hxxps://www[.]fefykee[.]com[:]2087/1035[.]html

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.fefykee.com:2087/1035.html
Sample260802-n2gekascpd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4372	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301452319310924"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{6E15BB2B-A41A-4AC4-9E2C-CA46794A94A2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 4660	1132	msedge.exe	87
PID 1132 wrote to memory of 4372	1132	msedge.exe	89
PID 1132 wrote to memory of 820	1132	msedge.exe	90
PID 1132 wrote to memory of 820	1132	msedge.exe	90
PID 1132 wrote to memory of 820	1132	msedge.exe	90
PID 1132 wrote to memory of 4568	1132	msedge.exe	91
PID 1132 wrote to memory of 4568	1132	msedge.exe	91
PID 1132 wrote to memory of 4456	1132	msedge.exe	92
PID 1132 wrote to memory of 2060	1132	msedge.exe	93
PID 1132 wrote to memory of 4456	1132	msedge.exe	92
PID 1132 wrote to memory of 4456	1132	msedge.exe	92
PID 1132 wrote to memory of 2060	1132	msedge.exe	93
PID 1132 wrote to memory of 2060	1132	msedge.exe	93
PID 1132 wrote to memory of 3520	1132	msedge.exe	94
PID 1132 wrote to memory of 3520	1132	msedge.exe	94
PID 1132 wrote to memory of 636	1132	msedge.exe	95
PID 1132 wrote to memory of 3520	1132	msedge.exe	94
PID 1132 wrote to memory of 636	1132	msedge.exe	95
PID 1132 wrote to memory of 636	1132	msedge.exe	95
PID 1132 wrote to memory of 3440	1132	msedge.exe	98
PID 1132 wrote to memory of 3440	1132	msedge.exe	98
PID 1132 wrote to memory of 3440	1132	msedge.exe	98
PID 1132 wrote to memory of 4160	1132	msedge.exe	99
PID 1132 wrote to memory of 4752	1132	msedge.exe	100
PID 1132 wrote to memory of 4160	1132	msedge.exe	99
PID 1132 wrote to memory of 4752	1132	msedge.exe	100
PID 1132 wrote to memory of 4880	1132	msedge.exe	102
PID 1132 wrote to memory of 2208	1132	msedge.exe	105
PID 1132 wrote to memory of 2208	1132	msedge.exe	105
PID 1132 wrote to memory of 1112	1132	msedge.exe	109
PID 1132 wrote to memory of 4992	1132	msedge.exe	110
PID 1132 wrote to memory of 4588	1132	msedge.exe	111
PID 1132 wrote to memory of 2264	1132	msedge.exe	120
PID 1132 wrote to memory of 2264	1132	msedge.exe	120
PID 1132 wrote to memory of 4456	1132	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.fefykee.com:2087/1035.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff86e12c188,0x7ff86e12c194,0x7ff86e12c1a0
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,9628008691919387330,10158820381450882028,524288 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,14286842107345964173,15664963152314313235,262144 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,6487549638997484540,1573409624301144532,524288 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,6876903032830137819,11553339923285599523,2097152 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,6561621350988900259,8621045177588278339,2097152 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,4355753640128238699,14895246889292659480,2097152 