hxxps://ctrk[.]klclick[.]com/l/01KWDTKHF2KK0KCNG8ZZA11SGT_27

Resubmissions

22/07/2026, 01:37

260722-b136qahe377

22/07/2026, 01:31

260722-bxg43sxbkb7

Analysis

user interaction
yes
max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ctrk.klclick.com/l/01KWDTKHF2KK0KCNG8ZZA11SGT_27
Sample260722-b136qahe37

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2588	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291578676250633"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{07FE8307-CA8B-46E7-BB31-A53433FB94B8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 4776	3060	msedge.exe	86
PID 3060 wrote to memory of 2796	3060	msedge.exe	88
PID 3060 wrote to memory of 2588	3060	msedge.exe	87
PID 3060 wrote to memory of 2796	3060	msedge.exe	88
PID 3060 wrote to memory of 2796	3060	msedge.exe	88
PID 3060 wrote to memory of 4564	3060	msedge.exe	89
PID 3060 wrote to memory of 4564	3060	msedge.exe	89
PID 3060 wrote to memory of 900	3060	msedge.exe	90
PID 3060 wrote to memory of 900	3060	msedge.exe	90
PID 3060 wrote to memory of 900	3060	msedge.exe	90
PID 3060 wrote to memory of 1824	3060	msedge.exe	91
PID 3060 wrote to memory of 1824	3060	msedge.exe	91
PID 3060 wrote to memory of 1824	3060	msedge.exe	91
PID 3060 wrote to memory of 4128	3060	msedge.exe	93
PID 3060 wrote to memory of 4128	3060	msedge.exe	93
PID 3060 wrote to memory of 4128	3060	msedge.exe	93
PID 3060 wrote to memory of 736	3060	msedge.exe	94
PID 3060 wrote to memory of 736	3060	msedge.exe	94
PID 3060 wrote to memory of 736	3060	msedge.exe	94
PID 3060 wrote to memory of 3992	3060	msedge.exe	98
PID 3060 wrote to memory of 3992	3060	msedge.exe	98
PID 3060 wrote to memory of 3992	3060	msedge.exe	98
PID 3060 wrote to memory of 2176	3060	msedge.exe	99
PID 3060 wrote to memory of 2176	3060	msedge.exe	99
PID 3060 wrote to memory of 4308	3060	msedge.exe	100
PID 3060 wrote to memory of 4308	3060	msedge.exe	100
PID 3060 wrote to memory of 3788	3060	msedge.exe	102
PID 3060 wrote to memory of 2396	3060	msedge.exe	108
PID 3060 wrote to memory of 1136	3060	msedge.exe	109
PID 3060 wrote to memory of 4108	3060	msedge.exe	110
PID 3060 wrote to memory of 1824	3060	msedge.exe	119
PID 3060 wrote to memory of 1824	3060	msedge.exe	119
PID 3060 wrote to memory of 4572	3060	msedge.exe	120
PID 3060 wrote to memory of 4572	3060	msedge.exe	120
PID 3060 wrote to memory of 4572	3060	msedge.exe	120
PID 3060 wrote to memory of 2080	3060	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ctrk.klclick.com/l/01KWDTKHF2KK0KCNG8ZZA11SGT_27
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x294,0x7ffb8ad8c188,0x7ffb8ad8c194,0x7ffb8ad8c1a0
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,1393246683492916622,411557882643448781,524288 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,11607547411935582902,2198739982131335344,262144 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,9276938758506286985,17520799264981883583,524288 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,9011651227092706100,4137115138243235287,2097152 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,5722831531189146465,8884031839337655872,2097152 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,3607996210966674261,5600896266967334055,2097152 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,4979217146773634946,13709802497718625956,2097152 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:2
