hxxps://share[.]evernote[.]com/note/a68f02bf-1e95-40af-3614-fc55eb204cbf

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://share.evernote.com/note/a68f02bf-1e95-40af-3614-fc55eb204cbf
Sample260720-lp88psdv6r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3520	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290142579681307"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{253995F9-D7F1-457C-B42B-1C95D8A30E5F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1684	msedge.exe
1684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 648	628	msedge.exe	85
PID 628 wrote to memory of 3520	628	msedge.exe	86
PID 628 wrote to memory of 388	628	msedge.exe	87
PID 628 wrote to memory of 388	628	msedge.exe	87
PID 628 wrote to memory of 388	628	msedge.exe	87
PID 628 wrote to memory of 2080	628	msedge.exe	88
PID 628 wrote to memory of 2080	628	msedge.exe	88
PID 628 wrote to memory of 2108	628	msedge.exe	89
PID 628 wrote to memory of 4524	628	msedge.exe	90
PID 628 wrote to memory of 2108	628	msedge.exe	89
PID 628 wrote to memory of 2108	628	msedge.exe	89
PID 628 wrote to memory of 4524	628	msedge.exe	90
PID 628 wrote to memory of 4524	628	msedge.exe	90
PID 628 wrote to memory of 4444	628	msedge.exe	92
PID 628 wrote to memory of 4444	628	msedge.exe	92
PID 628 wrote to memory of 4444	628	msedge.exe	92
PID 628 wrote to memory of 2196	628	msedge.exe	93
PID 628 wrote to memory of 2196	628	msedge.exe	93
PID 628 wrote to memory of 2196	628	msedge.exe	93
PID 628 wrote to memory of 3084	628	msedge.exe	99
PID 628 wrote to memory of 3084	628	msedge.exe	99
PID 628 wrote to memory of 3084	628	msedge.exe	99
PID 628 wrote to memory of 3432	628	msedge.exe	101
PID 628 wrote to memory of 3432	628	msedge.exe	101
PID 628 wrote to memory of 2844	628	msedge.exe	102
PID 628 wrote to memory of 2844	628	msedge.exe	102
PID 628 wrote to memory of 4812	628	msedge.exe	106
PID 628 wrote to memory of 2536	628	msedge.exe	120
PID 628 wrote to memory of 2832	628	msedge.exe	121
PID 628 wrote to memory of 2272	628	msedge.exe	122
PID 628 wrote to memory of 2172	628	msedge.exe	126
PID 628 wrote to memory of 2172	628	msedge.exe	126
PID 628 wrote to memory of 2632	628	msedge.exe	128
PID 628 wrote to memory of 2632	628	msedge.exe	128
PID 628 wrote to memory of 1684	628	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://share.evernote.com/note/a68f02bf-1e95-40af-3614-fc55eb204cbf
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffcf500c188,0x7ffcf500c194,0x7ffcf500c1a0
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,1503944485082381050,6462356985740525043,524288 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,13284395439335086498,3402391199432002092,262144 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:2
