hxxp://ecaa[.]com | Triage™

Resubmissions

04/08/2026, 15:17

260804-spgxsa1taz3

04/08/2026, 15:15

260804-sm717acg523

04/08/2026, 15:14

260804-smqrxahk6v3

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ecaa.com
Sample260804-sm717acg52

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3288	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303301704028453"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{70E553CF-CC76-4AD7-8920-21E21724F119}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5192	msedge.exe
5192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 1404	1272	msedge.exe	89
PID 1272 wrote to memory of 1220	1272	msedge.exe	91
PID 1272 wrote to memory of 3288	1272	msedge.exe	92
PID 1272 wrote to memory of 1220	1272	msedge.exe	91
PID 1272 wrote to memory of 1220	1272	msedge.exe	91
PID 1272 wrote to memory of 2312	1272	msedge.exe	93
PID 1272 wrote to memory of 2312	1272	msedge.exe	93
PID 1272 wrote to memory of 4372	1272	msedge.exe	94
PID 1272 wrote to memory of 4372	1272	msedge.exe	94
PID 1272 wrote to memory of 4372	1272	msedge.exe	94
PID 1272 wrote to memory of 2740	1272	msedge.exe	95
PID 1272 wrote to memory of 2740	1272	msedge.exe	95
PID 1272 wrote to memory of 2740	1272	msedge.exe	95
PID 1272 wrote to memory of 2696	1272	msedge.exe	96
PID 1272 wrote to memory of 1896	1272	msedge.exe	97
PID 1272 wrote to memory of 2696	1272	msedge.exe	96
PID 1272 wrote to memory of 2696	1272	msedge.exe	96
PID 1272 wrote to memory of 1896	1272	msedge.exe	97
PID 1272 wrote to memory of 1896	1272	msedge.exe	97
PID 1272 wrote to memory of 4324	1272	msedge.exe	99
PID 1272 wrote to memory of 4324	1272	msedge.exe	99
PID 1272 wrote to memory of 4324	1272	msedge.exe	99
PID 1272 wrote to memory of 4812	1272	msedge.exe	101
PID 1272 wrote to memory of 4168	1272	msedge.exe	104
PID 1272 wrote to memory of 6028	1272	msedge.exe	105
PID 1272 wrote to memory of 4168	1272	msedge.exe	104
PID 1272 wrote to memory of 4200	1272	msedge.exe	106
PID 1272 wrote to memory of 6028	1272	msedge.exe	105
PID 1272 wrote to memory of 4200	1272	msedge.exe	106
PID 1272 wrote to memory of 4200	1272	msedge.exe	106
PID 1272 wrote to memory of 5000	1272	msedge.exe	108
PID 1272 wrote to memory of 4332	1272	msedge.exe	109
PID 1272 wrote to memory of 3532	1272	msedge.exe	110
PID 1272 wrote to memory of 4256	1272	msedge.exe	111
PID 1272 wrote to memory of 4256	1272	msedge.exe	111
PID 1272 wrote to memory of 5192	1272	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ecaa.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff95e8ac188,0x7ff95e8ac194,0x7ff95e8ac1a0
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,7361281063428932337,8903883113143126330,262144 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:2
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1720,i,2967480518992208714,2285108879949308497,524288 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,12000946472225558962,1229928299446738114,524288 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:13
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,6280697648564668244,15500242760308965624,2097152 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,8572376938434039160,3857894889570054312,2097152 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,11955785474540177300,7646655732861867511,2097152 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:9
