hxxps://encuesta[.]team-survey[.]online/s/3SMVTzwnC487hMSC3NjqXqgVXU4JFQV0ib8Mj1pxXzwteTKb

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://encuesta.team-survey.online/s/3SMVTzwnC487hMSC3NjqXqgVXU4JFQV0ib8Mj1pxXzwteTKb
Sample260802-dnb8kscd49

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4648	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301137439565398"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{D3F2B17A-3861-44E4-AB1F-612CB3AE1E61}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 632	3836	msedge.exe	85
PID 3836 wrote to memory of 4648	3836	msedge.exe	86
PID 3836 wrote to memory of 936	3836	msedge.exe	87
PID 3836 wrote to memory of 936	3836	msedge.exe	87
PID 3836 wrote to memory of 936	3836	msedge.exe	87
PID 3836 wrote to memory of 2112	3836	msedge.exe	88
PID 3836 wrote to memory of 2112	3836	msedge.exe	88
PID 3836 wrote to memory of 3988	3836	msedge.exe	89
PID 3836 wrote to memory of 5028	3836	msedge.exe	90
PID 3836 wrote to memory of 3988	3836	msedge.exe	89
PID 3836 wrote to memory of 3988	3836	msedge.exe	89
PID 3836 wrote to memory of 5028	3836	msedge.exe	90
PID 3836 wrote to memory of 5028	3836	msedge.exe	90
PID 3836 wrote to memory of 1864	3836	msedge.exe	91
PID 3836 wrote to memory of 1864	3836	msedge.exe	91
PID 3836 wrote to memory of 1864	3836	msedge.exe	91
PID 3836 wrote to memory of 1052	3836	msedge.exe	92
PID 3836 wrote to memory of 1052	3836	msedge.exe	92
PID 3836 wrote to memory of 1052	3836	msedge.exe	92
PID 3836 wrote to memory of 2476	3836	msedge.exe	99
PID 3836 wrote to memory of 3960	3836	msedge.exe	100
PID 3836 wrote to memory of 2476	3836	msedge.exe	99
PID 3836 wrote to memory of 3960	3836	msedge.exe	100
PID 3836 wrote to memory of 2052	3836	msedge.exe	102
PID 3836 wrote to memory of 3480	3836	msedge.exe	114
PID 3836 wrote to memory of 3748	3836	msedge.exe	115
PID 3836 wrote to memory of 4048	3836	msedge.exe	116
PID 3836 wrote to memory of 2400	3836	msedge.exe	118
PID 3836 wrote to memory of 2400	3836	msedge.exe	118
PID 3836 wrote to memory of 3536	3836	msedge.exe	119
PID 3836 wrote to memory of 3536	3836	msedge.exe	119
PID 3836 wrote to memory of 1412	3836	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://encuesta.team-survey.online/s/3SMVTzwnC487hMSC3NjqXqgVXU4JFQV0ib8Mj1pxXzwteTKb
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffe6e2bc188,0x7ffe6e2bc194,0x7ffe6e2bc1a0
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,15246196732555024661,18171732694570915403,524288 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,14385621517532333181,11930237572076658402,262144 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,18352378636056048232,11919854536918608297,524288 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,8149675810362479393,8599566914040248331,2097152 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,5490156818410388615,5431708198927038419,2097152 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,16614491508528533082,2091810545098361536,2097152 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,11179529133439615657,4725201026911095227,2097152 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:2
