hxxps://c88neeeb[.]emltrk[.]com/v2/c88neeeb?rl&d=

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://c88neeeb.emltrk.com/v2/c88neeeb?rl&d=
Sample260724-snxxlsshle

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3548	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293798230922060"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{9E3C49A0-BAA0-4110-9ECE-5CDCCED22F21}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 2244	3948	msedge.exe	85
PID 3948 wrote to memory of 3548	3948	msedge.exe	86
PID 3948 wrote to memory of 556	3948	msedge.exe	87
PID 3948 wrote to memory of 556	3948	msedge.exe	87
PID 3948 wrote to memory of 4420	3948	msedge.exe	88
PID 3948 wrote to memory of 4420	3948	msedge.exe	88
PID 3948 wrote to memory of 4420	3948	msedge.exe	88
PID 3948 wrote to memory of 3264	3948	msedge.exe	89
PID 3948 wrote to memory of 3264	3948	msedge.exe	89
PID 3948 wrote to memory of 1756	3948	msedge.exe	90
PID 3948 wrote to memory of 3264	3948	msedge.exe	89
PID 3948 wrote to memory of 1756	3948	msedge.exe	90
PID 3948 wrote to memory of 1756	3948	msedge.exe	90
PID 3948 wrote to memory of 1052	3948	msedge.exe	92
PID 3948 wrote to memory of 2512	3948	msedge.exe	93
PID 3948 wrote to memory of 1052	3948	msedge.exe	92
PID 3948 wrote to memory of 1052	3948	msedge.exe	92
PID 3948 wrote to memory of 2512	3948	msedge.exe	93
PID 3948 wrote to memory of 2512	3948	msedge.exe	93
PID 3948 wrote to memory of 912	3948	msedge.exe	99
PID 3948 wrote to memory of 5036	3948	msedge.exe	100
PID 3948 wrote to memory of 912	3948	msedge.exe	99
PID 3948 wrote to memory of 5036	3948	msedge.exe	100
PID 3948 wrote to memory of 3908	3948	msedge.exe	102
PID 3948 wrote to memory of 2184	3948	msedge.exe	109
PID 3948 wrote to memory of 2184	3948	msedge.exe	109
PID 3948 wrote to memory of 2184	3948	msedge.exe	109
PID 3948 wrote to memory of 2228	3948	msedge.exe	113
PID 3948 wrote to memory of 1204	3948	msedge.exe	114
PID 3948 wrote to memory of 3312	3948	msedge.exe	115
PID 3948 wrote to memory of 3388	3948	msedge.exe	117
PID 3948 wrote to memory of 3388	3948	msedge.exe	117
PID 3948 wrote to memory of 1008	3948	msedge.exe	118
PID 3948 wrote to memory of 1008	3948	msedge.exe	118
PID 3948 wrote to memory of 3408	3948	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://c88neeeb.emltrk.com/v2/c88neeeb?rl&d=
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffade1fc188,0x7ffade1fc194,0x7ffade1fc1a0
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,13303912756279300964,15296933366482286779,524288 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,15745579827131124424,9905579069460762790,524288 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,9995033081288137802,2690806746965311457,262144 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,4408861330839493031,13958369575056187573,2097152 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,7541809878355591279,2069499241677505197,2097152 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,8868840879574623905,3936793879028413385,2097152 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,5075681021855490682,8144625130345920847,2097152 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,2016735880823912269,12671241746615678367,524288 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,11725544617590910163,13178059111836523208,524288 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,11010074295763596166,17619452541700048678,524288 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,11010074295763596166,17619452541700048678,524288 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4268,i,263806841070483116,1341470745752504055,2097152 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,16488515063988284477,11423445678302890268,524288 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,13898244479246932315,15164014062958351310,524288 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,5618665090082829792,17065806263273144424,524288 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,5227904570574918806,8940645829326727082,524288 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,9370360021179775067,10260516723480145732,524288 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6060,i,11533969359809111508,6251636866830507140,262144 --field-trial-handle=2436,i,10412748032806463041,8920451634776226938,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