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,12728581053123330740,8361108628724902840,2097152 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3648,i,17444272597291576985,11718701114331238444,2097152 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,11097765119332688625,6709783799517950742,524288 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,11097765119332688625,6709783799517950742,524288 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,18141772067531934583,13188825544386677334,524288 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,3339213916025907670,2430385221270083560,524288 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6040,i,12399807680329000649,3546670225811023623,2097152 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,1994782703899857053,8582689352135411911,524288 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,3769642931047917613,12681170420115540318,524288 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,11418379989125391294,9112831374056647558,524288 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,1879079445712348059,17887090731754575361,524288 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6516,i,16218615711013695150,18396591476232933790,262144 --field-trial-handle=2552,i,4445911769033768455,7679692876416863367,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5d50677f1008100983f9f4bfabcf23c2a44ead620b1a9e1dc8b7a9df44e553be
MD5 b3ad8ddbb67c564c78b0615e9470b7e1
SHA1 fc0fb19df52eb76d8213885b950e1c4b29912301
SHA512 5c60da8680c518cbb13ec69e0142394c406ff0ad9c0b77cdc811e11a3ac1256434c42e0057384994439b34bbc22f079af1e8fcbd21665078b3173397e2f695b0
TLSH
T1806184746B639BB1FFE890B273DE84D8B23684150963AF2F1040A3341C8F7BE5297068
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59dcba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59dcba.TMP
Size 2KB
SHA256 8386316e64548e145afaf680b59b0d8097734368a48fb69fda4217dd1799fe64
MD5 cf4444de2fd70a87f36090379132a2bd
SHA1 8ea61d9dcd4d291c7d5f06b0baa79e4315c69525
SHA512 684a787896217a83c60ee68100242e98bcd0fb3d0e5ca5654efef6735c0c274c4c773cb49e52042c3a3a5284ad5c3d754568a8a761ebe04c9ab24faa7e88d616
TLSH
T1D2512FB06B231BB1FFE894B573DE80C8B27685594063EA2E405067745DCB73EA0DB058
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 dfe6c0f2aa3154918e2d1d627bdd6c448dadf121119b7583b0cf328e8959f7da
MD5 31dc6223d6febe54e3f6f7649d5096c1
SHA1 0714e8c1607b0e40cb3b9969720ce3499b4220e2
SHA512 5167f86be1f85cba20d79d2d48a0bd4dcad18c495da37e516953dc9adcfc435fb24a7af17088a9665f2227e5068811a777298464631aa5532962bcbc31cffe85
SSDEEP 192:DdTZ7yG2eQ3uaxJOffxqyAr31xkwRstvkpjXW:DdTZ7yG2eQ+axJOffxqyAr31xkwRstvh
TLSH
T1CBD169F7C3E88A7EAD1152F0AA24AF1BCD1D0955522C3D4685E4EE4B93F2471E182E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9b86f90911890123a380f23051c65676c4576ca0c5afc375497641bb74c4a720
MD5 2053c8668203346e691fc7350eab43c4
SHA1 5d1f92e9552cc2f930394d4539c09a2830829890
SHA512 ebfab7ca2c71992ab0ee8d9d3dc9b938b3b056887206ab8ed00356dbc039a807f9c98c6a722df1390ce418e2347c769bf03a4273872707ea757ffd1af72e4ea0
TLSH
T11321B1F7C6F8557D894182F467147E1BCE2D0814532C3E9AC4D4AF6F93E2871D24095E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c6870ae1355316c325a5f15e955554f953adabec3bc253319ae2a3fb264a1e50
MD5 8ce58648c3e9fbdba2c6fbe30ca0c634
SHA1 becdb466995a6356181e57061645d90dc8ba9e7d
SHA512 b5f8794e3348eea0ded15294a093601b4c2038831bb2d9cc52bed2d6341ce5f7c85b67ed5a2d140d41f9a9a07cc69ed8f6bc28cc11f56719b0285cf7b6bda69d
SSDEEP 192:sxR4R+bJ/fQsfPHm2Sm7aZBzoD8pRg/g6+WNL87/Y3vIGTIgDcJ:sxR4WJ/fQsfP2NW/5s/cE
TLSH
T16442B715A928AD7B9CCBD219BF65BF63D2F9603361D02E58A7FC960C04E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7cb89fad34a300ea446344ba71d4335737edb3a1624972f46eb7f20f4658b86e
MD5 e03717ec396997a965f2cc1a2385f5dd
SHA1 58dfdf0c2f057cfbf5c8a19f9805168088a76e1f
SHA512 7de48459751165c1488b1153ba8337c5222c585bd084e535066da44cb6041ed368756d72aacf5f09b4c5d0f9e5e2f24da7df3fc65a38de5d416bf76f9e36e912
SSDEEP 192:sxRfR+bJ/fQsFdHm2Sm7aZBzoD8pRg/g6+WNL87/Y37LIGTIgIJ:sxRfWJ/fQsFd2NW/5s/szs
TLSH
T16E32B715A928AD3B9CCBD21DBE65BF63D6F9603261D02E58A7FC960C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4428ca668b7aef61f37e11e545ccf0c544770bb9a8d5752a6804c7817991b4e6