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,2241523203120320794,11932823316461172425,2097152 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4988,i,13797137328054852741,4815320022485174823,2097152 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,10636661774793705343,357894651159638742,524288 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,10707089271186916802,5189503071125218214,524288 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,381348396443583302,16701593821643231001,524288 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,381348396443583302,16701593821643231001,524288 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,2370234897930579953,12732959040771904551,524288 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,12663421027669342187,4383804120927594393,524288 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,6502294531317110472,7813101979826715589,524288 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,9160324033904749082,6331107234752693303,524288 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4008,i,13426051442593141987,16006245698817584978,524288 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4540,i,7441968560854301124,6554958599857313248,262144 --field-trial-handle=2380,i,10611636875108108871,10170187310778956655,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 566KB
SHA256 ed3c24ba5561ab443050cb4fcc57a9385302333d4b7bc71c0abd3e6258f5d96e
MD5 66ca6491ccad400470af2b8ca75c0185
SHA1 281ea3ca7fa0be3bc1ec36572e2c7ff3d4f9ed80
SHA512 c1272f8ae2bb14d0add3f7e01eee535dbcc45b6928c649a7261331af71e84c8d15e3b4005d292972307ae9370981b7aba11bdd5979c51718be2613ead8da948a
SSDEEP 12288:vJOi+KUi39q/ImEERDAPJi313LMLIUQMPdpH+LqLaS:v1JTQ/MWDAOiOgHVGS
TLSH
T1FFC423858BF204CCCD3A3939B38D9966452DF1931E5447CBB934E9FB62D022C6E8758E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2db7eb9f722c5454665c26bce201bcf815b7210aa93f810df6b27c9d9348576a
MD5 3670769bb37a7b0b11ceb614cea61a99
SHA1 cd270f4ae8ec8e4187da6ae4e4ca19a61e25f405
SHA512 c2b348517fd90e4ee9087617b011d634e6a2fa8c31b65d86adcce52a0815babf29adeb9dd4506a79de0ff83c15bdb45f100b84c117ce9ccc8a540c264a3f1f76
SSDEEP 96:6RLZsW6vYcjel63pZC2+bb9nLSA25VB+lyN1+:6RyW6wc9Z+S5Ve
TLSH
T149913C35818D04A3EBF1013FB0E28A1A7139C9E2FA475E6314B459B5FE1AFA543B48E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5905e2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5905e2.TMP
Size 3KB
SHA256 2b03c9a0d56de824bc73eea3260e833db75eb63b9fcd6acb1a773996e068aad6
MD5 2257224c3644a16f27d21e52ba103a92
SHA1 153320e6356bfdb7425a6cd9a3621398e4cef969
SHA512 a36627a6ca0d6525a07124f0719b698c30e31ffb75ce0a20a490d2eab8f16c224480340bdba7f8dbd0e3e72918d98f15b8b8a2590ec90906356b38cf5dbc7f3e
TLSH
T18C7173390A4E04B3E3714173A5F2024A713ACAEBFA1BAE7725F40D763A14F6183B81D4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ca9f47b382d2ee9ed531d60aa1e41125c4626d5091ad2046e5cc60c26ac82df4
MD5 725b4a8172264165e33d2cde5488a0fe
SHA1 7ae13b7e52b9a6bb81801014a139146e6694df12
SHA512 229b5dc6d354122ab29f3cd2045f6e7ac8e1290e2aed6a4e24a91cd3a4ca278ee2510e079e522d9e2b20c806ba8817e68cc66d28d69881c2b0adf4c989db27ec
