hxxps://9sd9vgdv[.]r[.]us-west-2[.]awstrack[.]me/L0/https[:]/partners-rappi[.]auth0[.]com/lo/reset%3Fticket=3q7IiuSbVOW1iUP2NVbtUSsOKTPdMa0G%23/1/0101019fbf06f088-24b46d5f-1568-46f2-a8c9-d129cbb4fb7f-000000/94DViJOjaKRi5HUl5FWt7cUMxVc=474

Analysis

user interaction
yes
max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://9sd9vgdv.r.us-west-2.awstrack.me/L0/https:/partners-rappi.auth0.com/lo/reset%3Fticket=3q7IiuSbVOW1iUP2NVbtUSsOKTPdMa0G%23/1/0101019fbf06f088-24b46d5f-1568-46f2-a8c9-d129cbb4fb7f-000000/94DViJOjaKRi5HUl5FWt7cUMxVc=474
Sample260801-312rfazvdx

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
940	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301023893516636"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{0A8735A2-875B-4504-92A8-71A58E095ACA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 1868	3752	msedge.exe	86
PID 3752 wrote to memory of 940	3752	msedge.exe	87
PID 3752 wrote to memory of 4276	3752	msedge.exe	88
PID 3752 wrote to memory of 4276	3752	msedge.exe	88
PID 3752 wrote to memory of 4276	3752	msedge.exe	88
PID 3752 wrote to memory of 4824	3752	msedge.exe	89
PID 3752 wrote to memory of 4824	3752	msedge.exe	89
PID 3752 wrote to memory of 1532	3752	msedge.exe	90
PID 3752 wrote to memory of 1532	3752	msedge.exe	90
PID 3752 wrote to memory of 1532	3752	msedge.exe	90
PID 3752 wrote to memory of 2696	3752	msedge.exe	91
PID 3752 wrote to memory of 2696	3752	msedge.exe	91
PID 3752 wrote to memory of 2696	3752	msedge.exe	91
PID 3752 wrote to memory of 2116	3752	msedge.exe	92
PID 3752 wrote to memory of 4832	3752	msedge.exe	93
PID 3752 wrote to memory of 2116	3752	msedge.exe	92
PID 3752 wrote to memory of 2116	3752	msedge.exe	92
PID 3752 wrote to memory of 4832	3752	msedge.exe	93
PID 3752 wrote to memory of 4832	3752	msedge.exe	93
PID 3752 wrote to memory of 760	3752	msedge.exe	98
PID 3752 wrote to memory of 760	3752	msedge.exe	98
PID 3752 wrote to memory of 4924	3752	msedge.exe	99
PID 3752 wrote to memory of 4924	3752	msedge.exe	99
PID 3752 wrote to memory of 2632	3752	msedge.exe	101
PID 3752 wrote to memory of 892	3752	msedge.exe	102
PID 3752 wrote to memory of 892	3752	msedge.exe	102
PID 3752 wrote to memory of 892	3752	msedge.exe	102
PID 3752 wrote to memory of 768	3752	msedge.exe	113
PID 3752 wrote to memory of 4232	3752	msedge.exe	114
PID 3752 wrote to memory of 1776	3752	msedge.exe	115
PID 3752 wrote to memory of 4412	3752	msedge.exe	117
PID 3752 wrote to memory of 4412	3752	msedge.exe	117
PID 3752 wrote to memory of 1908	3752	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://9sd9vgdv.r.us-west-2.awstrack.me/L0/https:/partners-rappi.auth0.com/lo/reset%3Fticket=3q7IiuSbVOW1iUP2NVbtUSsOKTPdMa0G%23/1/0101019fbf06f088-24b46d5f-1568-46f2-a8c9-d129cbb4fb7f-000000/94DViJOjaKRi5HUl5FWt7cUMxVc=474
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fff4d27c188,0x7fff4d27c194,0x7fff4d27c1a0
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,17153946685226617463,10040943423643424539,524288 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,415006294386818043,7674290390725719695,262144 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,16126515860366709143,12032780525932255405,524288 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,6917641497559195941,3926713401971642082,2097152 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,10063023796744859280,398127015093883997,2097152 