26c5c697-a649-46a6-8f45-01cab2511762.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\26c5c697-a649-46a6-8f45-01cab2511762.tmp
Size 15KB
SHA256 6c3d845430a720e47a9ae18c8261ea6a112e8b43437dd52f8def3f7a5f2e72e8
MD5 a1b95fd99d8903685c0e2afe4d881e2b
SHA1 23602ac141f7b1010a569a330523052a0577a67d
SHA512 7d94ab9a14674de8c09888f68f77327fdd56f3db73dceeb9c15074f59cd957001071a5fe3f1cd2226ee69650fce13412cfb4808074c72a2cdeeb31fed906eaa6
SSDEEP 192:uNm+xasuheOwQxMGsNEEQC8Y/sTvBM78DsdQmiU1rXsB4MTobWCIK++Wyic8z1x9:DZcIhsNEEiMQC7msb1suzFIKPlMEsJ
TLSH
T176625BB2AC648C7B98A7F245F48E36131EB481ABD3C45A90E5ED6F1D00AA5AC130791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f4569f2e2ee424955bd44bbf9fb18cd76a421e5e74dcab6e39de72bc18d30d07
MD5 c161f02c380e89d226ca8e41ca66254d
SHA1 39b2fd39a2e684b35ae734d6e7b78a9437e83f6e
SHA512 fa1f03af9aff869155855ebd228bd0808dade88baa22f286a95e3a413c36a7711defddd09848719c67def81bc1ddec5e0f68909209f1f2953e875fddc4250922
TLSH
T11561A4750A9312B1EF14C63294DD025D3777C6F7FA1B6E8990809633761231EF3259AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5870a7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5870a7.TMP
Size 3KB
SHA256 30e52cbac5561095caf3081b8cc240b56b4e17837b4b5956c53b2263988e1afe
MD5 3370a380b307a9df4ffe72dd1d329b15
SHA1 b78c9b4f71a5622b7ba2322b670153ff09b6307f
SHA512 d8001f37869ccefda441ed22dab02b470252d275b612e6368af83cc1f88265ee01b531f7b9bc9d6d48eb661e5860ad937ffd39df6c380b390db859a1fa973ac5
TLSH
T1D761C5750A9322B1EF14C63294DD025D3773C6F7FA1B6E8990805633761231EF3259AD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 635f08c2a70aa1521840a934a71d05d3b598c6ec5ae223895cbb3d9ab9376d8d
MD5 b736a46252bd5d9c8bb5dd2a75fee835
SHA1 b307946bacefcbd1d1ac0ca371795fb5f7560e70
SHA512 9327ba80876900b79d65b9f3009cbe26c7397a92ae342c9a42a1e3ba5ee9b81cb3b8d70f2eba10145dfbd4c743769f8321ab3f91094caad6e4331795482ba217
TLSH
T1C5115BF7C3D5856E891156F06A24AE2BCE1D060683187D1989D4EF1793E3469E10195B
MD5 SHA1 SHA512 TLSH

