hxxp://moovlixapp[.]com

Analysis

user interaction
yes
max time kernel
148s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/07/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://moovlixapp.com
Sample260720-sdblmafy7w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2644	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290332182851544"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3054922120-1500138384-519748408-1000\{10781BB6-E8A2-4B24-9291-8D8DD28579E0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2524	1692	msedge.exe	83
PID 1692 wrote to memory of 2644	1692	msedge.exe	85
PID 1692 wrote to memory of 1956	1692	msedge.exe	86
PID 1692 wrote to memory of 1956	1692	msedge.exe	86
PID 1692 wrote to memory of 1956	1692	msedge.exe	86
PID 1692 wrote to memory of 3920	1692	msedge.exe	87
PID 1692 wrote to memory of 3920	1692	msedge.exe	87
PID 1692 wrote to memory of 3884	1692	msedge.exe	88
PID 1692 wrote to memory of 3884	1692	msedge.exe	88
PID 1692 wrote to memory of 4684	1692	msedge.exe	89
PID 1692 wrote to memory of 3884	1692	msedge.exe	88
PID 1692 wrote to memory of 4684	1692	msedge.exe	89
PID 1692 wrote to memory of 4684	1692	msedge.exe	89
PID 1692 wrote to memory of 2320	1692	msedge.exe	90
PID 1692 wrote to memory of 4060	1692	msedge.exe	91
PID 1692 wrote to memory of 2320	1692	msedge.exe	90
PID 1692 wrote to memory of 2320	1692	msedge.exe	90
PID 1692 wrote to memory of 4060	1692	msedge.exe	91
PID 1692 wrote to memory of 4060	1692	msedge.exe	91
PID 1692 wrote to memory of 4132	1692	msedge.exe	95
PID 1692 wrote to memory of 4132	1692	msedge.exe	95
PID 1692 wrote to memory of 4132	1692	msedge.exe	95
PID 1692 wrote to memory of 1280	1692	msedge.exe	96
PID 1692 wrote to memory of 780	1692	msedge.exe	97
PID 1692 wrote to memory of 1280	1692	msedge.exe	96
PID 1692 wrote to memory of 780	1692	msedge.exe	97
PID 1692 wrote to memory of 4004	1692	msedge.exe	99
PID 1692 wrote to memory of 1404	1692	msedge.exe	104
PID 1692 wrote to memory of 3560	1692	msedge.exe	105
PID 1692 wrote to memory of 3552	1692	msedge.exe	106
PID 1692 wrote to memory of 4812	1692	msedge.exe	112
PID 1692 wrote to memory of 4812	1692	msedge.exe	112
PID 1692 wrote to memory of 1760	1692	msedge.exe	113
PID 1692 wrote to memory of 1760	1692	msedge.exe	113
PID 1692 wrote to memory of 4184	1692	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://moovlixapp.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffc73b0c188,0x7ffc73b0c194,0x7ffc73b0c1a0
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,116703342094055564,7128191899645731885,524288 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,11888549301693107220,671784668478174278,262144 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,10571387346997005556,5705365564403468308,524288 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,9781615620235289475,1670755348024734730,2097152 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,11476556215229564182,826545991394665498,2097152 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,1861256079975161613,15069233197271387749,2097152 