hxxp://www[.]jandsc[.]com/

Analysis

user interaction
yes
max time kernel
148s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.jandsc.com/
Sample260724-ryryns1tex

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4380	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293773952691775"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{55C54A3D-620A-482F-AA7A-1E98A988F710}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
972	msedge.exe
972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 1384	812	msedge.exe	86
PID 812 wrote to memory of 4380	812	msedge.exe	87
PID 812 wrote to memory of 3528	812	msedge.exe	88
PID 812 wrote to memory of 3528	812	msedge.exe	88
PID 812 wrote to memory of 3528	812	msedge.exe	88
PID 812 wrote to memory of 5116	812	msedge.exe	89
PID 812 wrote to memory of 5116	812	msedge.exe	89
PID 812 wrote to memory of 1148	812	msedge.exe	90
PID 812 wrote to memory of 1148	812	msedge.exe	90
PID 812 wrote to memory of 1148	812	msedge.exe	90
PID 812 wrote to memory of 1704	812	msedge.exe	91
PID 812 wrote to memory of 1704	812	msedge.exe	91
PID 812 wrote to memory of 1704	812	msedge.exe	91
PID 812 wrote to memory of 4640	812	msedge.exe	93
PID 812 wrote to memory of 4640	812	msedge.exe	93
PID 812 wrote to memory of 4640	812	msedge.exe	93
PID 812 wrote to memory of 4664	812	msedge.exe	94
PID 812 wrote to memory of 4664	812	msedge.exe	94
PID 812 wrote to memory of 4664	812	msedge.exe	94
PID 812 wrote to memory of 2996	812	msedge.exe	98
PID 812 wrote to memory of 2996	812	msedge.exe	98
PID 812 wrote to memory of 2996	812	msedge.exe	98
PID 812 wrote to memory of 4876	812	msedge.exe	100
PID 812 wrote to memory of 3876	812	msedge.exe	101
PID 812 wrote to memory of 4876	812	msedge.exe	100
PID 812 wrote to memory of 3876	812	msedge.exe	101
PID 812 wrote to memory of 4120	812	msedge.exe	103
PID 812 wrote to memory of 1804	812	msedge.exe	104
PID 812 wrote to memory of 1804	812	msedge.exe	104
PID 812 wrote to memory of 1804	812	msedge.exe	104
PID 812 wrote to memory of 4932	812	msedge.exe	117
PID 812 wrote to memory of 3668	812	msedge.exe	118
PID 812 wrote to memory of 4972	812	msedge.exe	119
PID 812 wrote to memory of 4520	812	msedge.exe	121
PID 812 wrote to memory of 4520	812	msedge.exe	121
PID 812 wrote to memory of 820	812	msedge.exe	122
PID 812 wrote to memory of 820	812	msedge.exe	122
PID 812 wrote to memory of 972	812	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.jandsc.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f0,0x7ffb81efc188,0x7ffb81efc194,0x7ffb81efc1a0
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,17056045535428813764,15579791410034775546,524288 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,14122622874265233541,17524299987899199816,262144 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,1903948392876546698,9290631590283755861,524288 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,7119674029691141600,11808860005299887500,2097152 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,5889022910419892873,12430523171010063890,2097152 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,4252166213862125519,7409562900438412508,2097152 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,704022134053343611,386181705607708300,2097152 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:2