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,3177159569498737055,9495046862383780328,524288 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,18439192762420976336,6330718293691615785,2097152 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,11135445274916685616,10455921078336652850,2097152 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,13104239939188628828,14409529630827863546,2097152 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,6041581871384309106,16684938661040308276,2097152 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3568,i,8925098642964246304,5872583805483442965,2097152 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,1230280944842222721,1307870593925419371,524288 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,16622129704823306167,9919373391554930735,524288 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,5356755247205160695,4262741604565010319,524288 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,5356755247205160695,4262741604565010319,524288 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,15958264928168280486,12558594032522077484,524288 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,3404738728223627765,12275469551490425042,524288 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,17445194134939456442,39379989642545680,524288 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,255720785717035837,5969136320264118030,524288 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,13020737391208294270,3269498514826580515,524288 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6216,i,6597790259966252346,8403940868200446285,262144 --field-trial-handle=2856,i,17400941310806745078,4506304138146699413,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5b016a586ff83d80326bb30bae053760ef5bd8d390c69c8f6b2092414362c9b3
MD5 f192abfd1d01f911c85298cc19608d9e
SHA1 31884c02935c336a41436556e3b7b073b7bf6799
SHA512 84e144d5a43fe3be07b0ce581a7976f0473d80f7edb07b5fa464db507289d4dbaef15951930965008015349ea5778a1e0a98e88b9ecaa5171dd319c592f7df78
TLSH
T1048196380E6F00B5F3B11FF2B3D14B45347E82EBF997BD9652806A70791A7A1B2D9504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c38a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c38a.TMP
Size 3KB
SHA256 41cd851cdb81987a5a0141f1e47a8baefc8be97e7ab8c202ccbbd80618863dea
MD5 4f551c3cb8df9cdc5ceabfa8debc75af
SHA1 f21f6a4958a5a7f613249324dc3d0e271eccbb21
SHA512 5ea54c947d44a8cb350a89d2a89f3caba429c47d5203018bedda25cd4e7dd08f79d514ee1693c6853c1fe43f1498b7e24cc9aafb35e917d06400dac28455c50f
TLSH
T13581A7380E6F00B5F3B11FF2B3D14B45347E82EBF993BD9662816A70790A761B2C9404
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_lite.evernote.com_0.indexeddb.leveldb\000003.log
Size 28KB
SHA256 b4f16be606e119fd3ad55427f19e3550386d10d661d23ad42142c244ac6cb46f
MD5 712c393a64e91d1d1179c6eaecb95dc8
SHA1 5da14aa6169b9e11e6c82da6fadf529c454f5f7f
SHA512 88b8c08644edb43dfa4fbe845ed07e5c232b81144b8bab67e52763ed6774fbb4002f0bc7bc49e816ca7dc7dc93f06d092028190fac9c987ca91a9657fba2c3d4
SSDEEP 768:zz75NDQfWa8WpLFZhENWyqy5auqZHukWKcpqZpGZFxsa5Y:D5NcfWa8WpLFZhENWyqy5auqZHukWKcQ
TLSH
T1EAD2FFAF6990CE27D5BE0A7145A41FC25BB73D81BCC1984FE0C5BB3C8876A619C70B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_lite.evernote.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_lite.evernote.com_0.indexeddb.leveldb\LOG
Size 355B
