hxxp://docu[.]hgrcklmny[.]net/?62f63f=qZuH8fpdWkk4z4raX-hwiFE7xXC-ojbDbw&sso_reload=true

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 01:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://docu.hgrcklmny.net/?62f63f=qZuH8fpdWkk4z4raX-hwiFE7xXC-ojbDbw&sso_reload=true
Sample260722-bkgmsaxake

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4720	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291563349206477"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{4D4FA8A7-99E8-4F21-867B-21D03F408012}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
940	msedge.exe
940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4920	4912	msedge.exe	85
PID 4912 wrote to memory of 4720	4912	msedge.exe	86
PID 4912 wrote to memory of 4360	4912	msedge.exe	87
PID 4912 wrote to memory of 4360	4912	msedge.exe	87
PID 4912 wrote to memory of 4360	4912	msedge.exe	87
PID 4912 wrote to memory of 1412	4912	msedge.exe	88
PID 4912 wrote to memory of 1412	4912	msedge.exe	88
PID 4912 wrote to memory of 3248	4912	msedge.exe	89
PID 4912 wrote to memory of 3248	4912	msedge.exe	89
PID 4912 wrote to memory of 3248	4912	msedge.exe	89
PID 4912 wrote to memory of 3128	4912	msedge.exe	90
PID 4912 wrote to memory of 3128	4912	msedge.exe	90
PID 4912 wrote to memory of 3128	4912	msedge.exe	90
PID 4912 wrote to memory of 4308	4912	msedge.exe	92
PID 4912 wrote to memory of 4308	4912	msedge.exe	92
PID 4912 wrote to memory of 4308	4912	msedge.exe	92
PID 4912 wrote to memory of 1588	4912	msedge.exe	93
PID 4912 wrote to memory of 1588	4912	msedge.exe	93
PID 4912 wrote to memory of 1588	4912	msedge.exe	93
PID 4912 wrote to memory of 2860	4912	msedge.exe	97
PID 4912 wrote to memory of 2860	4912	msedge.exe	97
PID 4912 wrote to memory of 2860	4912	msedge.exe	97
PID 4912 wrote to memory of 2776	4912	msedge.exe	98
PID 4912 wrote to memory of 2708	4912	msedge.exe	99
PID 4912 wrote to memory of 2776	4912	msedge.exe	98
PID 4912 wrote to memory of 2708	4912	msedge.exe	99
PID 4912 wrote to memory of 3520	4912	msedge.exe	100
PID 4912 wrote to memory of 3520	4912	msedge.exe	100
PID 4912 wrote to memory of 3520	4912	msedge.exe	100
PID 4912 wrote to memory of 1692	4912	msedge.exe	104
PID 4912 wrote to memory of 3084	4912	msedge.exe	118
PID 4912 wrote to memory of 4752	4912	msedge.exe	119
PID 4912 wrote to memory of 2184	4912	msedge.exe	120
PID 4912 wrote to memory of 5056	4912	msedge.exe	123
PID 4912 wrote to memory of 5056	4912	msedge.exe	123
PID 4912 wrote to memory of 940	4912	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://docu.hgrcklmny.net/?62f63f=qZuH8fpdWkk4z4raX-hwiFE7xXC-ojbDbw&sso_reload=true
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffade1fc188,0x7ffade1fc194,0x7ffade1fc1a0