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5092,i,3100828810280325859,3398996201237305945,2097152 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,10178888705049350164,5452244723273229584,524288 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3388,i,10361489352438823176,8421797869530253959,524288 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,6834866087540074350,13170366610029463759,524288 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,6834866087540074350,13170366610029463759,524288 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6056,i,16443041056954606718,6362927449063124261,2097152 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,1622698857416616946,13030237967601519387,524288 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,12598482049082801203,14902655152076900228,524288 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,1619900303156589605,3253783200902053833,524288 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,3505188903498899160,5296498382068517392,524288 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,6202644776964098603,17305796649151343351,524288 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5404,i,13067472646110801186,11350106645162157948,262144 --field-trial-handle=2256,i,7867247014713603189,15152688904001882721,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2caded810fe2c50db40ca2144ac2f5f3ede057eeacb8db09bfd376b72c5ff9ba
MD5 d7277cb5560f94e90a9d41c8c3e3d94a
SHA1 987ec76df14f2a89d6eaad0744031fb0b4b7f6fd
SHA512 a8c34ea9652188149a561ae6cdefe29faf160110cba6a4aa19a85a894c42e88f46a8cb0233e4117c34c07278fbdff122740feeb692aeacdc5c00b3f745c74b1d
TLSH
T1FD81C82A13C284FEEB301378E5E10D02B172CBB966C77D9552A498FF3D06B634D6D516
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4bede69c34298ca6970d25991b01c943b724bf036ead1ff833bb22536f41e141
MD5 c982d4855b8448a52e847e431814076c
SHA1 d6c34fb9a919c225169109c0342707e1816901f1
SHA512 5508f118959ca0b7f89059a619130d3ad56e82433aae3762b3c4912ab771c6e24e6bd7db475eb3f2b1d16bedff68914979cbc72e222062d34ea4ba49a8dc1971
TLSH
T1F671716A03D240FEEB301378E9E00D01B171CBB96AC7BD9152A899FF7D06BA34C6D515
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ca40.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ca40.TMP
Size 3KB
SHA256 66ba2a87127facb2b5b2bfc488eacb3a0cc37519b8a569eda1c012310f058fbf
MD5 5da15c6c43fb37a8eed6ea943fed7ba1
SHA1 d045f38b0d4d391cd54820535f776649fe18f703
SHA512 3e5eb1bbe90b911999a9eb5728d1d06c1c76671530873edd1d0e3155a2c1b60080aa4c181100b304b9acfec56beb50972615d1067f6efd93930468925b162542
TLSH
T124615E5A03C240FDEB301378D5E00D013571CFBA2ACBBD9452A499FF7D06B634D6952A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6a6c1cbe92c26ef86cbb82bcd1823f12241a891f9137b396426214c53917f1d0
MD5 af23a3de4f29b283236f9f94f2a41315
SHA1 0d9df85b530eb50cc147b717e0e76ff7ab772f54
SHA512 184c3eb0f6efe04e7667b391c332a5a0af51bed914f0f27d9416dc90c2e49f6cd60e5fa2caa69b156bff020b6a78fee7687185fa179e053842115019ba346e89