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3644,i,5085885118491220203,16348226575463752163,2097152 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,4224802017112364037,7997631748637558503,524288 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,12509809726602496002,1708679736677397061,524288 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,10281405116113195200,12161807742585665883,524288 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,10281405116113195200,12161807742585665883,524288 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,15675064586970487328,3591527181487079872,524288 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,14284162677830777570,13822735128896416682,524288 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,15193770721666766184,17775117553759249696,524288 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,2318398477342646230,11511103330830938060,524288 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6448,i,7264104545297480699,972517773755495378,2097152 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6012,i,14672450918511629851,18327843811280056749,262144 --field-trial-handle=2308,i,16165080335767315086,17437745814821809957,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c1046505766a6460b1695ca375267df49a4e014fdac46895c1186ddd4c202483
MD5 b00a243d71ba694984c541640d8f8a21
SHA1 2dcb8335d95706f71038b7d9f97d698b4a0571ae
SHA512 751c3e87cd1612b1e50a4bbacaf743ca33ff934f160e33b3b39b6530d6f1b9a04f713d9cff0ba84720940efff93c690f57fc73714da69576a88d6956439cc22c
TLSH
T1067130340171C8ACE313B57980A5C2683CFDA5E8F8571E87D191DA362929FE0837DCBA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59016d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59016d.TMP
Size 3KB
SHA256 c846bced6dbca578021e5099bdcf0e7579dac755f5a84dd1513579e72ad22966
MD5 441fc2d1ab338a5f64c62e982526f3dc
SHA1 4aaf1efcd28921d3d1498fcc7aae38a763929e67
SHA512 1ee4ed0f4282e97f9e667c428ac0a15b8c326520110eeb3d0b90afbe23f35144768c81713c37538f3adc88e8089f0e4f6f5c48afd9a8a26d898a8c31ab0b8dc8
TLSH
T17B712F340171C86CE713B47980A5C2A87CFDA5E8F8571E87D191DA366929FE0837DCBA
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 8ef1defe89e0f519cefccf77288943a200ef151d48ed26c8cecc19942cc74caf
MD5 f06c3762e86f1cfd4d0035dbde88041d
SHA1 47aed58453385c2387bfd99091847efc5dddb01c
SHA512 f06ef7986f03ae4a981ed534ae8c4030b7ee55d1d5d700694a9d79b5bb14f22f87d12493ddcbb8bfc49d246391158149b73fa489ed8139a2b733689ff0b1d36c
SSDEEP 96:D0OpkDJzBu6/mgfpf7v/QzJXjwBLLvplgF:D/pkDJ1j/hfpf7v/QzJXjkLLvzgF
TLSH
T12A919DBB82F4866E8D0191F1AE147E2FCE1D0935472C3A1A8BD49F97D7E2471D20668F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c60da393dd4c202a45968137d267c107e56267e0ffad4dae591c1e65bd3d9508
MD5 fea533e0fc0f80b88f0e64f151f9ed4c
SHA1 7a0819b6db37ebea11f101143a283ce075accb25
SHA512 11aa24b080a31f38baad2e569707b20e1c263943dc91b7c527face2b5b68210062ce4c345e63eae96c14286e7356f07125243649118ef6c0ceabd78daec69477
SSDEEP 96:D0OpkDIxozBu6/mgBf7v/QzJ73GjwBBLvpCF:D/pkDIxo1j/hBf7v/QzJ73GjkBLvgF
TLSH
T178A19EBB82F4866EC80191F1AE147E1FCE2D0925472C3A1ACAD5DF87D7E2431D21668B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fbacc213fd2c8b3364ec8a1802dd3199f8386c8187bd77da4f91429271513586
MD5 c2e7c9b0ffe7d914c3c796fd1abbf3ab
