hxxps://app[.]callrail[.]com/calls/CALcc24ea8fcef5470aa37bbe468b90b1cc/waveform[.]png?access_key=05ee9db498c342e8ee1e&height=70&name=secondary&overlay=waveform-play-button&width=450

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://app.callrail.com/calls/CALcc24ea8fcef5470aa37bbe468b90b1cc/waveform.png?access_key=05ee9db498c342e8ee1e&height=70&name=secondary&overlay=waveform-play-button&width=450
Sample260808-c8faas1xfv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306306859044350"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{502F8291-A25F-4BF7-A980-9D5F024CC0B6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 4716	2736	msedge.exe	80
PID 2736 wrote to memory of 3000	2736	msedge.exe	81
PID 2736 wrote to memory of 3252	2736	msedge.exe	83
PID 2736 wrote to memory of 3252	2736	msedge.exe	83
PID 2736 wrote to memory of 3384	2736	msedge.exe	82
PID 2736 wrote to memory of 3384	2736	msedge.exe	82
PID 2736 wrote to memory of 3384	2736	msedge.exe	82
PID 2736 wrote to memory of 2732	2736	msedge.exe	86
PID 2736 wrote to memory of 2732	2736	msedge.exe	86
PID 2736 wrote to memory of 2732	2736	msedge.exe	86
PID 2736 wrote to memory of 776	2736	msedge.exe	85
PID 2736 wrote to memory of 776	2736	msedge.exe	85
PID 2736 wrote to memory of 776	2736	msedge.exe	85
PID 2736 wrote to memory of 2888	2736	msedge.exe	87
PID 2736 wrote to memory of 2724	2736	msedge.exe	88
PID 2736 wrote to memory of 1532	2736	msedge.exe	89
PID 2736 wrote to memory of 2888	2736	msedge.exe	87
PID 2736 wrote to memory of 2888	2736	msedge.exe	87
PID 2736 wrote to memory of 4528	2736	msedge.exe	90
PID 2736 wrote to memory of 2724	2736	msedge.exe	88
PID 2736 wrote to memory of 2724	2736	msedge.exe	88
PID 2736 wrote to memory of 1532	2736	msedge.exe	89
PID 2736 wrote to memory of 1532	2736	msedge.exe	89
PID 2736 wrote to memory of 4528	2736	msedge.exe	90
PID 2736 wrote to memory of 4528	2736	msedge.exe	90
PID 2736 wrote to memory of 3644	2736	msedge.exe	93
PID 2736 wrote to memory of 4624	2736	msedge.exe	94
PID 2736 wrote to memory of 3644	2736	msedge.exe	93
PID 2736 wrote to memory of 4624	2736	msedge.exe	94
PID 2736 wrote to memory of 4824	2736	msedge.exe	95
PID 2736 wrote to memory of 3356	2736	msedge.exe	97
PID 4824 wrote to memory of 3308	4824	msedge.exe	98
PID 2736 wrote to memory of 4600	2736	msedge.exe	99
PID 2736 wrote to memory of 4608	2736	msedge.exe	100
PID 2736 wrote to memory of 4232	2736	msedge.exe	101
PID 2736 wrote to memory of 1684	2736	msedge.exe	102
PID 2736 wrote to memory of 1684	2736	msedge.exe	102
PID 2736 wrote to memory of 3112	2736	msedge.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://app.callrail.com/calls/CALcc24ea8fcef5470aa37bbe468b90b1cc/waveform.png?access_key=05ee9db498c342e8ee1e&height=70&name=secondary&overlay=waveform-play-button&width=450
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffd553ec188,0x7ffd553ec194,0x7ffd553ec1a0
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,8974321481355089754,12742368037678244005,524288 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,10222091981414285000,16198861768550591835,262144 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,12307451373793842985,3618348452870978415,524288 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:13