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,8751490586941255438,7137155908741767807,2097152 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5132,i,9882293011254844127,11825689317503862967,2097152 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,7086036062339867924,7323457645645337603,524288 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,11633911314509504686,16055361760414875515,524288 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,18059309746583925421,10041154226915780414,524288 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,18059309746583925421,10041154226915780414,524288 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,9749895695526749983,5741084317037104376,524288 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,12891802149213082578,846875188955772025,524288 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,18194193707102291455,2426253545005296300,524288 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,18264853494387901432,6656821403225181623,524288 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,3124332587751707047,14085636404840487899,524288 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6560,i,14988384866366362200,107000750640324402,262144 --field-trial-handle=2344,i,6173815563402715699,17661738922384541285,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fb2adc73b0e2921e667c28899e7c4f830fbb29c7f563ca0b3319ac4cd7007983
MD5 5a6df42dd698122d665520fb12140c37
SHA1 9d09f6fa2f10e669a83386ff53aae5fba73effeb
SHA512 52513e0bbf5b162ddc3643441c215f197264c32736ed560286ad3dcfba5831b89dd961ff3c2ddda1a50ae1bbaf4589e17ef43817fe8c3294ca18c88dec2e21b4
TLSH
T15DD012317B5BF001C6C120B2D8348B79923F889A74D7C652B024C88EFDF625DA3D6067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c2c9a9ffe645bb4483011279363f1d6b7efe3d1311c969002595db89e2e28e26
MD5 fd1a71c5f52353ab70a63caeadd8a35f
SHA1 1c2efede69f9484a6b25dfb9879b2e134c0c04fe
SHA512 53bb310c44087d0ad54291ea32ae8e6708d9e6675875d074264aa49b27317393b3c1f0758bd53b04795df767f42392d93ad325da28f085258329151e4a47a03d
TLSH
T12ED09B213756A001C5811071D4244765512E44557497C6527014844DEDB61595395057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 47d2a76876595fc5725e36c673b11370b847f67b16578f66195c94e090989811
MD5 a993cbd81787e2d17773cd22b7aaed97
SHA1 a2fd90e7d3567cd0d7fbf6c8fca82b9c5181be0f
SHA512 ea6344b8ecb320da497d2c0e70611b196fce67f6e90df05e34f48b1bc92df0527c9d931896be748bdfad74f8c693956424ed7321c1da5d5f7725af3357fb639d
TLSH
T1B2714B26020A44E2EB7CCCF14CDA024EB676877269631EC63538587476EBBCB4035F48
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588d57.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588d57.TMP
Size 3KB
SHA256 95e2ea7651849fddd7adc7afe21a09d8dc6143001582721f2d3aef77272e6b21
MD5 a560fbf4fda475560b8c73ec76724f8c
SHA1 438be7186cb646e55d62555a1948eff5bf48a8c4
SHA512 e71615edf4502107a916bf5e57a4258244a28c2824378a7611459355b3b3ac2cb3e6375128ba649f7bc513a270f7528851b98f257195aa303d28b32fbbb633c3
TLSH
T1B4713B2A020A08E2EB7DCCF15DDA024FB676877269631ED63178597076DB7DB4131B48
