hxxps://esim[.]dog/success?payment_intent=pi_3Tskp8P3rsvFckzp0VEiRgVS&utm_source=email&utm_medium=email&utm_campaign=order_confirmation

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://esim.dog/success?payment_intent=pi_3Tskp8P3rsvFckzp0VEiRgVS&utm_source=email&utm_medium=email&utm_campaign=order_confirmation
Sample260720-3rynesay8s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
756	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290647388493863"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{C505A208-A8EA-4698-9DA2-6896BFB2228B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 4716	2320	msedge.exe	86
PID 2320 wrote to memory of 756	2320	msedge.exe	87
PID 2320 wrote to memory of 1488	2320	msedge.exe	88
PID 2320 wrote to memory of 1488	2320	msedge.exe	88
PID 2320 wrote to memory of 1488	2320	msedge.exe	88
PID 2320 wrote to memory of 512	2320	msedge.exe	89
PID 2320 wrote to memory of 512	2320	msedge.exe	89
PID 2320 wrote to memory of 3568	2320	msedge.exe	90
PID 2320 wrote to memory of 3568	2320	msedge.exe	90
PID 2320 wrote to memory of 3552	2320	msedge.exe	91
PID 2320 wrote to memory of 3568	2320	msedge.exe	90
PID 2320 wrote to memory of 3552	2320	msedge.exe	91
PID 2320 wrote to memory of 3552	2320	msedge.exe	91
PID 2320 wrote to memory of 3028	2320	msedge.exe	93
PID 2320 wrote to memory of 4424	2320	msedge.exe	94
PID 2320 wrote to memory of 3028	2320	msedge.exe	93
PID 2320 wrote to memory of 3028	2320	msedge.exe	93
PID 2320 wrote to memory of 4424	2320	msedge.exe	94
PID 2320 wrote to memory of 4424	2320	msedge.exe	94
PID 2320 wrote to memory of 5076	2320	msedge.exe	98
PID 2320 wrote to memory of 5076	2320	msedge.exe	98
PID 2320 wrote to memory of 4204	2320	msedge.exe	99
PID 2320 wrote to memory of 4204	2320	msedge.exe	99
PID 2320 wrote to memory of 4648	2320	msedge.exe	101
PID 2320 wrote to memory of 4164	2320	msedge.exe	107
PID 2320 wrote to memory of 3468	2320	msedge.exe	108
PID 2320 wrote to memory of 4460	2320	msedge.exe	109
PID 2320 wrote to memory of 624	2320	msedge.exe	113
PID 2320 wrote to memory of 624	2320	msedge.exe	113
PID 2320 wrote to memory of 2992	2320	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://esim.dog/success?payment_intent=pi_3Tskp8P3rsvFckzp0VEiRgVS&utm_source=email&utm_medium=email&utm_campaign=order_confirmation
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ffcdd16c188,0x7ffcdd16c194,0x7ffcdd16c1a0
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,15274535580648012411,11365083547260299667,524288 --field-trial-handle=2268,i,11853053208360642544,1993417413729132997,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,12886197349687153,4477785565010416747,262144 --field-trial-handle=2268,i,11853053208360642544,1993417413729132997,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,18370191513877438291,13958075580661034208,524288 --field-trial-handle=2268,i,11853053208360642544,1993417413729132997,262144 --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:8
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,3811845281700630361,12370546201913406354,2097152 --field-trial-handle=2268,i,11853053208360642544,1993417413729132997,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,11784773221823602718,9914841790335598759,2097152 --field-trial-handle=2268,i,11853053208360642544,1993417413729132997,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,1065105499112344258,6126942908571300019,2097152 --field-trial-handle=2268,i,11853053208360642544,1993417413729132997,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,10674245289345601818,14782341058226152847,2097152 --field-trial-handle=2268,i,11853053208360642544,1993417413729132997,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,10285751768825161137,10160230231131932042,524288 --field-trial-handle=2268,i,11853053208360642544,1993417413729132997,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,15357463899762752752,949871119557812784,524288 --field-trial-handle=2268,i,11853053208360642544,1993417413729132997,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,872618655672014777,13613994472671740906,524288 --field-trial-handle=2268,i,11853053208360642544,1993417413729132997,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,872618655672014777,13613994472671740906,524288 --field-trial-handle=2268,i,11853053208360642544,1993417413729132997,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,15436305336554028274,6717804733883382862,524288 --field-trial-handle=2268,i,11853053208360642544,1993417413729132997,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,13377555777753844292,6817398902176132398,524288 --field-trial-handle=2268,i,11853053208360642544,1993417413729132997,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,9810209904835448967,2039724340156896619,524288 --field-trial-handle=2268,i,11853053208360642544,1993417413729132997,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,14314934926392715316,15490917053287404418,524288 --field-trial-handle=2268,i,11853053208360642544,1993417413729132997,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6100,i,11014474887535322684,6023709491988969383,262144 --field-trial-handle=2268,i,11853053208360642544,1993417413729132997,262144 --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6f4643e74b26bf5d2e01bc73de87fe767d4421f68e2f7573fa6465b1b4eb9bbe
MD5 c2825eebdba832cfbb0deb1132cceafd
SHA1 508299f8460d688f46bdececf01abf9a2f2735c3
SHA512 d10bc4bafc712d8ea52f6fed1322261096461aeb31c6e10c13b513fc20d4544e35143ba9f2d2b8c092aead12a77ebe0f3d13ae948a97f355a9495508ca90cd07
TLSH
T122814D360DA688B7F79811B1F0F40A7B76B1C1956F97DE321E10D5FD3116F5281A21AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5885b5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5885b5.TMP
Size 3KB
SHA256 c223de3912e6244821effa951c70401348a03d86f2dc64f4eea686b6c5fcf595
MD5 5d225f6ba42cbd82e75fac60c1b0c704
SHA1 c78c8ae097744b83e285fd50e69d369cc9269608
SHA512 dd453e145ccdf438250c7af6627aa89253e88964ddaab7a818ed237209960de03e7b6e6f2f045782fa508c69173cbcba2e57cca7dccf493635708e10eb3a8575
TLSH
T15A6109360A5684B7F3A81171F0F4066B7571C5862FA7EA761D14D6FE311AF1680D21EC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d0e6f86c3c7fd0686564927bcaae1f0e3b28d471c9ae15b9a14379e966a1d5aa
MD5 7f72c692c027034f2d4d9c117b31b34d
SHA1 0a0fd741a8ff15862ea926648635ec557bc60783
SHA512 50eab2753f87bcd92da0a1a8caf122a47fd9b9362e4c11e8101a690f80c37697e8022cc5c522b8efa2e727353bd11563d215f2d2094c0cd052ead5e6a2696b93
TLSH
T13E318DF3C3E5866E9A5152F0AE286F2BCE1D0906831C3C09C5D8AF1BD7E2471E20155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6546a693d91344bbae4ba05b15662537a3b85f4086294f3023be6e27f0d491eb
MD5 27b8b8d519231e80149838da105617f9
SHA1 aa95b06324276215838e409572d2b7a1ad8063ef
SHA512 402f53637874693daf7d260fa775890c95e0a38c1832f3cafa66ec0fef5dfe340a386dde8493b05cd273f174c462e33d485561739cad671ec4cf78e31a9a3f53
SSDEEP 192:sxZCRtyM/jK1Ml8MkV/fksI3viIdpTQmHW6+WN+DJ/YH2Dn4+UIgrJ:sxZCLMV/fksI3vLnHbw/Qd9
TLSH
T16B52C656AA345A77CCDBD209F955BB53D6F90472E2900E44A9FCCA0C04E7AED230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e9a592e8e007752cb37c7146bb3af720248e3cef4e58222f68b0eb57375a118f
MD5 53ffab4c9a60c911b7b29fe594951bec
SHA1 7cea13659253bb7d8bec6455216d21d0524c198a
SHA512 b24e7eaca181b9c699d046ee36e46bf7c344fbbc42e7841ae5ec3fcbc8a6850759c931d1d76ba8b0bf615383133a6200d0630895ad3783db5a02d00b53cd1196
SSDEEP 192:sxZCRtyM/jK1Ml8UQFkV/fksK3+EiIdpBQmHW6+WN+cKZYHSKnB+UIg5NJ:sxZCLqOV/fksK3NLNHbMZmd1
TLSH
T1BE52B556AA385A77CCDBD219B955BB53E6F51472E2900E44A9FCCF0C04E7AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 89a07c75711ed64ba473b9e8f04cce9b78ccae16ccd36f259ab7b62b1edd3a2d
MD5 39790a333e3032590ab97b3ef53504cf
SHA1 58a2b80768c3644dce91f74fa34fced299a4c10a