MD5 3f3443abd8c107e7d55c6f253713e1cd
SHA1 7b83cbe2d4b7425337515462aa2a08565e3aa3dd
SHA512 a2d8507972fff73177fe8419f70ff16ad58b9091a38eeb6d361272eb028741943ec77fb21db65cc7f6c7bb5c3c36e8e1929b9f01ab753e5774a6a9a1aa38c4c8
SSDEEP 192:sxR4R+bJ/fQsfdHm2Sm7aZBzoD8pRg/g6+WNL87/Y37LIGTIgDGJ:sxR4WJ/fQsfd2NW/5s/sz2
TLSH
T16342C815A928AD3B5CCBD21DBF65BFA3D6F9603261D02E58A7FC960C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 7cbf6f50a78285057424f596a9c0d3cfac9b1b7d4562eaa4a70b935c740fb8fc
MD5 b87f5dea036daf6a7a0278a49e399feb
SHA1 5098584a0cf3c1f4b05d675cb80182dbfa975d9d
SHA512 f7d6797f6547f09cda9bab2a7629da5fa67cccda7e68887196422a7735a498615205355332cf2d66a4b445d150535df0bfb170afb07baf0d16daf3a89aa76d47
SSDEEP 384:GMgEbt2fCtg0+FfKsKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVKO9W+RT6roOLv:GTEbtkWg0CfKs8F1+UoAYDCx9Tuqh0VJ
TLSH
T1A2B2EA2F600DCB7E9F804AADAC59AFD76D5802C79B588D4047FE990C02C77FA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\010f52a6-2df6-4588-8ca0-1dde5b217669\index-dir\the-real-index
Size 72B
SHA256 b40133ea6dd63a33795618ac312b95f1944062fc52b5cea9d450ab4c1945d874
MD5 c17c5faff965ff362757e167f52dbf0c
SHA1 ec063688a1a638d305ce5f66d8b8db25337ef5d6
SHA512 19c94b70a0ebd0fc3176afc629d702f15d0f075d648e062fc288829fc46c96ae427e6fffe0aa872a36aa868d7cbbc2f1fa4b82ed7e2c3007b4862ac8a4705099
TLSH
T101A0022951B00A41C5003672645742A132358D10E92A561282D22195C8E51A9514323C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c99f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\010f52a6-2df6-4588-8ca0-1dde5b217669\index-dir\the-real-index~RFe59c99f.TMP
Size 48B
SHA256 455188db36b92abd4ea1716b813619165e09afe771b0c5632be15c6908430c06
MD5 70de6c05d63d8fd7ee5ac8ebbc530be7
SHA1 a47438093be893465c7c618baf22ad799eed71ce
SHA512 2cea88eaa966ef534882755fbe089978f5726c6c438e5ff73512a1e314d21e4e36f485db83027fb3add823092014e73af59972dbf69f7c7c35747670edabb55a
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 74B
SHA256 dff31653121ff112cbc29c3a15ba134090f2887155d98d69951788b71f10e510
MD5 3daf1e2b7ad30f6d3b4e2b100df74d46
SHA1 421cf1139c34b7930548339e8aca4b896906e62a
SHA512 9dcebcdb3dd7a7bb292ceb4f9a1a0dc96f7290b9d3d0b81f754807c263a0b8241e0ad8541f3afb7f567a22cbffe83d8504f63cf826cb04b8b025ed9bdcda7dcd
TLSH
T112A002F70841809E6F30A9EC6039B32DF44BD28C8CC0DDF4C54DC0422138B770002C50
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 155B
SHA256 99decc2a57c8edc21ad47584edeeb27b742962a783f8baa3c123ffbd316e8187
MD5 139eae5551d346db11dfb4718d118eac
SHA1 f26aea3ff8d295da32b06d123bdfde8603fc1843
SHA512 72472355a9f71320946c504081bf9bf1c1060a8a5819e08e05c9041cda895914e917eb0a5ba2970790a12f70a9d37285343cc9692761fe443e7e7c189e4560b0
TLSH
T181C08CE3012240474B30A9C85024321DE80F9E5D4CC4CCE8A28E70022038E334102920
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 149B
SHA256 2d3f886a96af142e22cd135a4b6913d3fa0dc8fe94b85feafec07faaf185e35c
MD5 97e325c95446192ec59961ac49c4b4a2
SHA1 3ff22e777f2d052b4cc8e0f7b77148cdeb9cf5b8
SHA512 6090585d43a6d77a78b1c08fa0e77d15c7074db00a5244e46052dcb0a380b4420f39182610ef7b75f4f8193d63b7fbe1a28463d494a38636ed7ecf04cad3f9ab
TLSH
T133C02BF30502804B8F30EACC1018332DE80F924C4CC4CCECE38D40022078D330803930
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59741d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe59741d.TMP
Size 158B
SHA256 cf2c08a6ef648044fea04628c4c33a8ad1f9cda389f6444a46da6d936152f46f
MD5 96b32a595004f4e904720853f77fe776
SHA1 5f6a9912f54adcfacecbba08be4537ddbb188f27
SHA512 023b8c02872db4c60e0b56aba88dad2fd5540f09a1fade697efaf0286899f75be3d6ff4b10262e99b750923d8fc36f5dd515677b45c6830deef42f0f658a016f
TLSH
T195C08CEBC171A019AE30D5E97239729CE51BBD4C9CC2DCE88808F25230BC233801A911
MD5 SHA1 SHA512 TLSH