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d8b15f8dfa9f619d601570786a6525dac7036a16dcd0f441682b91616e143b07
MD5 7a0a9e44c8fa2076c3fece2681b9bb9d
SHA1 77fcab872145faa3a80b20ce8a0c640c7ddf1dae
SHA512 ca21149eb7e51e030cfdb42d7c3bb366b1d18cbbb99cba37511cb74db02546fea902cb7425eb9a34b26158b7a8081f200233c1e4fa316700cf9143435a2cfdb2
TLSH
T1CC618CB7C6D4875EC81552F067147E2ECE2E192452283C2BC9E5EF9BD7E2872D20168F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 768aacb427afa61d9f0367678d884819e04f26ae097e815120bfc9db767177f7
MD5 3d9ccd284a70a0271f9f869442816bb6
SHA1 f8863e6b17e32605dd49350013364b410e0fb0a7
SHA512 d12228db206e92fb61571788bab7b0aeff2b7e836d4c58f4b91fd6cfbab352efef937fc09426ce28784265020e76553dd79437040b17e9d843fb5c48aa65d9d0
SSDEEP 192:sxZ8RayM/jK1Ml8UQSka/fAsXqqAmIdpzxHW6+WNGXN9Ynjiq4+Ig5WJ:sxZ8UqRa/fAsXqqAHlHbI9OJA
TLSH
T1F752D716AA345977CCDBD209FA81BF53E6F55472D6940E44AAFCCE0C00E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ce9ff262ca5d0e2dfc6a12c76a2964a401c12b3940f1180e86620dc386bba03e
MD5 a48ee99c3b6bf42eb09b09f6d88c5ea2
SHA1 d0b1d8a63ff279f1e84178c93071fe8388ba2f5f
SHA512 5a5fcd3b52dcedc0851f17401dd77f81a863c6c060a34f2f39e8371056ee3c1a8480bcfb506bfa3815fe8ff4654776e483597b29368b7c2f351f9a1fc2d57b16
SSDEEP 192:sxZ8RayM/jK1Ml8Mka/fAsrq/hmIdphHHW6+WNGs4fYn0rq4+IgrJ:sxZ8UMa/fAsrq/hH9Hbif4J9
TLSH
T16942E816AA345977CCDBD209FA45BF53D6F51472E2940E48A9FCCA0C00E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b18a52ee449b7c62a4f4d86f0e78e10943412367510b3358d33c4044c99281e3
MD5 01794199d2fb6729b93b37a01205403e
SHA1 d94ec8b1e8e1e0b84dee4e249dfe78290dba67d5
SHA512 e5ae8b3158e2f79075b0a4099ea08661649e4fe2dd85198f1cbff88effab6955325ccd96430d8080a84c33b4b93f246d6e8c54acce572f1e3a26bebbc32572aa
SSDEEP 768:BUQRMvUWv0sTg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlTBshiro/xMxDp:BUQRMvUWv0sTgu1jakTLROh5/xMx1
TLSH
T178D20C3B284CCB7E4F841E6CEC26AF976DD801CBA7984D5447FA884C03C77EA511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0fe11ff1f90675a73d18ac18e65c528726f81227f213abb273a78e5e69beaa81
MD5 059635d952bd4af90b9b1f42a5bbdf6c
SHA1 798b71d2bfe753ac26d1ae73dd3412099b7df22a
SHA512 03456eba97852f5ac2c2879b35f4f24497e3f36f11d467df0abadb35fb82e6118d57c3a2765bdb4e161a593fc09b19776c4c6330b6e66523c7620c59ddd503f8
SSDEEP 384:FtNn/s3n9SfsN8kJUfe2IMuX54atKZkRzYo/hFOObjI9G6w7SUH:Fj+9UdfShxIZkFnT29MT
TLSH
T1B6928E36A8389C774EA39556F5873A1B6EF4962BD3C43A44C5DCAF0C01DF29C431B515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 4defd4dea98ebf0a19e975c24139e5a79bf7b7d3381a19d813c47b4276303cbc
MD5 961274401b8d1f4991d24c060b2a4531
SHA1 8fda1979331e5057545289c89736c6dadc73fed3
SHA512 fccb4e3e21c7920dcf3cbc9407bb5ba6d26d0ecf93ed77568ee0f0de569beb28a272bfa347571108ac50af8471d63501e1e78edd6cbd003fab2dffa7dd48be70
SSDEEP 384:otNn/s3n9SBzsNmkeUfe2cMuX54atKZkRzYoihFOObjI9G6w7SUH:oj+9CIfehxIZkFaT29MT
TLSH
T1A1B206F694E75876C99E8353B7BE2E075EBCC217B2842A40B7D85A0CCD8A1BFC306515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9477e6b88423f6990361c5845f72bb6de2759abbd03473387ffa03b06b7bb6f4
MD5 89a2adc99904424c1ee9a693e7c1cac2