SSDEEP 192:D6u/W+9MT/QMpQV15XNX4whAu54rF8H6L7Q+17T:Dt+08IIQV15XNX4whAu54rF8H6L7QO7T
TLSH
T104C14AB3C3D8CA2DDA1156F06728BE2ACF1D0615472C3D6689E9BF4AD7E2421D20265E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3863372ccce25e7239420849c62226a965b741260f8862e4ebf54f57f4b5d6ef
MD5 3aabad4f104f951b522e8bbde033d842
SHA1 b475be91a86f26c87d14db70ccbf142f4ba70b88
SHA512 bb6a0f0f67fb4cc8777cbf1e8b2c8aaf608bcbd7649eab971095acee884b317b1547a4f1350bdddf3618ca8aee038df9b6237c55bf05bb37a43c28944f27fa45
SSDEEP 192:sxZERFyM/jK1Ml8Mkd/fcsCCRIdpBFHW6+WNZLm4/Yw0RN77IgrJ:sxZENMd/fcsCCanHbB1/y/9
TLSH
T17042D8066A34997BCCCBD209FA55BF53D6F50462D6940D489AFCDA0C04E6AED2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f59736e44d2c7a3bd7a8fe303e7223448c2112f1e228c0116a0ef0afb280b90b
MD5 bf415bb0dcf7addd848c33006d0f8cf8
SHA1 cc05721b9bdac73d57387e43d1dfaa6bfc9e4ee5
SHA512 36231bce9fc62f8961fd1834603cff87f3457c7bbf7626c2c536a056ea7850934f764214a4d77e303cf2995c219fcdb8bd5140627fd01a4503dd01a199d61b5c
SSDEEP 192:sxZERFyM/jK1Ml8UQIkd/fcsC2RIdpnFHW6+WNZLm4/Yw0m277Ig5GJ:sxZEvqrd/fcsC2aFHbB1/yzg
TLSH
T1C852D8566A349977CCDBD209FA51BF53D6F5047296900E48AAFCDB0C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ba0fa5ebee50736da172d9c905de254043f343ff9b430a65e369cbb94d3129d5
MD5 2ada78814590f4ecde10b53b7a7a2fba
SHA1 5b6b24da162b317d2e0a64526ea1624534dc359c
SHA512 6f123c97addbc3ca631791b96e37d70d7b4a9cacad405727635e83178611e8aa3f564e3610f2ac9c63bd4d04ac52d9c0a8e39624f10ff2f7b674b6e8ab681f30
SSDEEP 192:sxZERFyM/jK1Ml8Mkd/fcsC2RIdpBFHW6+WNZLm4/Yw0BR77Ig5GJ:sxZEvMd/fcsC2anHbB1/y/g
TLSH
T1BA52D8166A34997BCCDBD209BA55BF53D6F5047292900E489AFCDB0C05E6AED2313C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f567ef851da3b5ea8307ae97d5e640cd829a17b5fe1a25c3194fe7262c82b349
MD5 2a3a4b79e818309f2c6d0315d8b0c645
SHA1 4d38cf38559400e5a1c8baf0b879e3110f758b3a
SHA512 af2105f16605e62920030591b13045597f24bf106f508a9696ac17948c5fcd24246309a5a9966d86367d63ae3756f41784be11feb4505bd3e4ca5abf0bdb94d6
SSDEEP 768:Wb4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dxrohncAaO:Wb4jeXmWvmKLEu1jacPLZQdKOy
TLSH
T1CBD2093B280CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 56cd3e3cbf41451c1fb330228dc2ac9b9fe08c560cb6659dcb759b57ebf80c2c
MD5 fd7c3c49314c26ed9ea135c1e84f76dc
SHA1 caec94a57dc3e5d138f31e6151c27d2c11d93f93
SHA512 a92e42c2e778d80dc63d2579c2da2fcba0796850fef05a289ddd15f4edee195c5e1d9e02d1079a748aa790465a4fb496e90499b1bab888f4880748928ad43309
SSDEEP 96:K8mQKjiWe9eKmwKw9kACOSgumHzYYgKA1YKgUoY3qQtSQAK9SF:uLFHh3G
TLSH
T12BB1600574BB8200293D2A188554962A9AC2F963355EE42B7BACC0725E27E31CEFDDCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5956c1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5956c1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1cd50cb45bda6d6c1d09330fd5de67fc4aeead6b31443eeb43fa193fbd170c70
MD5 a0542379925906e8eb9304d84698e15b
SHA1 75fcf33868c904e9136fd6c6837ab1014d38f4d3
SHA512 e0b15ba57798e45d6503edbfd6a6c80f1e37406343aca86f603d74be73639cb040b49d81b8eab06f3e0f75425aebe9bb9e3a18462c321896d83fa9d9457b2367
SSDEEP 192:uCLsNPPQtvp597ZEayLQmiU1pL94H/+jVWjzorGYZX4+2fM5cFTIqqU8:JsNPPIBT6d9TSf+g8GYZX4+2fvFQU8
TLSH