TLSH
T1653199F783F5956E8A2152F09A18AE2FCE6C0512832C7D7985D8AE2793E3471E101E5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 95f145a773b6a807c93017d6249c9c2c861de14f27c832ef28e94462022fb93f
MD5 ae1d783311c72e6e0e71fab5f8a61e8f
SHA1 8f114f9f69815944dfef50104c72ed3fac0fc349
SHA512 2c8ee29caa1a0ab6a66d4aadcfbed7e1dd3399de54eafd1029404d7473db15872d5e53db4f4c123db08b470a7dc3722adc6621245e2c9c2a68db7f401142db39
SSDEEP 192:sxZeRpyM/jK1Ml8Mkij/fqsWEQVQVIdpDX3HW6+WNF8mj/YzWeKrtxDIgrJ:sxZehMA/fqsWEQVR7Hbb/Nb9
TLSH
T17752F8026A34A9B7CDDBD709F945BB53D6F50462D2900D44AAFCDA1C05E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bd28be023ee87aa30d2668542fbaf9a2f6fb52e3efa51c22751cda7affb93996
MD5 8069013807ba8ff88d01f1e9933f3611
SHA1 6ccc47ae3fd1e1272f56d74fed10ede7466d7fe8
SHA512 ff6902ea61833fd04295fc41bb0c0d13d710d730643b1e2daee6e4d091fc8c57fb6a0c150dc03597ba0ec85ecd49974f679929be56fbb0a5da7423df27698cf6
SSDEEP 192:sxZeRpyM/jK1Ml8UQ4kij/fqsBEEVQVIdpBX3HW6+WNF8mj/YznFKrtxDIg5+J:sxZeTqbA/fqsBEEVRdHbb/xbo
TLSH
T1EA5208126A34A9B7CDDBD618F945BB93D6F50472D1900E44AAFCDA0C05E6FED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 433aa905e76bd24b5d32750c10a6c4f67f6e944dff87d627f9350211b19393ff
MD5 df60401cf6720b3fcac023c951c9d56c
SHA1 8c4391b95fd389a027b8eaac6a81942c8c3635de
SHA512 3f13d8b5ed03a87cd1d0cc9d191b0accacf93ecd4c1a57e9a3d8634b184dbcbeef913b928e2340dd73b7e567d69699bd3065009e088f5e72395d9c1f1ade7237
SSDEEP 768:f985W7kf0Wvqina8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj84roIi0vPYCL:f985W7kf0Wvqinau1jaa5LA3j8D7CL
TLSH
T1E7E2FB3B684CCB7E4F840E5CEC266F966ED801CB66988D544BFA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1ac153220bdb586ca6184b454c0fe91de7eca9f102520c236b86c4c70089919d
MD5 3d4fb5a2bd57dd98dc7a7a9c50b48039
SHA1 4220198521c291bc029ef1851745bca3993036d2
SHA512 b79373d5b8631c4696e1fe66c6b03aac068b60b42d53c23fef453f66af9640039a66cbeecf4694e76ae67054c4cd9f65c697ab1f190e3025ed5ef5c1cb01903e
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbwIbKxK0nyNHIhKEIcUZIlKCAgPyD:KIbCKcbwQKxKmmH6KEIDZOKCAyg
TLSH
T1C3A19315307A1E9238BF3989B199953A1F4231A33214B47F7FB904660E6BE121DFD8EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e285bc4c-80fe-41d8-96e7-ba9850306f6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e285bc4c-80fe-41d8-96e7-ba9850306f6a.tmp
Size 13KB
SHA256 f1b83f1fd8f0e8fb645d78a4a977da6e9401da4662260795b4197c0e44eed449
MD5 791518a2800454495a213f813cabd38e
SHA1 eaa3f1e45619f2376fba010e77275f1e7f299dde
SHA512 eab1acbb812ca30142a2d837412f6cc7993726c9df7d80dc8cacb86f0d6a9054371d4f87e73c8ac96762288d4ce543d83a49497d7e31fe909ba820147c99efe5
SSDEEP 192:sxZeRpyM/jK1Ml8Mkij/fqsBEQVQVIdpDX3HW6+WNF8mj/YzWeKrtxDIg5MJ:sxZeTMA/fqsBEQVR7Hbb/Nba
TLSH
T1095208026A34A9B7CDDBD708F945BB53D6F50472D2900E44AAFC9A1C05E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592178.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592178.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 345d880e8a8fcb9b85a30084d649575e9d96b17ef244165ba710c4aa0666dd04
