hxxp://statics[.]moonshot[.]cn

Analysis

user interaction
yes
max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 08:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://statics.moonshot.cn
Sample260803-kgnflaef99

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302197171962681"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{25968F29-20AB-46E4-8276-A1366BDC15DB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 4528	5012	msedge.exe	86
PID 5012 wrote to memory of 1440	5012	msedge.exe	87
PID 5012 wrote to memory of 2120	5012	msedge.exe	88
PID 5012 wrote to memory of 2120	5012	msedge.exe	88
PID 5012 wrote to memory of 2120	5012	msedge.exe	88
PID 5012 wrote to memory of 1412	5012	msedge.exe	89
PID 5012 wrote to memory of 1412	5012	msedge.exe	89
PID 5012 wrote to memory of 4300	5012	msedge.exe	90
PID 5012 wrote to memory of 3824	5012	msedge.exe	91
PID 5012 wrote to memory of 4300	5012	msedge.exe	90
PID 5012 wrote to memory of 4300	5012	msedge.exe	90
PID 5012 wrote to memory of 3824	5012	msedge.exe	91
PID 5012 wrote to memory of 3824	5012	msedge.exe	91
PID 5012 wrote to memory of 1536	5012	msedge.exe	92
PID 5012 wrote to memory of 1536	5012	msedge.exe	92
PID 5012 wrote to memory of 1536	5012	msedge.exe	92
PID 5012 wrote to memory of 3608	5012	msedge.exe	93
PID 5012 wrote to memory of 3608	5012	msedge.exe	93
PID 5012 wrote to memory of 3608	5012	msedge.exe	93
PID 5012 wrote to memory of 3208	5012	msedge.exe	97
PID 5012 wrote to memory of 3208	5012	msedge.exe	97
PID 5012 wrote to memory of 3208	5012	msedge.exe	97
PID 5012 wrote to memory of 696	5012	msedge.exe	98
PID 5012 wrote to memory of 2112	5012	msedge.exe	99
PID 5012 wrote to memory of 696	5012	msedge.exe	98
PID 5012 wrote to memory of 2112	5012	msedge.exe	99
PID 5012 wrote to memory of 2292	5012	msedge.exe	101
PID 5012 wrote to memory of 4728	5012	msedge.exe	104
PID 5012 wrote to memory of 3292	5012	msedge.exe	105
PID 5012 wrote to memory of 2460	5012	msedge.exe	106
PID 5012 wrote to memory of 4904	5012	msedge.exe	113
PID 5012 wrote to memory of 4904	5012	msedge.exe	113
PID 5012 wrote to memory of 3432	5012	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://statics.moonshot.cn
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x220,0x7ffa415bc188,0x7ffa415bc194,0x7ffa415bc1a0
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,17459003969724533976,4678616772692735540,524288 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,14175386790177470908,1015442108013200769,262144 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,1299314339129953134,8302576145784213259,524288 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,6965289204003520099,14099806512274773622,2097152 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,2978708549033999765,14673984603346699958,2097152 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,15913062945487808715,17154537809254833770,2097152 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4112,i,11018413324759601852,1343136884499839267,2097152 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5080,i,2611551922999816986,11482606939535924357,2097152 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,135056995488423866,7213827913918473862,524288 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,16603216661126192304,1316841995099530372,524288 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,14800234810570547485,12497323371283749421,524288 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,14800234810570547485,12497323371283749421,524288 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,9941949268419487463,4157682402358484331,524288 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,8425189023612635868,9084939086715771347,524288 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,17767752087464797715,784262360726547429,524288 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3304,i,10140673005418118963,5563731096998903365,524288 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6364,i,14574994996939133155,6258764231691229073,262144 --field-trial-handle=2292,i,4682381418514167695,7669012803465346657,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 86f58006da590b6a6397eb32ecab83559def6e4467e696655355071b7bf2aa4a
