be64935f8a308afea0a9c
SSDEEP 192:sxZTRryM/jK1Ml8Mkx/f5s9IkLV/IdpIZHW6+WNeb9rh7I/Y9IAqDMIg5JJ:sxZTVMx/f5s9IkL2cHbm2/uN
TLSH
T16D52C6266A3459B7CDDBD209BA41BB97D6F5157292900E44AFFCCA0C00E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5c6b2df60ad1287c41decc73eb903887a9f444e246a3f27ae66891466a3e409b
MD5 0fc3363bf91c0c52b0b030fc4a332c24
SHA1 546622e63d17cedf17dc5cffe626abb9fb32d8a8
SHA512 6e80abd0041fd314b7e28642ab5c0c8170b8e4782ce81d7b8577f09f7ff3d6be68161b9b4c337246e9f10c789b170b8e0ec00901eaf8d21713539fa150c759bd
SSDEEP 768:aTcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNdroug6x:aTcv21wWvu+Z+u1jaeFLeRNWuB
TLSH
T163D20B2B280CCB7E4F841E9CED2AAF8A6DD801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599dfb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599dfb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6ff4534b5e36ff215233039106167ddfc6c6edcc52042bf497de56de9c19af7a
MD5 7478c62cf4f24683e7415ce6b90ea539
SHA1 e654194a2578efdc994fd84d75187bb966d4a89b
SHA512 29486f59748f264d0ec364de97bc274829867d4bc3d8fd989668214f08c4ece16790e3b477923bf0c3c5aee900028c0fd2e05f55be1e780e43676b4cd85ffb13
SSDEEP 384:ntNn/s3n9SfsNHg2ziH2Ze+CxO9+Ri5OObjI9G6w7F2:nj+9UUDg5OoRi529MY
TLSH
T1A7929E326C244D734E929A99F14B3617AFF4517BA2C52F84EADCBF0C02DB7AC4306912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0c20d935e4f3f8b2ff9f0925479841155104638251c8821377500f473e79e639
MD5 0ce1e017fe9d9a2f5ae04c70b4c55020
SHA1 ea792d616206e1865fddb0f684daae7bf31db6c5
SHA512 c46fccef352c2f09190671a12f32fa075551ec0b8537ea424fffc5e93a0c8ce71f4627478907c936b39853408feec5d229060208e0b495663e6f24518b490166
SSDEEP 384:FiF1tNn/s3n9SAzsNZ8TUNTUlIlg2ziH5Ze+CxO9+Rj5OObjI9G6w7F2:MF1j+974wg7wg5OoRj529MY
TLSH
T1ACC228F258D74976D99E4B47F73E2E169EBCC167B5812A40B7886A0CCD871BFC306810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dc1614f7bf587481da009451ad271bb438d6c79afefc1d77540eefd4db8ac565
MD5 f78c2d4f318c9432239bca4246229e85
SHA1 3021e668db7fc6c42cc43424accb6492e1e1bcd4
SHA512 c8db2348465a8548c3a51e6e290f56fb8c898a27a6aaa77ff67230baa3b91e7f2fb17e8b7cb3e3d82b16e4d46b5c2973f95197d84b08ad909af5b3bea4becff4
SSDEEP 192:JONk6v+YLNQmiUygVZh+CGQO9UousBLU6:JONk6vz/zZh+CxO9PNU6
TLSH
T12602E835AD381CBB9EE2AE05F98737175FA4217BE9912F90DAD82B1C01D774C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d3bbc671795201e661a668a2a0c7c469292b961e0e6ef9f2112d44ad92f65ac8
MD5 6dac81197112965d43ac27e700312f11
SHA1 3ee776c492e57e3a0adb83abf881d68b61a67142
SHA512 2c10f9d02ddb8e9d9a934dbeff4050f42393b885e66d4af6efcb2510a678df230fea79b3e849c0d1fd30f7b1d2b227e3fd8356e4ab80edf89af915b745525ec5
SSDEEP 384:0tNn/s3n9SfsNH12ziHjZe+CxO9+Ri5OObjI9G6w7F2:0j+9UjWg5OoRi529MY
TLSH
T156929E32AC244D734E929999F14B361B9FF85177A6C52F84EADCBF0C02DB6AC4306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c782f56c76091898d6ea5e5c376c18dd2bb2bddc7ce0842cad53893b094ddac6
MD5 78e5483691d6927c1cfbf3ad926312e0
SHA1 3af3f7c4c11de075a54c59de3f8a62bb5252cf09
SHA512 41bc0b83497c40cac91f7ebe84faa1cffe905d77fadba9bd2498b830ac88f06172b7c3b24203dcf9baf5218ba30042329b8598df240d4c6a317465cd29715502
SSDEEP 192:sONa6v+YLeQmiUyNVbh+CGQO9UNR8CHOqdU6:sONa6vzuobh+CxO9+R15U6
TLSH
T14E120B32B9385CB76ED2A944F48736179EA45167EA857F80D6DC3F1C01DF79C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7c6c8ad-9184-46e5-bb46-d785b3c030c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d7c6c8ad-9184-46e5-bb46-d785b3c030c2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 515f41a11cd8041b0d189e8ab36152a2f885cde20638ee999f0e7df3d62cac22
MD5 1bbf4e8fcca471eb01cd27c9f5df8535
SHA1 f37fa863206bafa1fdc9570ce6917d76d8e3eaab
SHA512 4798b10e08896c4f2a540edeb8137a62a5ec3c4ec820ad44534f5292321d907fb8537f1889b3b04a9736cb4c0ebf3244ad9a3af5a31481aa7c02b51392841854
TLSH
T10641FC59A6F91148B7B76E56ABF6A86E487EBD372E47815E10010E4F0A26B00CC61737
MD5 SHA1 SHA512 TLSH

Submit Download