SHA512 17017d80419d01b48448f72be87e9ad3c301f7f83b3aba7cf43686aa6de2d30bafe0162f8f6dff8566efff2715f68e995c764f23893aa753bc3c96cf96d5b9ba
SSDEEP 768:Q7UZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RzroVD0Q:Q7UZYTMWvg0Pou1ja7eLZmRACQ
TLSH
T12CD20B2F280CCB7E4F844E5DEC2A6F963ED801CB9A584D5447EA894C03CB6EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 efdb96056309839b020d5e0378178bec973c465bfc060361c9f3ec92351c3a4d
MD5 84250187d2f046f2f46b0c32c21cebc8
SHA1 31416db3a18ebf793a1da2ed402fcbbe1597c766
SHA512 ddea231a5e4afc199d311fb8e448d26e02017deff27953dc7d823fe64217b9fd5b80361d4529ea1b196c153c6df7dfc36c21796f3638598d5c65ae17e7521826
SSDEEP 96:KA1eK2A08AK92uywgK1WKN2KeI6SUwKJGp:EuvzgxDO
TLSH
T122D14A5670BA03417C7D2A4D87A487569FC1B1973028A46B7FAC04B25E27E21DEFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f98e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f98e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2251def6c349327f57a879def20d8f986226158bc4a3ca68c2ed523127588d26
MD5 ac9b45205b26678800be16fca1cf6467
SHA1 146535b2ab2588c38a9e0024e3ee708d53d0db0f
SHA512 9b4ef0b1f4171756bbb470c0889c2e0c0b6f844123002153eda5d7da5e1468e44609519522614a9a4971ac0e53be0c3f43107d6aedb1234e59b7dcc609e75700
SSDEEP 384:u6iF1tNn/s3n9SfzsNa8TUNTUlIlIkNRPzD0zX5od+F8rAXYxOObjI9G6w7UD:KF1j+9I/wgFvsOIYx29MQ
TLSH
T1C5C218F248D79936C9AE5B57B77E2D124EBCC167F6806A80B7985B0CCC861BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d0cd94ef5f33a0c67aefc5162099460700c32ccf6b24a9c150c2f274dfc33e00
MD5 965bd71a8873acab126dc73c37864b70
SHA1 b8792b1407e9f589428ee108073175a68bc4bc0c
SHA512 9d0f47d6f24337860daa2ace61e24ef1a5d76033ab9596bde8b0064820b5c86a82a53e974b9cd1603bf82b89140b6eda80a8ce3d0fbff73d33b435884c3e5c36
SSDEEP 192:yONr61VWQmiUyE9gGX5Obd+jVjzorr+/aD3GSU6:yONr6WvgGX5od+F8rNiSU6
TLSH
T13102C93568686CA78EE2BD49B48737135FE41167EA552F80DAEC1B1C00D769C2357C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5b473146969fb6f6651ab3356315f119bf3f13f782e2a148ac2e2b23896a3516
MD5 d971cd451ea268516c45d682800e220c
SHA1 7009590ff16fca781769deec71c8fd152aee1a09
SHA512 e877feb17f6cc0dd16c94b259d82d066766ed14cd0c94f90121c8b40d60f451dd0a48a9bf35adc718da9747f21f245e12a9d433576747463c5dec0b73fb8d287
SSDEEP 384:ZtNn/s3n9SfsN5UFkNRPz30zX5od+F8rAXSxOObjI9G6w7UD:Zj+9UmzsOISx29MQ
TLSH
T158929C32A828AD638DE3A965B44B36179FF4917BD7C42F84D5EC6F0C05CB5AC4313926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d6b6295efbea0c96b549b73f50e36b68b2042d8914221725d2d1f7be6cf648f0
MD5 f348e2e1a68dae311deec838d981230a
SHA1 0d7014fb68ad90806c0526f72af645fb4cdab1b2
SHA512 0ab024b153cc138f05b8691bb6ec597da10467c5284c74a6a4a6fc2a40bdaac1a289ff8ca48070f2a978f155536561e60ce98a57ca8599ec0872b3877fe6e584
SSDEEP 384:2ztNn/s3n9SfsN5UIkNRPz30zX5od+F8rAXSxOObjI9G6w7UD:yj+9UlzsOISx29MQ
TLSH
T146929D32A828AD638DE3A965B44B36179FF4917BD7C42F84D5ECAF0C05CB5AC4313926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0253859f2e017651704e81d716ad3b400d21c1dbd014f0629e48e19522f578ac
MD5 a6c72cac1a3cc019c495c5abc8afdbd3
SHA1 73ea54e80b17458ac8b85bb08dab95a037ee8dd2
SHA512 c3560b3a81e6ff7e8384b06e3fda8b72913d159e01e71583f139405a302b54804d1fa24ccf06ac92fa519338fea33f992c97844a1fc6e025af8987e0767fcfce
SSDEEP 192:CONj61DWQmiUyX9UGX5Obd+jVjzorrAXK9jJpq0U6:CONj64kUGX5od+F8rAXMxU6
TLSH
T19A12F936A468AC674EE3B855B48B31135EF55127EB846F80D6EC2B1C00DB69C131BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3467cd5c-5227-49a3-a8a1-cea7574b6aa0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3467cd5c-5227-49a3-a8a1-cea7574b6aa0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 59e188231374bbed52d5224bff68411400b4173c39d10fe4f9bdee78f6f7442d
MD5 491736ca0c58d014c0edebda05a0847f
SHA1 38ebda6695b5a8a8ba3f027a538bd35daa9c09d3
SHA512 fc6493158d29956221fa5bce3e9b60cbd000aeada6185737b118211415692d83e54697127d58dee014d24162bae2c26d39926dbcd2b551c8ca87ad99b6be2a7b
TLSH
T15B412A58BAF91158B3B7AF66ABF7A4AD487A78372F06D05E00110E4F0622B00DD71B77
MD5 SHA1 SHA512 TLSH

Submit Download