SHA256 643a107b9d1586f3a026dc3d2701f73c0b0b135458d69e632be0c4fddfeae1dd
MD5 61a8a4e6d14d8266a2435692c22c879b
SHA1 9c085d823ae6822dbfb02e0a214e1a8a45e4b104
SHA512 397a36aed227ad8d63782e4adb32e8f09e2260369bfa7e806449b85a661f51295386f7181b48dea3a57163abd18bc42fda035d31ed78b54a3a1e8b4d8ac899c0
TLSH
T120E0D87C84C9C52B511465A6553C7B0EBAEB361EDBC8BD464E05EE20748A444D16E2D2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_lite.evernote.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 48250fbe328dcc9cdbfa10ffc0de13a25f81821b8197267ec45d81d77d353f29
MD5 ad447c29be13622c1670409546164472
SHA1 d06e2bbb35568248cb10729a50808b1ae75ba669
SHA512 1a6b8984f38d16c2e5145d602281c10a4597500c192e7c266206c0cf68d64032c1bada7afa0ff6b48f6e766ccc95ca8da4e96c7f1284b7645f4685cddea94484
SSDEEP 48:YALlN7O9VC9Vg9VzP9VI9VcXFP9V9Yz9bsEzEsN9Eis79wzsb9psc9csp90s3CKf:D5O2kfc+dyjzRa7ZXNYddMt5wQ
TLSH
T19F81ABE6C7E4C52ECC2156F0BA256F1BDE2D0D1483187C1AC9E4AFABA7E1430E10265F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a8d5126b3c0c6a959e6bd77a7ee0eabe767f49ddeed7de6bd6970f32371eea8f
MD5 18303ddfb7a78e8928f01be80ed4ffb1
SHA1 6109013724d953b19fab9b64c7f25445720eb3bf
SHA512 9f7a1eed224fa9dcc4deaf87270b15287b107333851224675290f6d1cabfd1487a6e28667140b6b74b0d82d6d4f9ed3bffab916bade94d482df112ba173d6b42
SSDEEP 192:sxZaR/yM/jK1Ml8Mk+/f1s4UJozIdpwNHW6+WNteN/YzubJ6IgrJ:sxZalM+/f1s4UJrUHbC/A9
TLSH
T15E42D7166A349977CCCBD209FA55BF53D6F55472E2940E44AEFCCA1C00E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 82e20c1cabee22a3b859818c104476f21a1d8a469e367bdbdc003a483b67e788
MD5 5bcb9a3464ecc99ec2afc2118b83599a
SHA1 74b880b9a51a10b1a83103988df27eaba7623385
SHA512 c8ecc54fc3482756c1cd6c5a17139a9655b7713ea19cf86aa4649ced11700f403ed7828091700303f8cf4baed490519e99f5a52904548e58927ce0caed04a470
SSDEEP 192:sxZaR/yM/jK1Ml8UQRk+/f1sMUJozIdpmNHW6+WNt+eXYzBKJ6Ig5LJ:sxZalqi+/f1sMUJraHbdX+L
TLSH
T14452D5566A345A77CCDBD609BA45BF53E6F41472D2940E44AAFCCA1C00E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0f97a712e7fec3dc0c91b40237ef3aa64f8431a45f1f3286bc58433462d7a5e4
MD5 ec8ea9faa1e88addd82ceb98e506c81d
SHA1 2359613a9632ecc6b766db92c4cc2db061cb18cb
SHA512 cf32126fccacde617b8844096a9c9826acfd346a98ee520083eb21364933ccf82c893842ac9648a8bdf975a85b820056606abb828a60c916cf620fbd205453bc
SSDEEP 768:oPW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjDroI7iPYL:oPW7kf0Wvqidau1jaa5LA3jwQL
TLSH
T145D20A3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 224b506bdb890ca9a87d4db50b2dc82fbcb81451b42295a9659b996d2a70bc2f
MD5 0c71213dfac631d5568d31adff5df665
SHA1 f4befba229f2469201ae83c78e43363230a943af
SHA512 8dd51977dd4c071aaf17da28ee85ce2a6aee347b5ed03101f001bb8944f6cddb3699b1263f685f0fdc2f78582ebc84793f904984dc3ebd620089f3fa6fd78e52
SSDEEP 96:KIbCKc061e6UccuKMf10auKsb0IuQCa34qv+XeKEcLzOKgI:sCFpBI
TLSH
T1A6914302713F060138BD28189666DA379E8272573514A4FF7BB910631E67E118EFEEDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cd16bf5-d4b4-4e62-b7a7-149f0488f19a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6cd16bf5-d4b4-4e62-b7a7-149f0488f19a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 39b287c30bc696bc499e6b458891efe32027beb01a8e3f3cc6b1835df8f33f32