SHA1 62ec6db8c25fd227dc2a75cf1dbe9894c26677b2
SHA512 11a15c5c992cff3d80de18f72d6d7ee6b1037ea6f788b0a4f412a8ecc594309838f67a2e1703797dbb9f5ccb6d50eb8d27e37a8d6adba6eae219d0af4e190901
SSDEEP 192:sxZpRMyM/jK1Ml8MkL/fOsw6K2IdpyDHW6+WN8ta/YzRVTIIgrJ:sxZpWML/fOsw6OAHbP/79
TLSH
T1E542D7166A34997BCCDBD209BA41BB53D6F54572D2941E48AAFCDA0C00E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1735471bf5d7851a05de2b965f7aeac00c791eeaf8f4c337ded6f8dc5204f88c
MD5 e0f02b12bb3f4b5df323e09a6a315c2c
SHA1 fae6536e4de115a94883dd033f337eeb14738a1d
SHA512 7fe868acbf2fd53ebc5139d151cb986dc312298b8f7306c397befb864be7dcc41cf7c8e55499c9a48e5d6cba6a8d7665b97b8bdb7e16628bf012bca008d04fcc
SSDEEP 192:sxZpSRMyMojK1Ml8UQ5kL/fOsGl62Idpw/EHW6+WNOQe1KxYzGwTIIg5HJ:sxZENq6L/fOsGlePHb9xvb
TLSH
T14862C716663499B7DCDBD20EB941BB53D6F55472D6901E44AAFCCA0C01E3BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 97fff1ad0f05fe56e011826b6fcd2796a31f4c918643558b6300269b271e37da
MD5 db00a0116df7c89cc5157553e706973d
SHA1 3df81d7303922091d478ee37eef5e84b730251f4
SHA512 4e24f7d773fa1c6b5dfd09ed3d7918daed3296ec9e5dccdbdec108a6cd38442042fa58b90511acaa06a3ffc1e2b7f530dc32fc79cde0bb76472e18f821b2cbe7
SSDEEP 192:sxZpSRMyMojK1Ml8MkL/fOsGl62Idpw/EHW6+WNOQeqIdYzBwTIIg5HJ:sxZENML/fOsGlePHbgdcb
TLSH
T1A552C616AA3459B7CCDBD209FA41BB53D6F55472D6901E44AAFC8A0C05E7BED230382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e4bf0a49957b92357b30de2041b425defaa37347391a917ded1f30795429bbb3
MD5 d79c815ec1d2236a545e12884bf3f96d
SHA1 9f0001d6b73f6b550828477c6db30ce1c2a5a02b
SHA512 a6a1b60128ff089943de2fbd19e61a4dc795163f4cccba763cf4ee3820b3a69c54320e9a65b14d67495304f7c5f76c91e4a2c3ba9796db56eb780a964a1586a0
SSDEEP 192:sxZpRMyMojK1Ml8MkL/fOsGl62IdpyvHW6+WN8LF3/XYzrFHTIIg5HJ:sxZpNML/fOsGleYHb25/XIWb
TLSH
T16452C616AA3499778CDBD209BA41BB53D6F54472D2901E44AAFC9A0C01E7BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4713d368ba6c4230d4836ef47b37a8069d6c9729ccda05e0992a09f94e382290
MD5 6a49174b6ff6b7e0641dda103842ad06
SHA1 fb8c999b530ad3a7528b4f7f5bd2b0f111e81d94
SHA512 826ef7143a08c638bdc9d4621d3e99c4a756c8706c714b25c50811574c291ef40c2c5c02ca504a5d433ebc503ecac5becf41bc12e3e64fc3c9f45e70cdf725db
SSDEEP 768:6VW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjtroIwi6YIu:6VW7kf0Wvqidau1jaa5LA3jGAIu
TLSH
T103D20A3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 e208c20c374dae3af6f47b23f253bdb7cf40bfdee567f9d3ba8ac384f1201d29
MD5 8503c028d52624de53b5c4cd8c9aa2b9
SHA1 78862bb61a9a7c4cc07e9c4b2115d4a3bb25f7e4
SHA512 d2e52ffee0ca6fc85fc9c1e100fef14c8a7ef0539b5d9b226e2013769971d04ff3ec79072d7cbd6023635029011b6be2ff5e647f8cb004767f5a12a7a789f11c
SSDEEP 96:KIbCKcXrOKcwOigAKVKmviKYkeiowKFi6k:sKFP4pXS
TLSH
T145E1CC66323B164138BD390CA75AD6779E4232A33498B46F7B7940660E27E135DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5913fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5913fb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 83117c72cc73d37ba7a89f7da6dcffc15d29cfffcde9fde2213f344085f7e40e
MD5 3b3d646bdf19c5a51f7276baa5f8d1bb
SHA1 2106800ccabc51643c829da09388ffe93108ddc6
SHA512 f438876d7f1d98c934f8dfdf972f108a69386d59fdd4a5de973095e58db868fe9b31dd37569596bb7362facb0eb03f00f2c051aabe048d3d60032610ef715f53
SSDEEP 384:liF1tNn/s3n9SwzsNB8TUNTUlIl32albBtW+I6CEJr1BLScjmwa:sF1j+9P4wgN7l7l3h1h1je
TLSH
