hxxps://med24-dk[.]tracking[.]mailmailmail[.]net/?track=XX1&type=XXwl&M=XX161840036&N=XX2131115&NWS=XX376907&LST=XX24679&mpevtp=XX3&L=XX361220&F=H&encoded=XX1&utm_content=XX161840036

Analysis

user interaction
yes
max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://med24-dk.tracking.mailmailmail.net/?track=XX1&type=XXwl&M=XX161840036&N=XX2131115&NWS=XX376907&LST=XX24679&mpevtp=XX3&L=XX361220&F=H&encoded=XX1&utm_content=XX161840036
Sample260807-lye18ascpd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
764	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305701931659813"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{61F387DA-255E-43FB-8136-8DF966AA437A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5832	msedge.exe
5832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1304	4812	msedge.exe	84
PID 4812 wrote to memory of 764	4812	msedge.exe	85
PID 4812 wrote to memory of 5932	4812	msedge.exe	86
PID 4812 wrote to memory of 5932	4812	msedge.exe	86
PID 4812 wrote to memory of 5932	4812	msedge.exe	86
PID 4812 wrote to memory of 2448	4812	msedge.exe	87
PID 4812 wrote to memory of 2448	4812	msedge.exe	87
PID 4812 wrote to memory of 5740	4812	msedge.exe	89
PID 4812 wrote to memory of 5728	4812	msedge.exe	88
PID 4812 wrote to memory of 5740	4812	msedge.exe	89
PID 4812 wrote to memory of 5740	4812	msedge.exe	89
PID 4812 wrote to memory of 5728	4812	msedge.exe	88
PID 4812 wrote to memory of 5728	4812	msedge.exe	88
PID 4812 wrote to memory of 3444	4812	msedge.exe	93
PID 4812 wrote to memory of 3444	4812	msedge.exe	93
PID 4812 wrote to memory of 3444	4812	msedge.exe	93
PID 4812 wrote to memory of 5840	4812	msedge.exe	94
PID 4812 wrote to memory of 5840	4812	msedge.exe	94
PID 4812 wrote to memory of 5840	4812	msedge.exe	94
PID 4812 wrote to memory of 2576	4812	msedge.exe	96
PID 4812 wrote to memory of 2576	4812	msedge.exe	96
PID 4812 wrote to memory of 4864	4812	msedge.exe	97
PID 4812 wrote to memory of 4864	4812	msedge.exe	97
PID 4812 wrote to memory of 5352	4812	msedge.exe	99
PID 4812 wrote to memory of 4184	4812	msedge.exe	109
PID 4812 wrote to memory of 5940	4812	msedge.exe	110
PID 4812 wrote to memory of 5136	4812	msedge.exe	111
PID 4812 wrote to memory of 3740	4812	msedge.exe	112
PID 4812 wrote to memory of 3740	4812	msedge.exe	112
PID 4812 wrote to memory of 5832	4812	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://med24-dk.tracking.mailmailmail.net/?track=XX1&type=XXwl&M=XX161840036&N=XX2131115&NWS=XX376907&LST=XX24679&mpevtp=XX3&L=XX361220&F=H&encoded=XX1&utm_content=XX161840036
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbc895c188,0x7ffbc895c194,0x7ffbc895c1a0
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,11811931902090237436,17937340911084116656,524288 --field-trial-handle=2236,i,1074604115465683210,8892290783809353551,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,16338286681774833011,10861473776869202104,262144 --field-trial-handle=2236,i,1074604115465683210,8892290783809353551,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,14277869087929055034,16973443251185537119,524288 --field-trial-handle=2236,i,1074604115465683210,8892290783809353551,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,1965478148328142586,8036580556409781352,2097152 --field-trial-handle=2236,i,1074604115465683210,8892290783809353551,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,6368384102563154940,13128064697072797458,2097152 --field-trial-handle=2236,i,1074604115465683210,8892290783809353551,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4992,i,18335129847305745023,8042622438778928022,2097152 --field-trial-handle=2236,i,1074604115465683210,8892290783809353551,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3668,i,2246793611193654273,16365264067627382579,2097152 --field-trial-handle=2236,i,1074604115465683210,8892290783809353551,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,6581234986949640494,3185360542052529086,524288 --field-trial-handle=2236,i,1074604115465683210,8892290783809353551,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,9008512899789080373,13012009635431264096,524288 --field-trial-handle=2236,i,1074604115465683210,8892290783809353551,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,15684950911605379439,16674373648819866859,524288 --field-trial-handle=2236,i,1074604115465683210,8892290783809353551,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,15684950911605379439,16674373648819866859,524288 --field-trial-handle=2236,i,1074604115465683210,8892290783809353551,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,1365497330876196766,15101738459812628398,524288 --field-trial-handle=2236,i,1074604115465683210,8892290783809353551,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,8484292232577336488,13386627021420851132,524288 --field-trial-handle=2236,i,1074604115465683210,8892290783809353551,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,11733944268472636977,5788590450499746743,524288 --field-trial-handle=2236,i,1074604115465683210,8892290783809353551,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,10599759374622316115,11439216865930808119,524288 --field-trial-handle=2236,i,1074604115465683210,8892290783809353551,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=780,i,17316140424380910174,6873382728035738380,262144 --field-trial-handle=2236,i,1074604115465683210,8892290783809353551,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bcd0a4c393d1e86456319d4b809b677ea8963937b516562372edcac5e5b7659a
MD5 4a984db91de6dcdda26821351ae263c8
SHA1 037bb49af06ab5de70b300e6e9a00d1b6aac8317
SHA512 5cef3232884e2a0c266b6b4a3231923f3e9919f852a95ce888baf9b8d6f0a307fc99feb224c6dee336e306f074b7ffaeb3bb8eaaa9eb8ef42cf676c8d80174a8
TLSH
T10FE02BA6C821EC270DFE0718A40D9A46E701135B2644995F3B3C820D8FB062A55C6C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 588e4c3f25f2fc43573fce0a1949f54f797b5993c66a46f4b6e393a83a8001d5
MD5 5b2c8b09e4ee7be24eb86cdd8d93d145
SHA1 3783c341334bd5759bdf3273259da7edcfc248f9
SHA512 74d33a55ad5fd9ca41edeb4d2c454912c120eb457ec395a9244e76d72070972c84f4dbed31948aa9ac118fb1acaaccdbec0994b09a951b95cfab3e9b5ad1aa90
SSDEEP 48:2dGY1JBjzVTcinxEv3ZlkstY7RAlJRlhX7Bc4KYwBx6bQgwUESWbyG:2xHiinxEJ8SplhX7BrKRBM7UEG
TLSH
T17891D73A04C35199F771213365DF098EB877CDFAFE276F836998AC71132B3A08469611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe585791.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585791.TMP
Size 3KB
SHA256 c5817a6390024d4db1442746ec24f6405fee7b48f62107240aef0ca62de74ca4
MD5 9c301caa6a7f8e10c9655d4d3a7df802
SHA1 bc0376975f6e449d4d5bef80d5f6635d86d51ee1
SHA512 483230a1d46e02285fe173b6ad40ca028ae3f854e0f9729a2a7b88c174f2bfc860d2408d378bbef4440892c578cd1e26c2acb5c71a0aa720d230a02bf3d89999
TLSH
T19681C53049D352A9F360413381DF054CF8B7CDF9FE276E916890A8B1232B37180ADA21
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 a8290e00aba468eb4adfc6bcdfbdb39ba2d7c38b8e60c00ddbb9b29ea6a6a61d
MD5 73eafa4b032305a7842e3ccd1568fc54
SHA1 8f41ee6265331d99011ba05340eb71c6511dbd59
SHA512 d6c796d56796388c33a036df7cc1faba19a28ccab1946a8e4f9db651b032df49f2c4033628f81cf8ed020714b4c044e41fbdfc4a18101559d79b843b45e67833
SSDEEP 96:D1iOXxOJAaaij6VYzBTTy/EV4EjE0uD/bq1eGpBZIZXwQ:D1hXxOJAaaij6VY1TTy/EVdQ0qjq1eGE
TLSH
T10D916AF7C3F4866E9A119BF0AA186E2F8F591416435C3C5A85E0AE1793F24B0F052B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 66f8ed2525402847ca65bfeeb6f62ca14426005d33c08a171e2b20e07912bea9
MD5 866809383c965a5589df4e51037502eb
SHA1 a18eb7a3ce289a621499e280ced4cbb26064e89e
SHA512 17ca5fdcd7edbd346767f5d1ce386087ec55a803648328d1ebe3436a8071ffecbf932a8a0615ef8b75df4251cf394a716d1bf4b21741815f86741dbf091768fe
SSDEEP 384:sxZsaSMJ/fysstYNazMPG7VXHbqy/xej1U:s0a/J/fWtYNazQG7VXHbqIxaU
TLSH
T1857208566A24997BCDDBC219FA45BB53D6F90023E1944E449AFC9A1C00E7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 675e4a6e93d5254567a31f47d5324e78af15b457aee689af8d8b20f2f876ff36