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,5422291934924534897,16159319523740113134,2097152 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,16466267212956221059,15560540562850232731,2097152 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,8484423741229254266,6317080799342167040,2097152 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,14170971180005226864,9499587465909962932,2097152 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4280,i,18128987154422994602,5323001963564193474,2097152 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4312,i,4797548690859103434,14575408545179770157,2097152 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:9
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,17879303104885575697,4102302075587748834,524288 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,17164258033832311374,13855082150375950602,524288 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:14
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,14667927796536812723,12708139065260419523,524288 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,16385981894921966555,7007044007301086666,524288 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,16385981894921966555,7007044007301086666,524288 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,3555874031968705209,185565031983842823,524288 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,8892894438050288601,13961528328645192076,524288 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,11924042613829020618,11528534916825550703,524288 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,8421647456995615662,6731985164734456081,524288 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5992,i,14074745888290622057,14287232248111927018,262144 --field-trial-handle=2208,i,15983039083517043824,6989148007122439208,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
MD5 39ab0f1d6d7946d873f1bb6929a4c13e
SHA1 c59f4f27654295f008fbfc2411a1ef79ea54cec0
SHA512 e470432f3c728552a9408dd90789bb6c2ace1ee0142fae2a37ea0127d228691c3150637174b3202058e5952e25dfd9256f96a6af74b77d36328dc528bee21aea
TLSH
T10BD080332F1D7041FB1D4730D463CB24277F845638478616B211C40C99754C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
MD5 83250c7c4d7b6ef62bd1bf26f4c3e0c4
SHA1 e9602c3da743490459da2b565766ef634e141b1e
SHA512 ca69ff689a6f6e3b7d2372cd69b840c4bfc55765ed02240fdf7742b99373e9bfcada680b5f79ef47adfa800608d07b4a31cf3835f5c30b056283e46bca076180
TLSH
T189D012232A5D7041EB1946309463CB24266E845628468616B211840C89664C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ef7c2afe0cb30ef91c223c7696a348a54df06a5b2353e3138431b06b1bfa4493
MD5 d7c22d46d964a13be95ff7ebce021c85
SHA1 e6626aa5537ff07a6ecb838bc9f9ef6529dfeb88
SHA512 106d08ec97b45676ddfdb77ffd57e9565b0b9438762bc93c56a69d96ff2f5c0abeadc51eb61cbc65fbd04248469c4c808c51e7c345711e4f7c79c9b12f8fe67b
TLSH
T197616E550332CB8BFF931170B4F1C1077972C239FA1B3E6536689C745B86B14C8EA445
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5888a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5888a3.TMP
Size 3KB
SHA256 de748128e40ce15079d03142f666a73e122e258cf69575f5113db46f02281ca8
MD5 689c17ffa1357c8d84e77a3a846ee5bd
SHA1 af6be0258d368e3f2ace6de923ddea7c74ab7380
SHA512 dd6a4c572ed15955762814ba8c3be025c4c8a22042108eff8dbb2bbf3fd85f65747f195eb9e65ba8053ffc369460199d98e893c02b8687e339e969a86acbadf1
TLSH
T1D7616E564322CB9BFF931170B4F1C2177572C239FA1B3E6536688C746B82B14C8EA445
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3a6618bd08ec7050eb96fb1546358a11cfb3c6c7b08d3be4e2c1472c531e48cf
MD5 4ae76cd153f1c80f93589c9257f0402f
SHA1 32198cf8f50526ba711fc814a54081a3fc1e471c