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,17373171156400227394,17591037068552641727,524288 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,285397272172346088,14585767817440724759,262144 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,2070762372690813745,16107496580672306010,524288 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15131853215111235820,6985015530684851379,2097152 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,6889708490214563489,9847337277870483426,2097152 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,5672319854827690459,413576749611596423,2097152 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,8887016205680876380,3790530715780875831,2097152 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3504,i,8560216892820569499,15966538118757046384,2097152 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,11951597255291488249,5270195808536852144,524288 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,12375554162984535835,2319598036603120320,524288 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5880,i,2718531185168105592,16128236332442887430,2097152 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,5447977386143605810,11286852457227813241,524288 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,5447977386143605810,11286852457227813241,524288 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,10357472072636606514,5313128142902242719,524288 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,13216567953698506293,6029318557707301107,524288 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,6633285156233790521,8892507002055120508,524288 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,347609657405444833,10288127175409207111,524288 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6544,i,10512065394981905868,14843217335155354924,262144 --field-trial-handle=2208,i,13560790429176551582,8034019414770259183,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6973182d49a5be81be6fed1610e1f8a615ae5024de47a5844f0bbebdc691f411
MD5 e1189b9db8617d3d0b3f097eb4c9654f
SHA1 756ef70c59e53b99280aa64b77ec02113c7718b7
SHA512 1716d0f6d8c75c8e41181dfb5cdf6dbf0c51b11cbb0847c74085b4a871c64d1459225310ce673a02be69e9c522984e70ddd8727d9037dad9e9f9a6701f570b24
SSDEEP 48:a4BknWkiS4mWnAQSRCP65ubJB1qbBtbIFnl9gHaFhbYzfhU+JFlIegUOrx1r0C7t:a4B/nphVgbKY6vYaO1gbh7pF9kha
TLSH
T16B91A73509C22A73DF1483328CDD2549B63382FFF6271E97D14057B26512B8EB2B59AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 7895a0769c6c6886a0bb27b2d6ac61c3d6044f74200588175233af7d7cdb88f0
MD5 28e17c743ee0a855ffe0c7093fb24321
SHA1 1ddc0d7e479336b122fd515020d65170ebad614b
SHA512 5f6dc1b2b7f733f3d84cd75a5aed9d9578c2dc6adb1cbfffc72d59bf90036f00554a6419902395b5786dcf7cb84b4ee7837a7826d5791e49f2bf271e54c3daab
SSDEEP 48:W4BknWkiS4mWnAQSmCP65ubJD1qbBtbIFGl9gHaFhbYzfhU+JFlIegUOrx1r0C7j:W4B/npSV6bKF6vYaO1gbh7pF9kwr
TLSH
T19691967109C21A73DF14833288DD2989B633C2FFF52B1E97D14057B26516B8EB2B59AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588037.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588037.TMP
Size 3KB
SHA256 c4dd7b4f1e0200aaae31d4afd6bad7610a36dd9661c82cdf7a9d6673b698d96a
MD5 e87762b3807fae55f15affad207135c8
SHA1 d427b186d98421261f8883931d286aa6cb2736a4
SHA512 b3a5bcb09f47dcd924b3234b55a8c4752a17807c0a034cea3e2354765ebb241eee5f35562dbc591e6d3e22aa387ebb84ce55be07d577c565982271c6fd8ac07e
TLSH