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,4181546041113590052,18070173771785554687,524288 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,8670250637378832954,9145649611997159592,524288 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,12882424474333633794,6340484766479525403,524288 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,12882424474333633794,6340484766479525403,524288 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,18274899008743697216,14618673455128438290,524288 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,14461297563043658530,16504332813948130169,524288 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,9788407727740091082,6471027721989427071,524288 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,14645891242128126295,12445494094346337541,524288 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,15454498026365336381,17707691388247263728,524288 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6184,i,3404763994665683228,4055905271952213364,262144 --field-trial-handle=2364,i,15247622920917958364,558935260442705059,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 93f94da1d421b7ae21e46ed435fb6c3b3446eda90e17e1c144f955ca34313b18
MD5 9f5255fe099554e1258aa04d2960c03c
SHA1 41e3470303547ff55aaef6b2eb9d4d4fa45235d0
SHA512 447757ed697730458ab7c25c6cf4540a4f8b1fe9f9242bf25320ae7a1c45ac65749cbb2466db55a77e61e81cac1b9c4ede507f285bd35e7370b9e1f6e15cb8cf
TLSH
T11871C7F5A6C10895DBCAD3B0E2D21100FB3B71EAF90F7ED28D941AF45907319A9D9606
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589788.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589788.TMP
Size 3KB
SHA256 820601bbb7380be1a4f5fc0da22bd86127151053d36130d46f84e6f794c076e3
MD5 19e769da99213e4efa57424aab66ee4d
SHA1 2310210a8cbf92ec4293eaad5b0a925aa792e33a
SHA512 7d64bc1b7ce1313eb45f665a72502eaf64da6549584c443ebe3cb5307f272ba55d0560ce11649c56e22be140a529415ab26e693e7f61052692dfb09fa6d0072e
TLSH
T18471D8F4A6C10894DFCAD370E2D21100FB3B71E9F90F7ED28C941AF85A07319A9D8206
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e531f79ce44e7837e065a80cabfd1b949f9cd6f0198a499852ed83539609c81e
MD5 193e20aebde8380befbd3ebf65096144
SHA1 67a80d2d9ee63db7fca1f3d5d49f60c033d62152
SHA512 857e8b53104d25468253a0662e7a495c3868bbb6f9af77f16fb35f325f6b7e4a9dbc4f5aac4f70e461bed20cb5589f770cd720a931831bf4c98962b682918054
TLSH
T1A321CCF7C3E4856E8D0052F06A18AE2BCE2C0A02436C3C5AC6D8EF1B97F2070D10254F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fb6cd02b59bffb67119814dc1bf41a7a0fde3d216f4e9170a712c400fcc46733
MD5 a43d0ccdc00979476628eaea3f87fcab
SHA1 f23b62bde63293f10ccabf6f7af012070928f65a
SHA512 3ea8a8c6079f7c49c929f5ce580ae533c265b985a134af088a1b759e354b0bc61139daa190ad2eb3c8a22730ac48f987fa7f15b61c6d15ca8e325f6e15cc79af
SSDEEP 192:sxZcRvyM/jK1Ml8MkV/fns44XW4IdpAVHW6+WNRcg/YzMuc9Ig/u9J:sxZcxMV/fns44XEsHb5/x2H
TLSH
T13E52D8516A34997BCCCFD209BA45BF53D6F5147392900D58AAFC9A1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7d8da42027c499a77bde95256cfd9c12c69562ac97ddf26c32658582368ab4d9
MD5 744bded1c12b46d4f213a6b8560a263b
SHA1 5131f2529a15cfc9e02dcae683dafe0a3268b1ff
SHA512 8c539f203cbef19f5d701de1f6750728cadb771ba6bd0008c0fa1cb1a831986f597082d63434c65b88f6e6f32abb3bb3012ce85cbea4e99c774699b05d2d9bab
SSDEEP 192:sxZcRvyM/jK1Ml8UQbkV/fns/K4XW4IdpGVHW6+WNRcg/YzD1c9Ig5Vu9J:sxZcxqwV/fns/K4XEqHb5/PWH
TLSH
T1BE52E8516A34997BCCDFD209BA417F53E6F5147392900E48AAFCDA1C05E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 61347313d42869a5a552850314b871e21a597f6a2a35255abeb9d0178e93c691
MD5 60358fe86d97519e16966789ed7d10c7
SHA1 ca34d0bb485087a8bff403f66aff95892b2b1d7c
SHA512 7d05aacfd4c365022168f448db4000462602eeb83d4cd2d2291f11ab426c2f8738c57bbc99483f84657b8abd39fa7dd9f84d3ff9333be8d783dd5293210506b3
SSDEEP 768:zeW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjgroIciKYk:zeW7kf0Wvqidau1jaa5LA3jr4k
TLSH
T17ED20B3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d5e18746b09f8dd4105d21f3fa901d330faedf7ed401629c77f056237adcf943