Submit Download

aaaa2bc0-0cc4-494c-b56b-d4922e8ccd99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\aaaa2bc0-0cc4-494c-b56b-d4922e8ccd99.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c19a0e4a0323856d7ed0f97c8ba9fa9965434ef2334e227db3667ea07abed5dc
MD5 b264c01917f8dc864eed2f2466bca604
SHA1 16df280246b806ed5318524a456fee76b78f6531
SHA512 b86770dca70a32712cb3807d10e77624374b2004df31d3c8e1088da09d526b614aadb67f195aa216f51e9b006962ad7c6c2eafcf5e80b302ddb4c5a3fb7d3be6
SSDEEP 192:sxZkR1yM/jK1Ml8Mko5/fIRssRZVYrIdpJH46bh6+WNGYvxYjokIgrJ:sxZkhMo5/fIRssRk0JH7OGhn9
TLSH
T19C42D7166A345977CCCBD209FA41BF53D6F515A3A2900E48A9FCCA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9cdfadc1b0ac4032a0c983b076e43fbab4db796179eb09f4e93b4d3e692f99bd
MD5 0b8055abeff8404351a9f92bb4423901
SHA1 a97b0f2cd036e224ed80b80dadef062ed6b2d2d4
SHA512 edd4a7761e00d99e1099ce8599b3100ed7e87efe962e97cd6477fc25d36dbe3e64d710cec27e53946b9425417d28d37f4cebfa53da4bd29697bf042a76691174
SSDEEP 192:sxZkR1yM/jK1Ml8Mko5/fIRsyEMVYrIdpo6yH46bh6+WNkMId/YvKxQjokIg5QJ:sxZkTMo5/fIRsyEl0byH7OJ+/ony
TLSH
T1AC52C616AA345977CCDBD209FA41BF53D6F555B392900E58AAFCCA0C00E6BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 43bfd282bdff2143b9877d4e27205dca6dd35adf3d84786c6bfe3a31cee5c125
MD5 b7fa1c062f2951e8f5c690a2ed1fec5a
SHA1 e36d1623b3cc46ddb2d6f2acaa2154cfa71198df
SHA512 849ea829d0cd00f12cbb27edd40c5ab6b76a0b3bc04fafabe34c192f023300dc15230b395c7fa272c1fb5aac9437e88882246b68b119b26c7f3ed3a34f956a23
SSDEEP 192:sxZkR1yM/jK1Ml8UQjko5/fIRsyEMVYrIdpu6yH46bh6+WNkMId/Yv+xPjokIg50:sxZkTqIo5/fIRsyEl0hyH7OJ+/pny
TLSH
T16652D616AA345977CCDBD209F941BF53D6F555B392900E48AAFCCA0C00E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b8d59f1540e6c0f75ffbd23c93c8f3f95c571885f3452922e736f65c7389ad21
MD5 9cb84c8a7f3149431e2a225601438f7f
SHA1 64fdb9b56cf044f759bf0d1d477ee6324b1e1653
SHA512 7fadc07a2fb9ec9269b2b108b259916ee0dbb4e8e88d806b5d6bdfae62294b6785890f156631daccc57803a78149c1d2a014fad509d989d9ef2b0286d7d26f8f
SSDEEP 768:ewseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp9roNt:ewseJ3xWvhfynu1jaVcL88p2b
TLSH
T13DD20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA980C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 43abe50aa9afa1d5da295c2cab9ab4ce18aeefbf8793383ddbb968722dc04d26
MD5 cffe8574e6b072def8eb85b1375dfce3
SHA1 f02ae8f3cd6eb81a58a86b9e8290955cf62ce8ed
SHA512 72a20a08266961c9e19e00fd1fef1e6b610db77778e26afc814f6e681185659ea5c968527d708e70dd6dc8d3522fb1b719940392e60c923d08022ac6f26c66e3
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EM:KYHIhKggkXySdIxK+cMjy9PIFKocQTyq
TLSH
T174919702317A53013D7D688CA2D2963A4F8175E3745874AF7FB884A55E26E224FFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 a619dcf3cf41390e890f3af37aaa4c830c72b63c7db99e060bd647643ed148b6
MD5 ed67754cfc2b3ab4f04520f3bafd3411
SHA1 c4558db0185d3ec1120a394d1639bad1d368823a
SHA512 96a45467317292a1396d630e22e164de4ae1a753462c64f45269c113daabb86f1d287723c5e19e490a5e8871d20df1bf8f63e9766c90b51f18ce00149d9dda90
SSDEEP 192:uom+xasuheOwQxMGsNERQC8Y/sTvBM78DsdQmiU1rXsB4MTobWCIK++Wyic8z1x9:mZcIhsNERiMQC7msb1suzFIKPlMEsJ
TLSH
T1D1625C73AC688C7B9CA7F245F48E37131EB481A7D3C45A90E5ED6F1D00AA5AC130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 eedc8563467a88dc4515ee5d193d33a8b768511a047be6b5b8e069a7ea189c97
MD5 a50af1aac6d0caa419941b3823edfc9b
SHA1 5c4783ac91242410352367ec4a126e8e6b3b4a88
SHA512 34242efa06caf03a8398c8d029d9dcc50146ebac83a545011af045e92773011fe113fb2dce2a78850a02620a69c365b086d70ebc6982cb4369c96b73b6740e37
SSDEEP 192:uFm+xasuheOwQxMlhzsNEEQC8Y/sTvBM78DsdQmiU1eXsB4MTobWCIK++WyiG8vt:9ZcI8zsNEEiMQC7msbOsuzFIKPlUEsJ
TLSH
T14AA209F258E74836D8AEA307B7BD2E021EBCC167B2845A50B7D86B0DCC9657FD306416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85ce58c2e75cbbaf257de0eec09101bb5a81278741f748700e8080cc83052ca2
MD5 bb012d3bfb26087616da48934398bd68
SHA1 d058f6717e78850b1bf7e7abf2699b2ede19de0d
SHA512 9e895122febf97c15aeee83626da879783101190fb28ef4a45f3f77273cfba4f52ff3f5ba19f464316a81d919b147a6cdc3762f32d44ed54e9e3c994ca20f3bc
SSDEEP 192:lONG6vMtPQmiUyToThTobWCIKp847MLU/u:lONG6UtRjTiFIKRSU/u
TLSH
T156020976BC685C7BDAA3BE45F48E27171FE411ABA5905B50EAE82F1C00D765C2303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 8ec377b866d5c882ce0f8aa2379df47b7c8761fc297d1a0f903ca7a7de8f0106
MD5 d615b0719387951f520450748ee378b3
SHA1 0207fe5a5523b1753d6f6dcf187d89c9d959b7df
SHA512 4fb47c4933d987d0085e3e9053128bc6ee5ae78144e006cbdd228e303ad135a497bd192e698f7fbc6dca973f69d08960bba9a1373626419e03573b07344e9681
SSDEEP 192:UONN6vMtPQmiUyMoXhTobWCIK++Wyiu80IxqRU/u:UONN6UtRSXiFIKPlWEU/u
TLSH
T1FA120976AC689C6B9DA3B551F48E32131EB4826BD6C4AB50EADC3F1C01DB55C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 355b022c970939907bcad8257ad88a81f2443ce6d7af2125d87006bb9ad77e3d
MD5 e06ad1278e813c067060af26d8a680cb
SHA1 1f43a35758bf382b0ed7c5a05452c8443bdc6de7
SHA512 2ae283c277805476d9c51d864f7fff6c1bd9eefec97685a3086105297a1f90a190cee14bab7394be2016fd5dcd37ad2abccff240a9894b7dbeab40d226181383
TLSH
T135413B98B6EA0148B3B76F569BF6A86E483B7D732F46946E10110E4F0A73E40C871737
MD5 SHA1 SHA512 TLSH

Submit Download