T1F661A5750A9312B1EF14C63294DD025D3777C6F7FA1B6E8990805633761231EF3259AD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 f8103af86d6c2c65fd6e7ea6e3d12063a8a55032fc6362cdd93e73de8969314b
MD5 04181bab407363cc41c25f66e572ee90
SHA1 6924db1bf46bea238f377fd7dacc5c131de66790
SHA512 d940ee44813be14b47db6045eca6bb0948d7b1b86640450224e8ffda52812b1600a744d22329161334cd2cfeca1d47af6e5a7d859749f763dad3c33f6f7ee75c
SSDEEP 192:Ddped5tdOgQ3nbVGXVwZ5UtGhMuooHThV5+cEXyQdPAayFka:Ddped5tdOgQ3nxGXVwZ5UtGhMuooHTh7
TLSH
T180F17BB2C7E4876DDC0196F4AA18AE2FCE2D1934871C3D39C9D5AE1797E2471E10264F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 aec889c0c79fc97a657710cacac5b7b5a8ff6d4eaaa37630c09b9f790ca76fc0
MD5 1de345c7d2155f2aaf9629bc9290ea76
SHA1 9db46aba53c6bc2c9591eb0bdd8ba5b9f8084057
SHA512 4da68a1bc55039b1497e7d9fe12b589faedc6b26d55a71718dd2eee947bc6b8d6469fc5cb7e5b4aba96f829adfb7056925c7d7f17a90d853f037124e3a9bb15f
SSDEEP 192:sxZjRfyM/jK1Ml8UQ3kU/fuslC4VqIdphH4HW6+WNG3N/Yvhfjx+NIg5fJ:sxZjBq0U/fuslC4iHbI/ixCH
TLSH
T12752D616BA345977CCDBD20ABA41BF53D6F51463D2941E44AAFCCA0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d1392b4e3c23421ec6a2e113c81d3ce64cb55acd4dfed2809a4bfe28f081aed5
MD5 9c78308460b93440cb547abc7f174026
SHA1 a2250308e19105a6878c0cd48c6040393724b65f
SHA512 7726a266d4930b6e041c181e19b862630f4d6fe21654f0136c28563e8ca4b6dbe3f5c3e0294bd5a8e42fb0750ca992a5861880e45bc2c6c5f83b34c1fc002eb5
SSDEEP 192:sxZjRfyM/jK1Ml8MkU/fuslC4VqIdpzH4HW6+WNG3N/YvCAjx+NIg5fJ:sxZjBMU/fuslC40HbI/OxCH
TLSH
T18052E716BA345977CCDBD20ABA41BF53D6F50563D2941E44AAFCCA0C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cea72f5b548948b61b22ff7838539b85e065ea9ee9ce490e6fdb1783eb60381b
MD5 f7108b97e8168a6ccd0525470eec3be9
SHA1 132640501a0ce105087702ec3d16cce915550ab9
SHA512 5b44742d6e593b658b6a0366892d85a4300cc490bd94463a1ae235f1143ea9b00f8b6741e2d03797dcc5c2f7e79d33aa184c6b3a521f4d80d91abbbefc486980
SSDEEP 192:sxZjRfyM/jK1Ml8MkU/fus/n4VqIdpzH4HW6+WNG3N/YvuIjx+NIgrJ:sxZjXMU/fus/n40HbI/yxC9
TLSH
T1A042E7167A345977CCDBD20AFA41BF53D6F50563D2941E48AAFCCA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e92e92bebaff26e3abf4a6f9f0ca0a55d293564bd36ea27455d108f93d63bcec
MD5 eda5fe109bd62433c9fa34e4903d75f2
SHA1 cb37ffa7b44928a96011ca1ab1ff45da93a7f301
SHA512 e94d9015cd6cbd7a904ca7d93d0f870cd840b653ecc0d2c841176dcbd8b068d2586a3edbb7bfd41a862d4aa1fedd366dede2af0a2d13543751fbd20079d5d281
SSDEEP 768:2wseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp9ro5N:2wseJ3xWvhfynu1jaVcL88p2v
TLSH
T1FBD2FB2B280CCB7E4F844E6DEC266F966EE801CB67984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a1197b91f9516869675d9a16bd09a3feb4cca902fc6eed6dcfcd4f52c46117de
MD5 14fbc4b28781333bb7e3fde303c8dc17
SHA1 7f739e62710a346a6921120457b703edc8d0c743
SHA512 6f9ba9363c5acedd4000453af076bb2c6d40b17f235807208e9fac59dcced61259f5d60ac45fdc46af03829e360973b9e4ac66fddc49e0c2f3304c5515a57db6
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1E0:KYHIhKggkXySdIxK+cMjyx8IfKd+cnyS
TLSH