MD5 4a456940ee588435f77c8b666bdefc85
SHA1 1becad499088fecdeeb75e05cb63c7156d843e51
SHA512 108eec2a5f0f1f3afcdc9bf4832dae2c6f072cf0e4f99a3b016068bd0510cd4ce26efdb4210700282c4e7b746195df8f2ac8744cbb0085a42c8205659e2b3b5c
SSDEEP 384:sxZsaSqjJ/fysUYmzMPG7VXHbqy/yef1U:s0a9jJ/fSYmzQG7VXHbqIy8U
TLSH
T1587209566A3499BBCCDBC219FA457B53D6F94023A1944F44AAFC9A1C00E7BEC321781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1cdb424b9cb8ea4e91ad01cca8db9af6ce49567dae9730f32e0d1f3d5ea18781
MD5 8f61919ec288cb05e777c36c8eaeec4c
SHA1 94eecb2e8be23a49b013c9cf9306defcb9bed815
SHA512 c33cfa53b65dbe4e7321565172dbc95c66a4b6d6993dfd77d7de2521e76ff9baf8489a2212b7a953e10b807928ca66066a9c2e4b840c742c751ec813837dd464
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGF:05ppxnY753RNBvRJJdt7p5J9Vlfh
TLSH
T1E9B29C1A713E0212397E2948B39696364F4235A37058E4BF7FB814A54F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 5398280b81207e22aaf4f3587499324006ef0db1677705720a38671263917309
MD5 63dfd1f27b16323485eb187924801f3e
SHA1 947307e2139f8113f58069cc8ff7c1056fb12a79
SHA512 1711f172ee1f3f3cfc5a7f11c1c28bb3b390e4ed38015cf72dd3419c79747673e0ebca733623698c6d6da370fa6d920adac505b8b7cfea0b1f0f5014b377115f
SSDEEP 384:npNiF9CcmyWCs3sNj8TUNTUlIm2QckCr9laKphBftGnIppae4KV8p0mHpty/7IgI:pEFccps3mwgbkU8k1GI+I8p0wd
TLSH
T155B25C36DC58C9BBECE74F99BB4A7A03DEE41267869C9AD4DAD81D0D10871DC030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e2f95f7bb0eff4ef25fdd130b9c9e73cc2451dcc036d900b8050ebc521760914
MD5 8a1c10b0e2f3fc770cdad1e712fb2cd2
SHA1 cebf7be1d86c8ff9b6349519ecc22a0b695545ac
SHA512 2fd7384ec5aea6f78ba66bebb254c5b304ce28e5eeabfd9190b691a1e1aa3f7b202603346530b89d9b07054b75663874b7c40c402077ecb0998acce8f2ff0b09
SSDEEP 384:n9iFiZcIa3sNF8TUNTUlI4pQckCrlUjphBftGnv4lxf5UrzIty/7IgM:0FQa3IwgOkZt1Gv4lxSY
TLSH
T16FD25A369864D9BBFDE78B85AB4A3203EFF48123C6CC66D8DADC5D1D009719D030B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 539e9caf8cee4a20e0d86b77197f2799aa07918983214bcf0d57896d0928354c
MD5 61337903f09a617bee87f90f9275ab6d
SHA1 4b97f844357e491068a3138ccf1aba5f7960fcdf
SHA512 5b40cdc247f4db8cca25f2560886b75941790cc4d97f886ff7145ac446cd2ded796711cc0a10ba2015386edc755468df27d5fd0a318bb7f8e7669ed1b5b526d7
SSDEEP 384:npOiF9CcmyWCo3sNF8TUNTUlI4aQckCrDUjphBftGnvtlxe4KV8p0mHpty/7Ig1:plFccpo3IwgDkxt1GvtlxI8p0ww
TLSH
T119C26C32D858D9BBECD74B99B74A3603EEE4416786CCAAE4DADC1D0D00971ED430B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 65e6926126846609165508ac17c24d497280361de47b9a1eafed26d3f40d4529
MD5 e4f76ddc7c49d2ef3cf599aef42dd437
SHA1 68e5b331a7d37e39f06466a8241fa2da0477eb44
SHA512 b6770a734c3842124d512d99c6b5a465d088bdb2aad32450568fcbc0cab8eed0609fb875f9c0a5479ebd4427635ce49886b17b1cfb438921e09910357167dfa5
SSDEEP 384:npIiF9CcmyWCs3sNZ8TUNTUlIm2QckCr9CpQphBftGnvVlxe4KV8p0mHpty/7IgI:pTFccps3YwgbkUuW1GvVlxI8p0wd
TLSH
T1E0C25B36DC58C9ABECE34B99B74A3603DEE44227C68CAAE4DADC1D0D10D71ED430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 9fc3dde1364b94222b920d7cf4d7f1acd97c90969e3d5361450cdbd61e2df5fc
MD5 d7afcf73b595e9fc2a1466c8b911114f
SHA1 bedf8488c248239fe44f711eec890093805f6abe
SHA512 fa773358c3ccaf62970ff9dca7c7d41f47ca5730fe7577e34e17d50f90cbbf74b9d448e06822eb3729177041231936f568b4b1013894e75a1572c42f1cac9e1d
SSDEEP 384:neiFiZcIk83sNF8TUNTUlI4pQckCrl2jphBftGnvHRlxf5UrzIty/7IgM:1FQ53IwgOkrt1GvHRlxSY
TLSH
T1BAF2D4F598D79977E89E8B87A77D2E029AFCC113B5885684B7D81C0CCC961BFC306819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 54efe7fd3c60fda3d55fd4d939d0d8373dd658355ceb675262122893bac73435
MD5 30e5df7f4a27f0cabb24a0334228f039
SHA1 498afe9df8bfbd6e8e0d91b2e5ae2bc03c6c99ae
SHA512 baf51ff4c725b4f324bb8731df116d74d7f3082d7d53dce0bd8e8fe20a1c22fcb8007d871d03704465e50c79ae4f817f8ea591d233177fac447909863802f82e
TLSH
T1EA41D64CA6E91148B3B77E16ABF7686D487F7C772F0AE4AD10110E8E0A62B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download