MD5 448f19b0779a65b0be650a956fa5df6e
SHA1 3baed8e409ca650111c9646e8bf0dad44ff672b3
SHA512 f7785f7b3b588df9949bb0ddf9ccce50e7ecddfe0d32752bd78b9bf0c7255c65a9c30533b1b6de2eb00570b5d4f393e3d3d59d030c093e0902b082d13b1d4f37
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7d:fwUQC5VwBIiElEd2K57P7d
TLSH
T1A5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 653ee3d128a74e36e6cd32b6660c19a2ceac89711af9d879bcad3d1fc555e4b2
MD5 43139d03da50ca27dbc999552f0354ec
SHA1 1cf470f31188e3e985eef3e2cdc3ed3c4e39f93e
SHA512 b8b7be71e851e8028f94772c34c97e56095deb357ec7a7727c4343efbf2b41fc68ada74417c49782885e518a3f53d41181d4168397b69935819df820b19e93b6
TLSH
T149613E08005F6D6EE32D9DF2F3D1525F747D418A89AB0ECB204088BD1506BDDC179DD8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584f15.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584f15.TMP
Size 3KB
SHA256 a8b1c93fa0fa2ac45c42a5335b9b93385360607ba8f55a749ecd4bd63e1e41e9
MD5 1953589857d5e60c40fa14d2267c7226
SHA1 8c4aac1179b5cb3afa1392af038dc0db26be07db
SHA512 310a7938164067b50c3517587e47787cde4f0a444f9ed2c4968dfd0f7cd8df48e7a6d377ef88188a54eeb566416d569265fa7559a8ae9e2b751ea0e43c3e79db
TLSH
T11B614D08015F6D6EE32CADF2F7D1525F747D818A89AB0ECB200088BD1906BDDC679DD8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 39866867a1341ecd1cee0e12ed91e6cdab28fbc8a6d1eff7547985aded9e966a
MD5 105db2461e038f85c207d944a29e98f2
SHA1 8e482264bf899598af50c45e34837cb1b2f796b6
SHA512 b02139e598ac5e6bd77db88ae5191281eb868fe588842329fdb7aa25d74bfa16f32251f651f36685e7fb542cb984d0e3552e757ea9011fab4505cab5ec388c33
TLSH
T1D711AAF383E0856E8E0156F09A28AE2BCE1D0906432C7C2689D4FF2783E3475E10699F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 67af66f7a1c9d110662f2435ca7fc436f1fb02ccbb65f21c90f43967380d2a39
MD5 dc44f99e7a2c895c05d5955a3e4072a9
SHA1 01e8f25d77f2267219dc73112b0f59a1210889bc
SHA512 bdba78e8ec61b3785e26a8378e69ea062aba6ee224fbf50ed2d860d8cce20e2648a00711e442c651ac534dbcb5099d8c0236cb6acc6decc394cb343954e65b31
SSDEEP 192:sxZnRFyM/jK1Ml8Mk8/f9sH5xgIdpP/HW6+WN5beF/Y4WMfDGIgrJ:sxZnzM8/f9sH5xhHHb54/1q9
TLSH
T1BD42E711AB346977CCCBD209FA55BF53D6F9446392900E44A9FCDA0C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e4adec48c36212a9a8c82a9e30b6f29a1f0e291799b279afeac551c781e42d44
MD5 79ee27c40518e1fa3c6b5c4b6d4f8b7c
SHA1 65f83c9a9e498b9730f01b9a03700f301d6a360b
SHA512 08069eae2f12903717ae80d86b36ee1324aba82f18314edc95605a53fbd939d8a886617a47431fe2d0eb530ad624d8be80d16fb9ab01d201e71c2f496932f049
SSDEEP 192:sxZnRFyM/jK1Ml8UQYk8/f9sB5hgIdpN/HW6+WN5beF/Y40JfDGIg5ZJ:sxZnzq78/f9sB5hhpHb54/aqN
TLSH
T15C52E752AA346A77CCDBD20DF955BF53D6F4447292900E44A9FCDA1C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8c8515a2898868235bdc59a786b812fec8f2df482d78c39f9918dc6d44f784e4
MD5 4bf4684afa00a6d9d1e15663c3c8e4b2
SHA1 3f2b2c34712ed86e5af649f6c72d81c921c153cd
SHA512 d6d18054f1272f1c94b47f6cf25b7c42b980c7b78f91b8153699552f740c5105dd36c887318ba2789ba3933f67ca47fd111cc60c25e8f597dd5e1ce5826fa907
SSDEEP 768:FJ8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdqroYXkvUnC:FJ8iJPNWvx76ru1jahALocdBYcUC
TLSH
T17ED20A3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EE51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7ebf39b8a4051ce592abc3cfb6492e96dc00c8d9f3fa46a8d59edb785bb1550b