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,9083820451094036819,2815963460468415882,2097152 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,13954378921357701236,13475752596534090470,2097152 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,11653966003574988057,2134709636128734085,524288 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,12674677611136700246,7762145178564275207,524288 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,6504183134749849599,697559236269138623,524288 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,6504183134749849599,697559236269138623,524288 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3588,i,1655146821799922080,8423095713203544378,2097152 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,13166861274647491598,17343233759597478103,524288 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,1609881207176484043,4303845230985639811,524288 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,7496546352336292752,9890173492931728571,524288 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,3807086166214645070,16715443963294237800,524288 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6164,i,13506748630102149139,11465903525097573007,262144 --field-trial-handle=2212,i,506281014520891078,4743796292080469937,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ec7d777e9f82cc87481e9d10104c57698c3c97a34d89b261eeb50f12674e7956
MD5 8aaaf81f3f8900791d26638b9e218183
SHA1 e2f1a9ec6734d72b58ea4e2397ab028e8f07c40e
SHA512 0559cfe716ce981fc50b412d895d80097df3499250d9b944185ce8f2f8e5d8ca563df8795a83c910636b772d5e0ab8a741c9736f5eee5ba6623f2d8051d5945f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7a:fwUQC5VwBIiElEd2K57P7a
TLSH
T1F9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 06cf6208e62a07a659927ca6ea318058404179c2916efb2179f325b6ff0a9936
MD5 f89f90a4d148d5462a874a8463531557
SHA1 298666b2be9593c2361276b452600745f0746e03
SHA512 46fe550f78a00a87b3da10a654783178ced32d301078412118870e2c9645b61e559310e3b28b42b41617b1d86bccc0076dc95dfbc3aeb93e4c1909edf7fc38f3
SSDEEP 96:mpLj8vKseevRnkanVDqtUB5rnsswc6mfqyW5:gCXXVmtUB5jsI6J
TLSH
T1D0C1D8D0119BD94BE7104330E0E37532B8B15F981DABAECE11026BBD1BE9F9E2125D4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe592e4a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592e4a.TMP
Size 3KB
SHA256 566ef258f4b2482122ebd14816f23e6791585d1b0a441a931b564401a0c3a9ed
MD5 5145a17003b127167941986ae97f01b7
SHA1 64d9146f9be6e5ede4753d07493fd40a48c17d64
SHA512 486739491e4abe79a376a9ab12347f07f578105102d28620ceaed83f6731948861d32b394f735c7a659c33eb58042fbacfb2c6839aa9895faa62f113afa22478
TLSH
T1FB719118126BC99AD7200331E4E33274FCF28FA90EEFFE8511855BBE19D0F2D612A448
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ebe46d13704a21015daa45f798c73ed8cc7d006709235b7e5a79664a8995a516
MD5 fba96d17dfa81a21e8557a19f2b97ba5
SHA1 1c0f2dfba0266edcfb720669ae12a77c260fc46b
SHA512 600d4483e2f341c7265533ece18cb6ccb6a56b6d5ee8d1af30379df1f51d2c04a0ebbef61c8d7bed4c1d1d7b4a260132a977afb0e0b84072ae4ed65ae8e112e2
TLSH
T10B8187F343F5892D9A1251F09A18AE2FCFAD0520876CB979C9E46E1693F3471E201B4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 dfc4580d17b0e4b50f7799cf03238b3c3f5a217902e337ad21b97cc3f84537de
MD5 17967ccf1cc42fa4836031339f8afd2e
SHA1 c0ddec060f6b92924b4c21e993d9ffffc766c5c7
SHA512 dd24a59e0792a7595bdef5496625cf59462ad57f382d0c537245822dac7c3853989edff35341d7512d85354ab2cfc16a5cc4da96830be5a422094e42769eb529