Submit Download

ccdf8c87-b127-4d85-ac56-d3361b5746e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ccdf8c87-b127-4d85-ac56-d3361b5746e5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 11be139e8f1d10eddedbe0e00d283aee525f7b3e49bff6cbc4dc01a8161ebe34
MD5 cfc351931762e1b4ae303b8aefdf4826
SHA1 5afb6bb2bc84f6da3c4e0b7e76726282ee8721db
SHA512 d801f6d1bf1e59b9c58da342a58331ba971fe788bd9fd9de819521e596d6aaad84add8fc2e91b9ffc01ed819b85d11f73d60d73eba3174f414d7c19233165a57
SSDEEP 768:Jrv+4UNbd43GOBXc+wfZOLf/66RfI66SvShCQREnjdB:JbsbW3GcwfkfC6Rfb6SvSwjX
TLSH
T17403C071E878AD339EE28244B6477F53BEA46163C8C85798D9DD5B0C01C76EE271F822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 25d2b031185a47f04f953eb7ad6134f0ca133d67b3571e8ecd99cd4f71b0002b
MD5 dcd5283e0b1f23f43758676fb0d92764
SHA1 363a72b50c5c6b26350136e622b22894ec2e105a
SHA512 568dbdca8cd4bff66fb6d932b79411ec30717f225c533884693ae9095a7807a538a26e3cfa7a3293f750ab1bfca72791d4b7b7d59c7484a0435cdd145792494a
SSDEEP 768:/f3GOJsXc+wfZOLf/66RfI66TvShCQREAa2xQAe+01:/f3G9wfkfC6Rfb6TvSwXr6G
TLSH
T1ABF2BFB0ECB05D338DA693487A467B52BDD5A173C9C89A88D6DD5B0C01C37AE271F836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d1f3dd4371708ac5c6402d5c0575dd4eda635243f8cc23bb48d3b5c075945e58
MD5 4f363ed2562c2d94f8587494f72b33a0
SHA1 794d7fc05b81e80796b129afd8c11718d869d531
SHA512 a9c23a4c9bc78f9680f0b8d6289997d8c9d0243872e016d932e06a2511f45eee0e9f4029591c676339f3d77b87079123ba7780f096d54b22b7572ec300a60b54
SSDEEP 768:Af3POJsXc+wfZOLf/66RfI66TvShCQREAa2xQAe+01:Af3P9wfkfC6Rfb6TvSwXr6G
TLSH
T16AF2BFB0ECB05D338DA693487A463B52BDD5A173C9C89A48D6DD5B0C01C37AE271F836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 ddca8b09f3b958d969e56ba63f12994f7cb66ef1ec60bdf46776f92d80ab48cc
MD5 4a68b7107e73e5ac03bd4066a113c24c
SHA1 b09f502479f71981509d8e326f479e5ef32fd0d2
SHA512 c43d74e7c5ee5d19179dac70cc546d7c337303d3c49a79859ecc7f760bee52f0817164ac5336c11e638e5dfcc2a4674a10137d26b54a4a5f397bc98366109970
SSDEEP 768:LFQ83wwgwOJsXc+wfZOLf/66RfI66XvShCQREAa2xQAe+01:e83J9wfkfC6Rfb6XvSwXr6G
TLSH
T10303BFB2DCA49A379DA68748BA4A3752EDE56173C8C4D698D7DD5A0C01C32ED270FC32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 66a21ed01036699ae8a317d62ee3f54549fbcb7bc69bd814a06fc937beb63aab
MD5 47f5b8597c7d91ad1effb4fc75ee6e05
SHA1 60bc36761f952b03ef864c46c08880dad327c4e0
SHA512 4d81622662e747e567f2cd1da41b0f183cebb7e72e67cfed9a1f2443533b4b9799a1e875c64e43f21bfb4f3a80cbc16577762c9e072212a5aa86febab88f63a3
SSDEEP 768:Rrv+4UNbd43kRkc+wfZOLf/66evShCQtc2bwWV:RbsbO3kYwfkfC6evSY0wO
TLSH
T15D03D072E86899339DE782487646BBA37EB96173C8C54784D6CD1B0D018369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

714c64fa-aada-4a3a-ae96-aaae7707ae25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\714c64fa-aada-4a3a-ae96-aaae7707ae25.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download