MD5 0e6f55e228044616608c8b7841799267
SHA1 16d99e9d7f211170dda5fbae49b1d70c85a2ab21
SHA512 df48069f49fbaaae6cc3828396e1938a62ddb6c619c9b4b4fc56bff80a174939ffa151855ba95e806b04c43e9308867cd364b5fe2026afa7703986b7fa9198a4
SSDEEP 24:KdDf6ZQaVdJ5J49Z+EIjFJKiWhaLJ1EDZSmLMO8Z6yXYRfcHuaLdzfn43b++Ij7t:Kc0I7KVScvyBOIXKnqAPcIjKxK0ryw
TLSH
T15A91580172FB52523DBE291DA2A1B717474271A33609E46B7B6820B30FA6E241CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58ec11.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58ec11.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 028e353b8c5a16378696e40640d59dad4bed251f2b6844fbe11436d543a258b0
MD5 aacacde2e8194d4820baa22d3501378d
SHA1 2d8800f7dc2647042a97a490639ebb85da1001fe
SHA512 2c30d9f66379e4898b76c9edfca9d7b90493f4c39a6e8af200636c1eeb6212ae91b267ece01286d92228adacdc586f9a6f82ffcd56f162effa45677d72884e16
SSDEEP 192:ujm+xasuheOwQxMGsNdzQlACYmVkQmiU1Js+B4k03cmxmFTLIKq4E6wt2lU0Byt4:BZcIhsNdzE24+ukmKgwE6HlytEDq1cWm
TLSH
T1BD929D3059B429779DB7A152F48B39174FB8C023ABD86FE4D5EDBB2C04CA194030B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bde5d61cbaa0c05b1203505d9966e82d9dd1833e19a4e389eca06ca8da7b6530
MD5 e95da0d9bc3e9aaa5ef8d385131b5a58
SHA1 a97890629904b4322408402cbe82094ec1d8fe18
SHA512 380b7fef66a3bcac1d93d42fd41ba20bb3f1866359e262706213c81c48fbdb301aae32c90d35502a3444fafa84474d826bab492ee876deb704c288a07e140862
SSDEEP 384:piFiZcIxzsNn8TUNTUlIlGE20+ukmK1wE6HlytEDq1cWm:AFQB+wgLswEoy6DqqWm
TLSH
T17CD228F144E7553AD9AE9743E77E3D064EBCC063BA94AA94B3C9661CCC860BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 162bd5b9dfeb9e0b3ceaa87c7aff48187fecc9e6731f5dddc687a14b613a6e71
MD5 f731d1983f4a46d0652c67e5b2861e61
SHA1 1ed2f9ef8c4d704f8f74f36d62d049f6daad2d21
SHA512 682d68e007824b95be1a77830c4fe6e42c8a064638140ee009deecd5b9d3a1fd3a9c2526c4200d1e7cfe79d18f26d3b749f78be2e305df9b8fdca49a8f955d68
SSDEEP 96:ZqONkhQsjpfmUTmDK5ih/cIPURHl8h4otop5l5DsBhPwivh50xy0SFYKHAxEYe3S:gONp6kDfQmiUy3gZ903cmxQiXo8U6
TLSH
T17902093468786CBB9EA3AE8AF44777175FA4213BEA952F84D9E42B1C44C764C1302936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 bf68e0f13e29a499f6f7cc88fae7aa6b8154bd4714ef3ff6ad068ffcaeefae9e
MD5 5d400403f53b5b0f0cc584c0d04728f9
SHA1 670bc85e88e81efce22427332e71c4d1bc98dc90
SHA512 826b407236850a1d0e74064d8c5b67ca164e7caeb295cdeaeefce103752cdd89b95b7997ec2e81ecfdbf2231d9bec747883595e1e586f471238da67b4858f839
SSDEEP 192:uHm+xasuheOwQxMGsNdGQlACYmVkQmiU1Js+B4k03cmxmFTLIKq4E6wt2lU0Byt4:tZcIhsNdGE24+ukmKgwE6HlytEDq1cWm
TLSH
T173929D7059B429779DF7A192F48B39174FB8C027ABD86FE4D5EDBB2C04CA194030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5d22fb61641e6165240d8c4046ca354bb4e1e663b79650829683805b29008415
MD5 9d8789197cc5b326cc46dbb6af22949e
SHA1 3d9a83fde1a6afb2e1bd67faec4b4cd58d29295b
SHA512 9c81eb9aa721cafa137006f14d2bf2766b2a1b91f69b9ac2bf3e35691dd57455b03ad786f7fb877981b44fa5cade9a24259558c8a161f548a3fe20e633d119e1
SSDEEP 96:zqONkEQsjpfmUTvK5ih/cIPURHl8h4otop5l2DsB5Pwivh50xy0SFYKHAxEYe3DU:WONQ6kmQmiUyigR903cmxmFrcRKq4EU6
TLSH
T11C124A3168B8787B9DE3A591F44336174EA58127DF887FD1D5DC2A1C05DB29C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41a71b52-b9e7-41b3-bbc8-3a1719a440a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\41a71b52-b9e7-41b3-bbc8-3a1719a440a9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ec6ab2a408dcd65e9445f5f231f4de37f8849e06800838866035e8e74f67e140
MD5 dc6e96b2a33d8fba5b50a6420eb73969
SHA1 d9a121fda4a0458e1855dc24b22f545036769d0f
SHA512 f5177558a8d43329855189db38dd95c9d9ca0a44e9db996547ea3c563a76db75ad4e60a7aa75c05e28f78e91979f11565db4f5db1354c6ed01309997e1827646
TLSH
T10341E659B6EA1148B3B77E0AABF6A86D847E79371E07D49E00110D4F0A33A40C5B2B33
MD5 SHA1 SHA512 TLSH

Submit Download