T121C24BF658D7893AD9AE9743B77E2E028EBCC063F5806940B7985A0CCC961BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c9103fc6019c629065e6f30be8a1c176b583879aa9185c8d83c4775bac3f3696
MD5 91cc33b2da404867354cdc8e9acf98bf
SHA1 c80510f836b15e6d5e3110b5e692819037d9155f
SHA512 cdb5f0fd64bac32c3d94623526e848ff235b5094962911d8c2613bf6af71c3d61db94f112c3ea68e07d0e32146947f2b0a840a02154761774fc9ab15d42f2595
SSDEEP 192:MONG64BAQmiUyB1YW5GBPKmbCIgaDi5U6:MONG6eAWaW9IpmU6
TLSH
T1D902FA39AC696C7B9EF2AE45F48627175FE8117BE6905F44EAE81B1C01D764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d6a6bd4e1af5ea12e87f2d79f75b9bc6f5213fc4ad4eec5663f34f79f6624672
MD5 844826fd4b6780d9f646090a2f3eb71b
SHA1 a201000df38c17e31e3a5a8d268642637be39165
SHA512 a8f7b419b474465089c41a9f9021c48190abbd088889287df052418c3a7f2e9cdae195e130f90490af9df885f65933bee14f97eddd6fe6b20ba121ba47f9c644
SSDEEP 384:DtNn/s3n9SfsN132albBYW+I6CEJrmBLScjmwa:Dj+9UY7lKl3hmh1je
TLSH
T1F6928E76AC654D3A99E2A085F44737079FB44177D6C02F84EAEC7F1D01EB2AC1317A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 08c48a70c25961b95bfc43fda82bede1f02144f0854601f144f05e9bcaf4b716
MD5 4534ecb225d128cbbfae8d6cffb7ff8f
SHA1 5a86bb23232787948125653b0c99db458dfb5628
SHA512 6cf05d8dfa6b4b5ec654f92eb43e052bfa149454b4cf0b53cfb23f65e1c7075b9ce460c1d42d8b0085ddc91a0bb72697764389cc13913c9743a1cf25e556d23f
SSDEEP 192:u5rLsN1KQtpNlBb99nQmiU1ErJ4aGBPKmbCIR4FC1SJr0dNJq0Li4dKw:asN1KalbBYW+I6CEJrmBLpdB
TLSH
T1D4422A76A8B45C7B5EE3A145F48733035FF4816BE7842F84E6ED6B1C01EB298230691B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d86d747b5db4d5e79c33ba3fe0bc9e2a40cfb25ef721aeff02744945684ebe84
MD5 1b417e0e3b4d1422fbbf03c72c00c68b
SHA1 724300539279313feec7b9d7048a2622b581559e
SHA512 ee39b75cc384a872f680a738be3694d7510e3a917ccb5139bf021c4a4187c1a81355707183b51c72ba8ee27f7d8d99190a843d489e7ba115b8f39f65b7ea7e9e
SSDEEP 192:KRONw64BT1QmiUylYC5GBPKmbCIR4FC1SJruWwJq0LU6:eONw6ePfC9I6CEJrsBLU6
TLSH
T17D12F97AA8A49C3B5DE2A541F48737135FE4422BE7856F40E6EC2B1C02EB65C630691B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9031a2b24fbb39022fe88dafccf49f60a00c256ba08d4191e8c5587cebe2c1f9
MD5 537784f604dba95eb10665681a13575c
SHA1 bcb56bc8f1f46b7bc0b30c89dd97f1c18f455d64
SHA512 61529fd38d3ba2ed647c524f6e4a5dd8437d0ca6990f45047463a75011243887a1caf6eb8b46a4089f690712d4279709d85af8f5dd3dc20078f5b5d00575bd88
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59073a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59073a.TMP
Size 392B
SHA256 fae6ad9c6f8b99c0a2f6c97c8e642851ae0ad213caefa76ff21922989e45db02
MD5 8c6bc8ebba2d08e19b89e7add56f19bd
SHA1 8b4e81fe0ae30575524992eadbc9f8358691dfc6
SHA512 6c2e0b011b4cfc9dce8062d72662962ed036ccae0d0e876411f6a1904901aeccb2fcad19c293ddc5be3ad3079091685f180128e4e573ef4bf77e42ed740a3bfb
MD5 SHA1 SHA512

Submit Download

c550882d-eb54-4a93-befd-c60d8bdbcb93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c550882d-eb54-4a93-befd-c60d8bdbcb93.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2ed0c8e8adb3e7cf8baa0ecb69b6d22843a8c664e6be61244be71c3a3fcd1366
MD5 d238af5867c68d3b8cfaf81477464421
SHA1 33a8fe9984891d45b6ea167307d0c1c493b954c0
SHA512 e9e4792115262883d90899905480d588ecb7a24e79d9ab641ec259657c93a6e6a47f367780e7afda19e55550be48ca18653a227fe6b262f32d746c9302423bc4
TLSH
T19E41079CA6E91158B3B76F4A9BF7A46D447BB9772E07D45D00110D4F0A23B40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download