T19A914012707F02023C7E2D8CB291A5764E8271E274B9B4AF7FA804915E66E111FFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590cb8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590cb8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 8af6ce5dd50bc395fbf62537988222bf96324882a53231a0d8f3ad44158b537d
MD5 f4a9ebb76393f22ecfdac932fa1200e1
SHA1 a3cb343d4eece8613ea8da70c4bc5f731d359f2f
SHA512 425c9d70fd4caa46b7f1879b6a417b81140536ba501db97b9b03fd02c19ebf32ff4d20588f3892ded5333c92615b2ae4bcb56092e552a2eef55bc81424c6ed5d
SSDEEP 384:stNn/s3n9SfsNHUPK75RDEGauzFIKPlgXrZu:sj+9Um3IGrFxlgbZu
TLSH
T15B625B727C295C6B5DE6A585F44A33071FF4916BE2C46F90E9DC7F1D00DA2AC130BA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 019dcfe400a78e9e2642225ee7bf34514160421e7b57a6242f0d75d449341690
MD5 060c3169472b37c8c6623080fb2d473d
SHA1 0abaa190a63f39bcd039c99810af9a5eb0bfa7e2
SHA512 c5a1a55ea144ac6ac5fc4c5fa9e2bd780bd2ed8b97c5dec1194c224f2900b18cdeb0ee2d107a8609eba2af0edde5a783c7079c84ed1b573cbab317a65d6dd507
SSDEEP 384:ciF1tNn/s3n9SXzsN88TUNTUlIlPK75RDyGauzFIKPl2XrZu:HF1j+9A9wgI3GGrFxl2bZu
TLSH
T1C7B2F8F258D7887AD9EE9747B77D2E024EBCC167F5806A50B7886A0CCC861BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7cfe0597adf1bb25dd6017d5b6a015c22338c8c6eb2682f95ff54f967df44b77
MD5 65e44723a4676c8ca3d87f7ad9705419
SHA1 c87beb572733c00fe95f710c2ed2b2d4098eff11
SHA512 73c9318ed76bd81c9c0d6370467cf3673b4d3ef9c8abd9a34e0a677d8f528392e0a28d640a8b2db98dab44ed0e84ccebe4a265fe0a0e131d98e714a950e1d28b
SSDEEP 192:lONG6vMtPQmiUy4xrThTobWCIKp847nLU/u:lONG6UtRxrTiFIKRLU/u
TLSH
T19F020976BC785C7BAAA3BD45F48E23171FE4116BE5905B50EAE82F1C00D765C2307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 b4c9c8915f7a0c9314a4b8d7299bc917aebfdbfab896262143d5f60fd3a66c16
MD5 924efcf4c7d7d5abdd7712e89cf0da22
SHA1 47a63f79084cc8e88c3d5b1b4ad550e3a1e8d553
SHA512 27c8cc71a56414b0fd126614f622ba67550a99b48b5b0a26940e360e9a0ea11fa1febf06e7c3008fcdf62271982ec9d3945e33f52a03b13cd86b39f8cc1f65de
SSDEEP 192:wONt6vMGPQmiUyrxrNhTobWCIK++Wyi780ISqHrU/u:wONt6UGR6rNiFIKPlpXrU/u
TLSH
T192121A76BC649C6B6DE3B551F48E32131EB4826BE684AB50EADC3F1C01DB66C1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 5ffef7ce541f4f9e7492d99a01d031057f1d4cf19d76513a3b00f1a3210a21e6
MD5 8413ff121f7f36af8c75ceb400ac4ba3
SHA1 122f14b6fda0ffb370e2538fcd1153867c9cb486
SHA512 e15cb1d8349e8e7699749caef2e8f6a1faa8cc87d7cf5b4004b29ede6fd1e78477ffc7f4ffe00a24b563aa626913e3eb849a2d2e94aea71220b92def06546552
SSDEEP 384:AtNn/s3n9SfsNHUiK75RDEGauzFIKPlgXrZu:Aj+9Uf3IGrFxlgbZu
TLSH
T1C4625B727C295C6B6DE6A595F44A33071FF4916BE2C06F90E9DC7F1C00DA2AC130BA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebc3c19a-315c-4eae-a27e-a2a69d748af0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ebc3c19a-315c-4eae-a27e-a2a69d748af0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c7c7434564b294460603d7b2d9b06b0dc2eed3a98b2ff7e34e5ecd3954c25f94
MD5 d43410611db45cdadcfa8ed1b03aa9a9
SHA1 efd8d9611d85e7534cc3df3c41c7785c632c22c4
SHA512 a469ee4432f6dc2ac20fc29683eb2a05be33f031be06665d7aa9989ba20452019d62ff3d0e44358fecca8d3b3f1f7bc215b4dc888b6b4900faf8d66107d13f1c
TLSH
T169412D98A6E91148B3B77E5AABF7A46D487BBC772E06D45E10110E4F0633A41CC71733
MD5 SHA1 SHA512 TLSH

Submit Download