MD5 a11eba9eea37f7646e7784922af8d536
SHA1 86e1f3a24177a4e63a8e118c421f1faf640be31b
SHA512 9d43d3ab8102b36f6624670fa2d0cfaa5bb51eb384da6cebf9b472fbb0c8e14bb5c0e31c2d353b29e2bed8f7c1f601853d897bd81161a54cc3661c38b7153d6b
SSDEEP 384:7tNn/s3n9SfsNz7SbNm7ORPIdEaACEJr5ROObjI9G6w7NO:7j+9UXecQyh5R29Mo
TLSH
T182929D355C255D378EA26655F48B3A175EF4413FD3C92E88E6ECEF0C05EB6AC4312816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 03a5e6f251642264457464559e11fba770f73bc193302ce7ade64905475296cb
MD5 f49b3539e104252a75ee068f12d0e1b7
SHA1 0eec0fcc74fa1d64ddd56a3f4903f68465f9e3c1
SHA512 c3e2eff9e91dab613e4a600d97b0d9b7631c62f9fb15fe23d26fe75eadeba4eb8a6b72607f2abb583d3c0836d34cd07800c3089c3f913175f0cbb62b8dcda601
SSDEEP 384:yiF1tNn/s3n9SzzsNN8TUNTUlIlySbNm74RPIdEaACEJr4ROObjI9G6w7NO:5F1j+9wkwg7euQyh4R29Mo
TLSH
T1C2C249F648D78936D9AE5B43B77E3E035EBCC16BB5852944B7989A0CCC961BFC302805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d455d927ed5e932297af222d98067af8258c0f747a51a6b8808ec670886a51d6
MD5 27d67ba07abda8b80ef9d431cbdc5248
SHA1 965fc668a873cec541f0d06114710cb7a0a20ea1
SHA512 6a792083764ffead7215ae1f70d40cc805b8eac959d6271120e24a63158763259935957cdc0f4ced32d079a668f10c3c306083b56854a0cc6a5733af693def44
SSDEEP 192:zONm64BsQmiUyMZCMcN5GBPKXo+FdGJaV6FC1SJr9WwbqWU6:zONm6e8/Z3cNTdEaACEJrhRU6
TLSH
T112120B3598646C7B5EA2B541F48737135EE8413BEBC96F84E6EC6F1C01EF69C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 44efdef8f01645c709cdc354231c3946b98ab34c9b8fdc87f896c7ce64e4dd2e
MD5 9a47144ec2c161b9c4555e91569f85b0
SHA1 d541d76fee1e04331f9889acb6d8677f6978254a
SHA512 3845f96751f3e29d50c3e13ce7415bdbddb1fb367c375fd343824ee8a9607082a9ecaf0cbcb3da997735e22bec527f02175749b0c41e5eadf56b3c95ebac131d
SSDEEP 192:MON664BAQmiUyMd1McW5GBPKXo+FdGJaraDMhLU6:MON66eA/decWTdEaQyLU6
TLSH
T15502E939AC786C7B9EB2AE45F58737175FD8113BE6C55B44EAE85F1C009764C230382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 410957137c0b139fffd9746205858b48f8e9abc5f1c73255d80fd7f3cd4e26fa
MD5 f7738eb3f1f2e8c16d4269e8caaf535a
SHA1 a2ca3f68ebb4aa092a0d683511b8d3159a9ba22a
SHA512 3ece52810737b590e3d19f1fe14c13fec8e7f7343aedda75095e02777975f10d21c863cdc036cb98e0b9a8ef94d69904f3b8540f542188f54abd6b738d9c888e
SSDEEP 384:YtNn/s3n9SfsNzySbNm7ORPIdEaACEJr5ROObjI9G6w7NO:Yj+9UCecQyh5R29Mo
TLSH
T15392AD355C255D374EA26655F48B3A176EF4413FD3C92E88EAECEF0C05EB6AC4312816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f89d8e6d-9678-4c2b-ac0e-7b77beb38c46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f89d8e6d-9678-4c2b-ac0e-7b77beb38c46.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5a7db41ab9557e2727283c527b68480560adbeadbeee6be91f85a561b7a8dde4
MD5 e19710fba89ccebeac3578f6b5457338
SHA1 5b622e4c7de7ace22978cfcf10bcb7a3ce8d6baa
SHA512 251bc16f55f3fc2ba3a2b8283f7cbc8d572603412b3d860f934e6cf259824ab096de7747272d81813fb76b420ca284ee86be80615bad1e7a8c51dcdcfe923dd8
TLSH
T1E2410758AAEE1148B3B76E5AABF7A46D587B78772E07D45D10110E4F0A33B40C9B1B33
MD5 SHA1 SHA512 TLSH

Submit Download