hxxps://tunnel[.]googlezip[.]net

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tunnel.googlezip.net
Sample260714-pr4msacz2k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3244	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285060912276241"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{43EE8D05-22F4-470B-B5AA-F30ABD061DF8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
228	msedge.exe
228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1472	1156	msedge.exe	85
PID 1156 wrote to memory of 3732	1156	msedge.exe	87
PID 1156 wrote to memory of 3244	1156	msedge.exe	88
PID 1156 wrote to memory of 3732	1156	msedge.exe	87
PID 1156 wrote to memory of 3732	1156	msedge.exe	87
PID 1156 wrote to memory of 3572	1156	msedge.exe	89
PID 1156 wrote to memory of 3572	1156	msedge.exe	89
PID 1156 wrote to memory of 376	1156	msedge.exe	90
PID 1156 wrote to memory of 4456	1156	msedge.exe	91
PID 1156 wrote to memory of 376	1156	msedge.exe	90
PID 1156 wrote to memory of 376	1156	msedge.exe	90
PID 1156 wrote to memory of 4456	1156	msedge.exe	91
PID 1156 wrote to memory of 4456	1156	msedge.exe	91
PID 1156 wrote to memory of 4560	1156	msedge.exe	92
PID 1156 wrote to memory of 4560	1156	msedge.exe	92
PID 1156 wrote to memory of 4560	1156	msedge.exe	92
PID 1156 wrote to memory of 2180	1156	msedge.exe	93
PID 1156 wrote to memory of 2180	1156	msedge.exe	93
PID 1156 wrote to memory of 2180	1156	msedge.exe	93
PID 1156 wrote to memory of 972	1156	msedge.exe	96
PID 1156 wrote to memory of 972	1156	msedge.exe	96
PID 1156 wrote to memory of 972	1156	msedge.exe	96
PID 1156 wrote to memory of 2808	1156	msedge.exe	98
PID 1156 wrote to memory of 2808	1156	msedge.exe	98
PID 1156 wrote to memory of 3644	1156	msedge.exe	99
PID 1156 wrote to memory of 3644	1156	msedge.exe	99
PID 1156 wrote to memory of 3568	1156	msedge.exe	101
PID 1156 wrote to memory of 5104	1156	msedge.exe	109
PID 1156 wrote to memory of 836	1156	msedge.exe	110
PID 1156 wrote to memory of 4260	1156	msedge.exe	111
PID 1156 wrote to memory of 408	1156	msedge.exe	114
PID 1156 wrote to memory of 408	1156	msedge.exe	114
PID 1156 wrote to memory of 228	1156	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tunnel.googlezip.net
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffa5408c188,0x7ffa5408c194,0x7ffa5408c1a0
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,4321566198043360917,5607546148214960003,262144 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:2
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,4658812627637583945,5457437050212393434,524288 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,1598703645138485419,16908263665833655535,524288 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,15196916890207015617,4952646066256442223,2097152 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,7488957962842326897,546309454354458996,2097152 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,17878078270040557612,14046175683892537839,2097152 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,12532678758482728563,7866389787016278710,2097152 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3652,i,6582708262782211476,12659919651689044450,2097152 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,8861558573614335632,9880271459161286174,524288 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,16610996244881318774,1070878070905177084,524288 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,9229671412861457533,425790084618901010,524288 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,9229671412861457533,425790084618901010,524288 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,2201802607747403070,10194720957765918656,524288 