MD5 fcbc5269051600fd70a65920658d07c6
SHA1 83e354f3f3dece93625ca08e0ca2cb2c3633693c
SHA512 e64a6e1a3db8843c983eca2d258abdf08940dfe7745df6241ccc5117ae9cb5ba62fa19fc0d74108afbde3c693257b23285e4260d5450ee5c358cb0355e9e1d0b
SSDEEP 384:RZcIhsN3Olr2wbie4CsmF+23KUnTKwBODNZOCfWb:5hWo2w1rjlaUnewBKZOeWb
TLSH
T1F6929D756C38AD765EE2F240F84A32074FF88177F6C45B54A6ECBB1C05AE668130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f3a2be8b9417ed8466cecd90408b7d51491ae067ad6044b7d0012bb131fac5db
MD5 5f373d393929586ff2b8d0d2b249672f
SHA1 2cf148c9772d6921c289e5a4f4bf77527654d770
SHA512 049a8dbcd27c9c78c9555c33640bdd6d3b8a70adac1dacd26592ece0fe19305ba76e26b2eed8fe6f3681a1dee35a050788dd83de3c75e1caa1c8948ce2b707fa
SSDEEP 384:5/iFiZcIbzsN3e8TUNTUlIlIr2wbiB4CsmF+23VUnTKwBODNZOCfWb:5KFQPWewgm2wOrjllUnewBKZOeWb
TLSH
T1ADD229F258E7887ADEAE9743E77D2E024EBCC163B5805650B3D8AA1CCC5A17FD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f59075a60c870d651f4544d33c04c75bb84e3e1d3f046c1bcc8643b498e28b02
MD5 36d1e4c6ead30207700d366c896f097e
SHA1 d6fe99edd942eb65cbb72514cd22d9ab18dca7a6
SHA512 b56202a44ed775555ce90fe2a50e818ce09d4cec8743e00038e6be0dc2de67c57c5d8f65ee3c6eb86e12b2682e20eab6ad55f8ba0a41c2916e3d44cb972b804a
SSDEEP 192:MONH64BAQmiUyi1dW5GBPKpcCsmZaD9FU6:MONH6eA1jW9smSvU6
TLSH
T1A6021A38AC786CBB9EB3AE05F48637175FD4116BA6D45F44EBE82B1C00D764C234642B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 54ebaa572e7b4eaf5419bb2480fdc5f9cbe86a6212cdacdda411a0cacffe5b26
MD5 3df032f75e61812a9b9f1de1b4c502bd
SHA1 a91069eb51f52eb0dddbf5ea50fb4b66fef7ce67
SHA512 673be4f6bd6aceaad3d76aef43da532dd76398f6458cbf3ddb7388fc7f8e97c1f525a54d2688c4fc78f75d53133c6604607d8ee96a5896b0045ba94786dbb1b1
SSDEEP 384:8ZcIhsN3OIr2wbie4CsmF+23KUnTKwBODNZOCfWb:qhWT2w1rjlaUnewBKZOeWb
TLSH
T112929E756C38AD765EE2F240F84A32074FF88177F6C45B54B6ECBB1C05AA668130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4c087319202d017fc52e49a5cecddca24702ac98ebe1e78e0c49dc07a24162fb
MD5 d3d012407df0674bb9b8932c0128c34b
SHA1 ebebdd0577ab9d690860bfa81a455536905e17e1
SHA512 5078ebdd6f70d3d4146ebe97ce32e39bf438c4056384ecc3754c9f655076dce6c23d37df8f122f70562b4f1209f1bee9177a121e92bb384f959d2f579824456e
SSDEEP 192:XONLb64B4QmiUyGdI5GBPKpcCsmdb+23qWwTqjU6:XONLb6eY9I9smF+23oUU6
TLSH
T16A121A75ACA4AC3B5E92A550F48737135FA5412BEA84AB40F6DC2B2C05EF76C230A416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a9901e3-cb52-4458-9645-ef4b014d52e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2a9901e3-cb52-4458-9645-ef4b014d52e4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c1a9166b816d3d80f21b639bcfbbdce68e824cc24ef38b4657933550bffc0f90
MD5 3e6ad0fbcb288c4eb6e2dd20f62f90e9
SHA1 88d638398479fbf2696c6fe1b070ba0b0bf84150
SHA512 26bb628c3edb4dcae9aecc611a8b949af4a0202d3a1a61c7aca158fe088c01f2b1a2800f4ba1bd027859053ddc8f200009ca9a66a7c20cb6f4de010965d3bdad
TLSH
T1B741169CB6F91108B3B7AE1A9BF7A86D487B79372E5A955E00000E4E0663B40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download