MD5 776e0f355698c25bbc4928f36f8bcfa7
SHA1 5ede2126459604e5c6e3f0920d6c41be84f88df4
SHA512 503fed64192c9165f056593172e7f2803fc2482aa5bfff45e96a54bf92c64e893529f2ef771636cafc6d500b47907c2707117febb3b9c0af9b576543221e2200
SSDEEP 96:KIbCKcXfGKAIG8pUtJvPv693CJrZ6KDPr76/JhqTdkQKF/:s69fc/
TLSH
T165915006713F42413C7E282C93A69B264F827A53381C64BF7BB844A25E66E110DFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592cc3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592cc3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 670828df84f4efdfe5a60296c2cc9c9ab009be2c82776c11a1895ecbfdaac1ca
MD5 9bd69993f55fc8a64ba70632792d150d
SHA1 5c62e2a8a974cec72a4da34aa59d881492dcd083
SHA512 a692b67c316de7d51a7e9a3603eaee81dcc85d4c007a9ebf5b3aa3dae1ad05243fbd90a660a57a71e6f228bdfa1d07be4daba8c001d14570b2256513cc5f4d42
SSDEEP 384:bZcIRsNKq6bt2EMxd5ml+2PRkHoNnTKwBODNZOCcKDnm+:DRfZwgleHoNnewBKZO3ym+
TLSH
T189928E715C386C375EAAB145F44A360B5EF88177F6C42F54E6EDBB2C05A9298230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 382553eb8aca8e92f114174393403891d8617ec3690e28c8644967a4ec8ea368
MD5 70846e67ab48c7d58ba632015ad8ef18
SHA1 5bee5e721b167ed25a5ce0b64807c819bf0ec4d7
SHA512 dd41f1647d42828d8537d1e6b01491fca6dfddb49a581a2794560a956a71127bfdc16b69feeffe75f99803884c78f22decd8ad26d89b95c5e2c4232603174ed8
SSDEEP 384:XiFiZcIK3sNS8TUNTUlIly6bt2IMxd5ml+2PRkOoNnTKwBODNZOCcKDnm+:SFQ6Twgv1wgleOoNnewBKZO3ym+
TLSH
T11CD23AF248E7983ADDAEA743A73D2D074EBCC063B5806A54B7D96A1CCC561BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b0b120b22e33a9fbf5b08385ac87227cd6272b1a6bbd2501c101f9c5fccf720b
MD5 8f9ef85404ae2c3a4b0bdd29f265b36a
SHA1 5ce7e74dbfd30078552ef726696fd49166f99361
SHA512 323f971221136d683860c87b9db6f73fc9190c73ac5bfbc5caceaa3ba922af732b614773af875608fa9d31427ee75035f466888480194f1a364ccb2c41d74a3a
SSDEEP 192:MONC64BAQmiUyj1nW5GBPKZX+FdGumWaDYTU6:MONC6eAwxW+d5mziU6
TLSH
T17C020B34AC787C7B9EB2BE45F58637175FD8103BE6842B44EAE82B1C009765C230782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bebdabf22efde080e5fcd30969a14a7d124e337e577306feec2969ad19ee9eed
MD5 9a09820624ab20b3458993d021441567
SHA1 d3ceb91612d7589e9f98b3623ebd50cee5c382e3
SHA512 eb4bdb7f088d4cb68a1a1d8595898ebbbe6fba0005c6429f39a9750f0a026ef812db84869cc1cb2e9b909d7ec209037cf41b5e2fdd2b0167f860e51a3c8facf7
SSDEEP 192:KONz64B1QmiUyxnc5GBPKZX+FdGumHqK+2PRkXWwSqYNU6:KONz6eTYc+d5ml+2PRkDoNU6
TLSH
T126122B355C74AC2B5DA2B545F08736075FE5412BEAC46F54E6EC3B1C05EF7AC230A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b36b0c4ae6afb346f24342bb03565e2a0a6def451450ebe56ec5bae432e9a0df
MD5 c1efbc43e8ce847975644db79ce2457b
SHA1 000b3ca7e88f6fa3c90196cdb3b9616f159d112b
SHA512 bcaff0e402eb648d19af5ce3f572cd802f223296772b093c40cdfc1d33933790724f57a0b81e2dbe02e69f311a648c85a65c19e3be7e77e179453c3761d73ff0
SSDEEP 384:cZcIRsNKy6bt2EMxd5ml+2PRkHoNnTKwBODNZOCcKDnm+:KRzZwgleHoNnewBKZO3ym+
TLSH
T1A6928EB05C386C375EAAB145F44A36075FF88177F6C42F64E6EDBB2C05A9698230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fb64e79-01d9-45f4-b6a5-dbafa3dcb32b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3fb64e79-01d9-45f4-b6a5-dbafa3dcb32b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c291ab63a64cdfd19978c32e5ddb2f9d4082f0211db0fdb78ba3b7eaaa717932
MD5 833454cacbe475b1c2246bb1a8a4d423
SHA1 9faf046dac9854c41ee72c961243d70a35f366e3
SHA512 746cc45b1e74ddff80eded21fad989cf7790e42a110bea9413033ce2da601e332ef113680db18e26360951440454a68746a5b86dd895428a1cbcb1704dbb416b
TLSH
T1CF4128ADB6F91148B377AF5A9BF6A86C547ABD372E0AD06E10000D4E0A62B40D871733
MD5 SHA1 SHA512 TLSH

Submit Download