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,2536980611089445236,10490682110925472680,524288 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4152,i,11712616338202650112,104411470268482672,524288 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,13283434507206530381,15009316655585625543,524288 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,3348230230594342365,3580855542280568998,262144 --field-trial-handle=2760,i,1759148464671286785,8116188713196601656,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a612efa1a3f1d4ee262abb96d63f3b4a31c2ad6c544574be7246db0f52212e1d
MD5 e0045423d265fbb4204e2ccf9cf4e729
SHA1 5cd430c76a965b7d49eb6f686349a92180871674
SHA512 e0fe72d7795acfb0a22d0da2bf0fda4779e67429fc7f0868abc95950b557948a8b07360e9f45a7446cbe79ca28b10086e9e6f63cce1bc4e718efef8261f1e913
TLSH
T11BD09B55754D7415D31B01315411E360955A4462A172D2457120440DB97C81857E5257
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bbf190a7ea56ee5d919fac9e36fb8cc5a9dec4686c9f424fce6930550574748b
MD5 9b02d25f162b812541680122c4cce0d0
SHA1 aba664acac98a7c0f93014dbbc034fcb1bd90829
SHA512 7db56d099d76ee503a3a244b9e4f612d4669df603fa913375019e3bacfcd49134fffa53a6ce18d0db7c2fb505edcbf0efda90aa06dd561e1bfd7f9498987faf2
TLSH
T18B714DF912AB34A1D7248231E8D306FDB47B4455DB237E51C140ADBCAAC6BD993EEC18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588920.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588920.TMP
Size 3KB
SHA256 4c2dc2f72ea097412a345825f55fd2f6a0785aa0676558dc7ab48c6fa17b3b7f
MD5 87240079002f88bce17fb30de5f5e8f3
SHA1 62d927460cf78ba376aa4d30c134e493050fbc91
SHA512 8dceea816636a71c47a8da1d8d5000b77b50c5919e24a5103a6daa748a727ca126183c42fdd654eee7b229e7f1a4465fec03cd3a1604034152112463c209fd5d
TLSH
T1ED714EF912AB3461D7248230D8D306FDB4774095DB237D51C1009DBC69C6BD993EEC18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4b684be09e89403c2add999626caa970032fd0d99cf729ab52b61dda3ac2d6a9
MD5 183954fc9ac23095e2a7ed48e5beb7c7
SHA1 f663d15902893274ae92ea3f61f60adb173c988f
SHA512 bdd7cda90665611bf84500da762b3ab7812d3e880600c372ac65fb16ca7f4793915c5afd9b990a25b87ce81e77b818704f5852d2554c0c0c388dc55696e478b3
TLSH
T11D21ABF783E1856EDA1156F0AA28AE2BCE1D0506432C7C19CAE0EF2793E3465E40294B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a76a226df2b2f117ef824e4a45427b01beda6fd26bc8e5810508e2ba4d340440
MD5 420902137634d70ecb8772c68cd31584
SHA1 20b9d5c504066ba038f185164d55d3b8efc81472
SHA512 9705e542240bd7fa446d22220d0871c08af9e05c5299a9d4c1f5c0e75c41a608e608c8dd05e89b9a125bb4364b4d2d7159ed0501b33c0b95e004e590e309cb00
SSDEEP 192:sxZoRnyM/jK1Ml8MksJ/fFsr6ZIdpkdHW6+WNGYHj85aIgrJ:sxZo1MsJ/fFsr6ygHbGS9
TLSH
T1D342E9166A34697BCCCBD209F9557F93DAF50473A2900E44AAFCCA0C05E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e984401615901d62831a747b27d24721bc3f4afe1d5ec75055a5ae48ba3e89d3
MD5 880f9fac5d5cb80c5644a4ea5c03338f
SHA1 44abf30f45fe0e410a07561bf81d5e387500433c
SHA512 814a6f0b576c266396ce6aacbbc7f004450d4c1c23872d44d47f8346914c275c2c776ea5729e63ac4e406c13e7d0c6ef23bc217df52f00706542ea2e01be00e9
SSDEEP 192:sxZoRnyM/jK1Ml8UQVksJ/fFs4RZIdpWdHW6+WNGYH6LQaIg53J:sxZo1qesJ/fFs4RyKHbGr/
TLSH
T10F52D7166A34597BCCDBD60DB955BB93DAF40472A2900E44AAFCCA0C05E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 95ba1a18a37fddc3dad60ce3dfe63e38cf26b606d2fb0036fe5eff29b02a8ea0
MD5 dfe06854592fc2e84b61c8f95cd34ec6
SHA1 f85c617492dea424873050b2b993b5f681a33bf6
SHA512 17b5301d6932908020167b6568e94601d8abce862dd6e54eb440dd05a0aa973864a0ca87ea064e2cc7a3daba8f4cee6886b019166bae4ac23173faaac414b9b3
SSDEEP 768:HSUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RUroVg0+:HSUZYTMWvg0Pou1ja7eLZmR/B+
TLSH
T16AD20B2B284CCB7E4F844E9DEC266F867ED801CB5A984D5447EA894C03CB7EF112759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 69b3d375163abcf466774f888e88b4cb709da5bd53c6679041fcd5c5e43adc1c