SSDEEP 192:sxZM7R3yM/jK1Ml8MkXJH/f3Ysh1OzJKIdpIqHW6+WNKe1/Ywas4eIgrJ:sxZM7rMX5/f3YsrOz1fHb1/n9
TLSH
T10142E801AA34A97BCCCBD209FA55BF53D6F5057292940E54ADFCDA1C05E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3f035fd33ed834c436fe4c00bac9aeaef14d793c2559edbbd1896a7176431d26
MD5 e1242d1abdca5eb3f394cbb7618b1326
SHA1 16577167504c5f8fa8a5443da9ada4c81e86631c
SHA512 077688bc9a17dd2d2a407b62b4a200c953b624b32171409ed34093719206e1ced66b24fab32859ec3d4a53c2a34bf9790e657e474c53dd0328a3fc412ea3bb42
SSDEEP 192:sxZM7R3yMojK1Ml8UQXkXJH/f3Ysq1ikzJKIdpOqHW6+WNK2tdYw+14eIg59J:sxZM7IqUX5/f3Ys4Dz19Hb9dIR
TLSH
T13B52E812AA34A977CCCBD209F941BF53D6F5447292941E54AEFCDA1C05E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3ba973f4b1fd65f71aea22eca11d5224738496d17629b3038aebb31142a4e95d
MD5 b8108658595e46339e3a941312f58b17
SHA1 7ea65de39476d281a17557358b4e1e4edc57302c
SHA512 4eb1ffdd65235a3bdb2d905a7e5d5729949ac9466fb3e1be4351e4bd7eeaf612bcff4a26199343e482c9a03dd9df3671440519f1164a3988e337823524203542
SSDEEP 192:sxZM7R3yMojK1Ml8MkXJH/f3Ysq1ikzJKIdpIqHW6+WNK7gZYw6W4eIg59J:sxZM7IMX5/f3Ys4Dz1fHbFZvR
TLSH
T14852E801AA34697BCCCBD209BA41BF53D6F5457292940E54AEFCDA1C05E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e7f058c71b56485c361e3a44db44d7f527f8b311acff2e9167d348d9757e97f7
MD5 3910b4c72ad49d840ae32a376900ab05
SHA1 f5b2fc0f2718c7ec0148df673a75974fd206323f
SHA512 ba197d5e59701529d397f365ecafa385200d1bf54133b69c2d05aab1fac22e2b72c9abb4e099582ba6b7bb1c3a1f75c11923e759369ede1a3a2604a1014188b3
SSDEEP 192:sxZM7R3yM/jK1Ml8MkXJH/f3Ysq1OzJKIdpIqHW6+WNKe1/Ywas4eIg5fJ:sxZM7lMX5/f3Ys4Oz1fHb1/nP
TLSH
T1A152E811AA34A97BCCCBD209FA41BF53D6F5057292940E54ADFCDA1C05E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 971410b105d17523bdeea7a7cf23032ee4047c867ff91f33502260fadc5fdbb4
MD5 12f1edcf6edb6aa625bed8cbd791f84a
SHA1 0a8dea21277ade490449742535d8bc033ec78d52
SHA512 f12f864365784ce1fb0ddad491e73272b2eabfda0e8f20c2f315588c936e6c4a3ee67ef2f26daa5e4f24b3e79d534cdf6819cc81fafdaa98ceb7b559034e907c
SSDEEP 768:+z4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d5roh+rc8aM:+z4jeXmWvmKLEu1jacPLZQdy0gE
TLSH
T11BD20A3B244CCF7E4F844E5CEC26AE976ED802CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 0fb67581849a5fcfe3f67d7b45f823bc797e5cc70f9b42b8e9fdce729f30e9a6
MD5 eace029398e82e14b845372981363874
SHA1 fa300d249c53cea28826fc0f7ef4890e3d54a250
SHA512 2d202d428b1bafc62bdccf1532364b435ad835a8dbe57a40fe6cda339bbe53407a9c42b4343f7e4bd2c4748b359da2519a41de7e82a4e48f5f461243f0eb64f4
TLSH
T190B0228300AE00CFC0CC8332C88008C832F83C208B83300282BC2AB2C838300C08F00A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590805.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590805.TMP
Size 48B
SHA256 b0c9e4bdbec9b195f7350029a28e7865b71a385a364fc11b893aae0b47e8b46d
MD5 a1349370c4850c0d3c3243753e09f9a7
SHA1 71c3960df1330ef0b8abeb84400cd8f076f68b95
SHA512 9eba7416f6341747511a6f08c8f8d3e01044083a10da7008bb7a8604daac3042a5dde4407bae3e2b795f586b2e7b60f81c1e563d9efdcecd03cf881eda852aa7
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3185a39d4e50db1b2cd4a54a6782e0a9ed3c314be1e070007e9c2ff863c9e08f
MD5 58c64845e5ef993790c4476ceea32f9c
SHA1 12dd606b25e6fc02f6552ec98183fa3abeaae046
SHA512 a7b792936b18d68a6ef27096931c9a25d6744ea31de813c203d1d07d9a8ee98a81b239cd07fc2327887a39ce928a9993c442817f2c8c782270a2c5e33041db11