SHA1 d7252c6407610c1adfc39b6d261c0c1899a57fc5
SHA512 01b9c175a6e87c45086724e6e89a325c4811a3696c456071ff6cdfd5d0bd4a12ded332a360de4c8d311863f9b39b8e39132a1054ced2f64273989731e9b5c9bd
SSDEEP 192:CONx6G+bgQmiUyMrDE54aP1KZoL8OyYCPU6:CONx6HgjDE54atKZltPU6
TLSH
T11802C939A8782CBB9EF3AD45B5872B176FD5112BE6D06B54C6EC1B1C40DB28C1307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 161effa2e98ba33d88905546d6ac7e991f0e331fae082f612d0f3774cc56c108
MD5 54ef81a322143c100c1c7d9d0e91e74f
SHA1 715bfd2ae829a2751b8ea6c92408a15e5ce06d0d
SHA512 504c78e156ac2c1abdb38f7809fe90ac7d735287ca9b97e2cdab3a787fc9820f5f9e9364593f29c1b4870d46224bbac16f001da849ae5280ecffc27400705d89
SSDEEP 384:FtNn/s3n9SfsNmkJUfe2IMuX54atKZkRzYo/hFOObjI9G6w7SUH:Fj+9UDfShxIZkFnT29MT
TLSH
T17C928E36A8389C774EA39556F58B3A1B6EF4962BC7C43A44C5DCAF0C01DF29C031B515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 75c26fbf7b25857030434fe604fba9543fc956533c41495a8341138337b10b23
MD5 66bb342ea86e216161e4b381846f502f
SHA1 b875178e367c2b284b01aa5a73823699e00b2141
SHA512 465be0d36dd7132224d37e95245087a21f42f91a13c2370ff7ca938bc242fc57b631b22a6ca566a29534deb49e4383f932f6b886196486fb5daf8ac2ebb92d10
SSDEEP 384:ktNn/s3n9SfsNmkeUfe2IMuX54atKZkRzYo/hFOObjI9G6w7SUH:kj+9UIfShxIZkFnT29MT
TLSH
T1DB928E36A8389C774EA39556F5873A1B6EF4962BC3C43A44C5ECAF0C01DF29C031B515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7c77432bc309288a2cf2215882f51c2221a8875ac7c648b15efecbba032cd059
MD5 c70d251a7d5f176d30d8d9c6b8558649
SHA1 185c0b1260ab2cba6bcca4b3dee9f03128f86d88
SHA512 20934154c5b08b763fcc68b3758f4bac87f0ed50f16a7318794e017b6eb8e384b627439caa2694fbaae21926b08b3c267cba585ecf6c8c703d282f71767533ff
SSDEEP 192:3ONt6G+bgQmiUyhr3E54aP1KZoxRXjPwo4i8ShhDq4tU6:3ONt6HgE3E54atKZkRzYovhFU6
TLSH
T108120936E8786C7B5EE2E495B4873A176EA94317DB84BB50C5EC2A1C01EF29C130F526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 74e4ffd42209bd2c3280c0d86a54f641a7452b7f5f54699a59709465eab0998c
MD5 8dcda6939494ae4104b7b572ee08acdd
SHA1 eafe19bb58a308f30a3df8e34ec5f87e2d8dd4d5
SHA512 67ae565921575fdfe5718f13f0cdcea18c4e0be7cee507ec176916603800329a7b52bae8f071d38d6a8dd469dd1a5d788b14c109dd7fc37336423e5e975a5f68
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe587cad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe587cad.TMP
Size 392B
SHA256 e49abf6218dc8e8df884ca35bdeb68862891b9be53f1830ce4c044226ef25637
MD5 28ff4fff9606bb9c13be330514913f61
SHA1 f3f09ebe8107662929a4330b52bf8c68ec8183e5
SHA512 278de2c21f54f1bc0512ea39519f411fd7f341722ba7880b3555cc7fd9f1f361564f6422728f5310e923b0816b7ad417433c0f689f1ad9eb98546254cf8835dc
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4d308b6327b9ea505033a25e02ee2d8de6290d70ab5b5137e926afc7a214aa91
MD5 88660148a5420e2686b2e02d491185e3
SHA1 a692e6ec8a4722c9c0f9cbd4e29b1fc0ec241562
SHA512 fed3e3b562a312892ab9da6e0d3225c2bf8b58384ab6d8f2f130fec081b76305159ce4abb195b428c92cd391fc66f3c687f87bc89be2a336ca0e198e82c05c88
TLSH
T18A411A59A6F91108B3B3BE5AAFF6986E487AB8372F07D41D10010D8F0A62A40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download