MD5 28a34d9ca371bbcd6e139d10c3d17239
SHA1 5a4a245803a0d9a2185d272b803a263185f2aac5
SHA512 0ce28102def19a6ed13e00ddc8e60f8ad69903df64ba46b73ec4ae8d9b829da4a825cb2ae36e32de05a821e550b2384012dbe85e90baf51d07e9fea3ddf671ba
SSDEEP 96:KA1eK2Aoz2Ksom9WB9v3Hm1XoNX+TKvKX4Tz8UDS6wqUti+sOSb1iTqXmbKviXQ2:E0BFlv
TLSH
T14AB1350372B712433D3D2908A2A9973A4F85F1937424A46B7FA544B25E27E740DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ad68598-6984-498a-bf78-9348858dcf91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7ad68598-6984-498a-bf78-9348858dcf91.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 86615143c41da45ca79dbba3613b7e34d6bf493a03bcc8bda009b272d1ac2516
MD5 81a74d9ddb2a218a720546bd3b58dbb7
SHA1 3b6ad5d4e14c9573655ec473e9576d54e0efe77a
SHA512 955dde78f1adbae2d815f58145f6c900714fb870a48e9e18be7e018d9cf766e67de0dce02f673bdb2ef562e8c646c966cebd05605b975d592482476f0c46f8d6
SSDEEP 384:ntNn/s3n9SfsNqZ3pL6szX5od+KOrmeOObjI9G6w7qn:nj+9UzgEOzOrme29Mqn
TLSH
T11E928D326C29AD768DE2D558B48B36179FF851BBD6852F88C2EC6F0C01DB6BC1306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 8e18c4c11edf7b2ea47c29b199c911fca046507e5e60d9a613a985c9b8b54afd
MD5 9c1ed047044fd552a3685959a008380a
SHA1 896f983f1bd91100ced99d4b4e43ccc4357fbd0e
SHA512 8655724b286c8c09e64f77f169fbb36a8a5a9adcb03977c9ad6292e2798eb74e40f8ee7cbb3d22e76902323a54371f1d624219f30e9085a13f088cbb890efc79
SSDEEP 384:UiF1tNn/s3n9SozsNy8TUNTUlIl63pL6szX5od+KOrAeOObjI9G6w7qn:vF1j+9//wgggEOzOrAe29Mqn
TLSH
T15AA26A3358589E7BAEE29A98F58B32139FF451BBC6856E84E3DC6F0C019B1EC1306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 38dd0a24ccab49b964081e5a7bee41777e0aa34c20119c003bdbd9b0350340b3
MD5 c8c30e3b71914e212acd55526bdb8af3
SHA1 8332676a82344e4e27ccfab95249ef37ac9b4b3b
SHA512 9dee8d8549855f34f37b6bb3327871e1a10e648f924efccd1b81128a895e93d5ce246b35cfe33f87c626258cb9410d67a2f5ec14dfd31ed99a935277fb55d887
SSDEEP 192:yONc61VWQmiUyfKgGX5Obd+juOFmI/an3s5U6:yONc6WbgGX5od+KO6c5U6
TLSH
T11202E83569687CAB8EF2BE49F48737135FA8207BEA516F84D6E81B1C00D765C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 05ef6fc8547755ecab05fb8fd831b129cea1ef754ddb29907bbce31c6149446e
MD5 95958c1d43277c48ecdc0164c079836a
SHA1 18094a25db9e65c8702992da230413a9d5ddca62
SHA512 c3a598338554933590ace5193b7f053817ebd26e76fb7a187cc1c9d3eccb27028f1a8e803c4765dff1e815a877748e9f9bba9cf3777bbdb2c32c8b610fa80976
SSDEEP 384:UtNn/s3n9SfsNq63pL6szX5od+KOrmeOObjI9G6w7qn:Uj+9UAgEOzOrme29Mqn
TLSH
T1B5928D326C296D778DE2D558B48B36179FF850BBD6852F88C2EC6F0C01DB6BC1302916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bd0d4152f3e925f6cc6cef1870615f4f7cf6fec13181e27299b6685c6a0d3b9b
MD5 0755ee0f799d97cfcc1dca5850c82727
SHA1 60a3d6232c0c29d3d27aa4696dc13991efbb53ca
SHA512 241f3794f9395c6fb4e1cee44cd2e92d10ad6db43fa90bdd977febe74e32a53ff0f9bf21c4256aaa95673d6cdfadab7290ec8d3167d1a79652a968467574b92d
SSDEEP 192:EONr61dWQmiUyLK8GX5Obd+juOFm0beFjJTqhU6:EONr6S58GX5od+KOryeU6
TLSH
T10012E7326868AC7B9EE3E544F48731539FA55167EA857FC0D2EC2B1C01DB6AC230AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ade1fd38-06cb-4b45-aa5d-a87dc6e0614a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ade1fd38-06cb-4b45-aa5d-a87dc6e0614a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ca1144889310e2220bd1bc57cb7be53567f44bbd0ac352b7341f0e53240014e3
MD5 397236b2753ae273b17b4d91e3d6aeec
SHA1 37f887448f05d603885806fd724a66e96eb4d8d3
SHA512 b9af94f11d795fe8a8b30ac36ebdde2e724af1f3771e0bbe61ead12cbfb4dec8c7883a0ce05b7bd352e07cd3cfd3e008b053e3042ba4a1a694f84bd7faabe172
TLSH
T11041FC6CB6E91048B3B76E5AAFF6A45D487BB9371E4AD45E10010E4E4A63B40CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download