SSDEEP 24:KdRtfRoR7RSaR3dRfR7Rz4RLRv+RCIjRnRzKiRchaRJRz1ER1RjSmRdMR48R7RQR:K88I7KZiEzyNdIpKGkcqQI7KlSs7yS
TLSH
T16891FB5672BE43023D3E2C0C97A1A767174271E33118A52A7BE840B65E67E680EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b60f8d0d-265a-45c1-ac0f-a459b8c6f398.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b60f8d0d-265a-45c1-ac0f-a459b8c6f398.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b49246abbb04fc871931009a00a841cdb9cb849e17ea3e70d7bc8e8c056451a1
MD5 f1c8f468e64da711be5b02f8e5f4f2e2
SHA1 033b7d6976e784acf4f5d9025f7f0c4db0f4e0b9
SHA512 3ba7ddd75f9246775447c4b4cc796112cbcebfec67969f5721f588cb8276d841f29f2bc176256400e51ac9e8a9390f70559b9fff968539e08a6e442e9aa4c181
SSDEEP 384:UsNwTV3YZMMqTdhf+98RUlXU+2mKFPVX+7:UlfLRJqlUlm8PVX+7
TLSH
T15D422C36A878AC775DD29281F40B32139EF951579AC93F94D6EC6F1C00CA6AC230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 bc0defb5028a667b58037e96cef683624b6fc36b184ef0cb38bbe4f1454aa3bf
MD5 ac436a3194c8a8b7a0ca3e16a2cdf3a0
SHA1 143fa163031acabe91ade8dec022fff12a39439c
SHA512 c4047e79c2c5cc68e4dfb05b1fddbbccfe80e6f7868fe9bc776cb20c689ad91ff5dafaa3635f1ed7a9164c0c722499d013047e5497738327eb049935891a1763
SSDEEP 384:ciFiZcIqzsNw8TUNTUlIlxV3YZMMqTDhf+98RUlXU+2meFPVX+d:HFQidwgpfLnJqlUlmQPVX+d
TLSH
T168B208F258D79836DDAD9743E77D2D128EBCC063B5856690B3D89A0CCC865BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9c8c1ba7657e6ebfa67abbd6f5850742bbf7a968058a5a85fbd5584360bb7135
MD5 ebbd967688a312b608445eeee23d49d9
SHA1 44c95ab81871d53cfeb535437cd10aadc3ddd66f
SHA512 b435f7eada828d1c08fe06d0a73d00f4a59e4b70ba6cc317434712a4b8c54b5987a09e32dfa5ce030981517dfa5261cea4ba725bd7207fe1254cc334e4d7da3b
SSDEEP 192:EONu6hZ0QmiUyNdpc/+jVnjzorRUY5wOZ6zU6:EONu6oEpu+98RUn2kU6
TLSH
T1A302EA35A8787C678EE2AE45F48727235FE5116BA9956F84DAEC1B1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 9a7fedd347e304d089b990465cb526eaed73f661648df6eae06b32c6d71b0d33
MD5 10debe5d0a5121a6db83c0d9c179c380
SHA1 7cca01ba6b9b84ae23c4dbfd5d48ab762348b21d
SHA512 e1d415b8006b9a1a950acc1fc9bc282a5685d5b9f65a4c43c3cf423cf2e2835e18a601882dd204a3fe6eb36169b54f192c30b028fbb1741e6aa96307e70b0b3b
SSDEEP 384:nZcIhsNwxV3YZMMqTdhf+98RUlXU+2mKFPVX+d:PhffLRJqlUlm8PVX+d
TLSH
T1F5727E326838AC765DE2E641F44636138EF95167D6C96B84D5FCAB1D00DAABC130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a505ad8fa01cd4c77db07f12fc19938f5d4b79f726fe8010a5738834ab9915a8
MD5 431053b40360245b27ec1d21aaf2febe
SHA1 b48b11b4fda962e7dae26b74eea96b918379d827
SHA512 be1b132715355c92938405ae7004d0fac7aae05fdac6c92a59f85a7c884f649acc7f10253ea083adb90cf5f939c7dbb3eb318e173a24103a2aebdb470660d319
SSDEEP 192:dONp6hZEQmiUyzdTc/+jVnjzorRUlXU+2m05cOqhqkVU6:dONp6osTu+98RUlXU+2mH9PVU6
TLSH
T15812FC366468BC675DD1AA51F44732139EE95257EAC97F90D5EC2F1C00DFABC230AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9eabdeec-15e6-403d-bcdd-9dad67d5eb9a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9eabdeec-15e6-403d-bcdd-9dad67d5eb9a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f988a1202e26ff50af370b63e5eac01b84430cebdc684e4c7b4cfeeaf234ad59
MD5 e6c997bfeb79f3112ad2e46ad8e8a5dc
SHA1 3a8f0c1eb4b56ec912cdef8ff6740c665ee5b2bc
SHA512 3b93ea0c0cb5938f5e50597b2bd75a35df4948b421f9c4316cb85cbbeefc98849fdd7018875782e6b25954a5afebaa84aa26d907938dba290af2f0a18716c811
TLSH
T10C41FA58A6EE1148B3B76F465BF6B46E487BBD772E0AD45D00010E5F4A36B40CDA1733
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download