T171320936A878AC375DE2A655F04736135FF845179EC52B98D6EC5B1C00DF6AC230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 869a83182990acd5efb6e108d5ffa169fbc2517429e7a5ed56a878fc412eb779
MD5 fef9487d822241e2eeb1056f55810bca
SHA1 15569a59c74e78241b3bdc8e8b5095b3e5d1f3a4
SHA512 d9ad1b6043feb453f4ca723f882785c4f2da81257839dd10c0e4135a6cb2143c6f4ad16c46192ebd4c4996aaa6a49364585c0ce3393d7e769a75f20cf1c9f455
SSDEEP 384:SiFiZcIGzsNx8TUNTUlIlyIBT6d97Sf+g8GYZX4+2fDFQOObjI9G6w7vS:ZFQ2Qwg5oh6U4lpQ29MvS
TLSH
T1F2D228F248D78936E9AE9B13A77E2D124EFCC067BA946644B3D85B0CCC565BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5a7fbc91e7a40405f000d10463bfb81ec220dac06d15b55a20afb24685559c8c
MD5 23351f625d5fb5968a8fd10cedc349a8
SHA1 f1f25d4224802ad1a3c74858b290bc38013413ab
SHA512 7ea373a0a0a20ec2b8850c419cea0f5f1c414e8f2d44a88199a695d16fef1b18a0f72732e181136ac41e8c2d2cd9c53dbdb8169615d6c2a1259e0a4ae7c95bf4
SSDEEP 192:uNLsNPeQtvp597ZEayLQmiU1pL94H/+jVWjzorGYZX4+2fM5cFTIqqU8:wsNPeIBT6d9TSf+g8GYZX4+2fvFQU8
TLSH
T12E420936A8689C375DE2A655F04736135FF8451B9FC92F98D6EC5B1C00DF6AC230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 79b5b289b6703e99b8a9febcab3f5010fd78cb219a90c9dba9a85cb06bb96322
MD5 3fd912f4fa96767dfe84842166967445
SHA1 5ef35a9edf1a18d5945cf327a1ecd4656482c076
SHA512 5a6d0764bca64caf2d73532b3371a49c3c9ad86ef2116f1406e075499b12af84c9531df380a77ec5cd5ab0402a64c4a1243669b46e2a8d6c8c47c1ee54ed43aa
SSDEEP 192:EONl6hZ0QmiUyJJpc/+jVWjzorGYW5wOZilnU6:EONl6ocpu+g8GYV28nU6
TLSH
T1F602DA35A8786C779EE2AE45F48767235FE4112BAE956F84DAEC1F1C00C779C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2030ff9252684528511d6a2465c7f3366d05820508b19878466e1ad3497b3fde
MD5 a73784901f6f65ba7d6fca117b54f505
SHA1 b0bbdab23ca5133654373c8f196ea26ec16d5762
SHA512 36ed427627b564e1b1087b660fb9a5a95edd289548f5cd9aa78c45c775211d581cba46f531c5bef335412e53f160ba6b3e3308d781d7f16ead6ee8912a40e6ca
SSDEEP 192:lONq6hZPQmiUy2JOc/+jVWjzorGYZX4+2fg5cOqIqqU6:lONq6VhOu+g8GYZX4+2fb9QU6
TLSH
T19A120B36A468AC675DD2A651F08736235EE95117EFC57F84D6EC2F1C00DF6AC230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a9851281e019c7e563caee8c9fb498de4ddbc52f4c058402db8edd63117da68f
MD5 0dadb5fe2c90605d96c09828d7180687
SHA1 83f2af43ebe71b5574713dd7c2667d780291d48f
SHA512 d268197fe87902df6cee29ee53901400d989df08d303f9028ed7a899bc906ace1ce48d300c2f6a46aa285d6c56597e30a51ad40c766c982faa101ff907db312e
SSDEEP 384:xZcIhsNPyIBT6d9TSf+g8GYZX4+2fvFQOObjI9G6w7vS:Zh8o96U4l1Q29MvS
TLSH
T1E99280329C389D7759E3A551F48736234FF8952BDBD86B84E1ECBF0D049A9AC1306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c066054c-c27d-4034-a2cf-da6feedbe30a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c066054c-c27d-4034-a2cf-da6feedbe30a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 19de230236be7f5ea3d1b9616ad220c0170987e991ee082d6ac6aefd692b386c
MD5 6ebfacbf3fc960105bc52df1afb8d502
SHA1 7462746320856086e6c7092ec806c20387539fc7
SHA512 1eff2c728f332ca8c2b6e308209e156b5f38120cc0d9b15f63cbee90cf785495db617648df68ab55ff349d35aff7553de86f40dc395bd5499b102a65e81752d4
TLSH
T15C411788A6FA1148B3B76F5AAFF2B86D487B7C672F06D05D00110E4F0B26B40C961737
MD5 SHA1 SHA512 TLSH

Submit Download