SHA512 2abecbd1e2db954a75df490da74dfb48ad6034f22227d142a1b20a14ed20cc76c0029b602ebac0d2c35aa6d3d404c574989563f28474b5f9e97c22eeb3e66c2d
TLSH
T138116DB3C3E595AE8A1156F06A18AE2BCE1D0506435C7C29C6D4EF27D7E3075E00195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ef14f3411c729197d51396ff336a9791c968132bc634e45221b293a210b0e753
MD5 c78bc3ddc902796f623ff724608076c0
SHA1 713fc572abfdd53d5f5e8fcae4e15fd634d64813
SHA512 0ce034a490feacc38c85476c0fb33966e887fbe30908dcda9c571af49619858a60ced86c4cf58def58bc8f210057db6041c621afeaf4b1ecde93a70e4c44e0b3
SSDEEP 192:sxZDRCyM/jK1Ml8MFX/f8srYaIRIdpM/W6+WNGY0uBHUrx40IgrJ:sxZDEdX/f8srYaIaM/bG5u69
TLSH
T12142F8016B38A977CCCBD20DFA557F53D6F91472A2900E54A9FCDA1C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6211050c8fb4e1627b731efe6cb2658022805cbbe599fa38700b4f1ca2854684
MD5 8b6528a735f4f76b574e76640244b201
SHA1 30c230b9c34d628adb25e75f5ae4c70a395ba045
SHA512 2c798013069069adac0a932731110f176df840df03fe0180ecd85969b97d36fcda4064cfe347d7850c96f9cefa25a2431c3c23c96a83e239dc3034a1c9a1345e
SSDEEP 192:sxZDRCyM/jK1Ml8MFX/f8sFYxIRIdpFi/W6+WN43c/Y0uBH/tx40Ig5hJ:sxZD0dX/f8sFYxIag/b7/5ubF
TLSH
T15752F911AA386977CCDBD20DF9557F93D6F8047292900E54AAFCDA1C08E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b4ed78f0f7fa3b71bb0d3c22cf10d01d965637310436cb2283143aa26db0be8c
MD5 c524955c54a9d89714ad0058c92b1472
SHA1 455f18ff27947d6102793ba4a77bdf6d6d9e1a78
SHA512 ae5116876a0431cd270975e1c6a1d2d8573b5490a3145d7eebb47e009d8cc2552520590a8e23d1efa53161a5ef8d5162f05bec82f5811029d46e1b998733604a
SSDEEP 192:sxZDRCyM/jK1Ml8UQsFX/f8sFzxIRIdpri/W6+WN43c/Y0uBHrYq40Ig5bJ:sxZD0q6X/f8sFzxIaO/b7/5urr
TLSH
T15452F912AA385977CCDBD20DF9557F93D6F80472A1900E54AAFCDA1C08E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 1851c50256b8579e94ef7977d0e1311fa85a54749cb015509e6e3fcb1b443864
MD5 598802b70777cce3dcc6318e48cad153
SHA1 9035ec3ac2779742005ed9b93ffc7235266f2ab2
SHA512 5e69d06b2107d53e1c127cfb870c0212e26bab6080586d02173c171ce4008ad266d17795ef373dceb3288203492852ced704bbe2d037e18d44277ac730d80625
SSDEEP 768:j6/Lh8dF2/kWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KjLl/060lDIrozb:j6/Lh8dF2/kWRmAcQ3wu1jaKKjLp0Dl/
TLSH
T1EBE23B3B690CCBBE4F840EADEC266F976ED801CB56684D5447FA894C03C73EA411A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 11d4e99bb8d5b8add63ea2820169d4e76c49b22ed50e1e4a55433cb0f837681f
MD5 c9c029fc77822e655b3593df1fd0f5c2
SHA1 26a961c7ba281eb1bb4676dadf530dd6018612f9
SHA512 77f155fc80529c45f8411d0c1d7116d037291e7a9ac8afc7bdf643170e76a3f09719182fab83587665c2b61192d37a91f5acbc60623b15310caedb84e5c8d38b
SSDEEP 48:K08I/KFGsfyIfK/qkvypKIPKjaofytHI5KIIMJ:K08gKFGiyoK/qW6KUKjaCGH2KIIu
TLSH
T175B11153367A12033D3E285CA69597A74B5671A33018B43F7BA818B60E6FE214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5923ca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5923ca.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 55aa9a61622cf03d31c53a5ae595edc2b7736c4259b41837fc2c2d8ce4e99d03
MD5 d3064f5d102726c13191f5457b76b1dc
SHA1 67b572ba597395800c22cfad24a6d1137b69f639
SHA512 609e01de83b89e79972d130e2db14dc061c5f8d3a5f92d567ef6c9de2f042300bc3311018f6e06bae576841540f0a197301642475d3cd0324fde4d67c0c410a1
SSDEEP 384:UZcIpK8Nau3BJ9X40H7f20Fpt3jITLf1nTKwBODNZOCRWP:SQGr1bVjIff1newBKZO8WP
TLSH
T16F928D725C3C28779EE3A948F85736179DF88177F2C42B5895ECAB1C04EA298131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 750d79a45d5f5193ae08edafbed2d0279f8977f2edc1ee0a67d5b4c464e07e4a
MD5 aba73daedc1e10182e31a7c6acc2c1a6
SHA1 9d4f90bfc80706c40ee57150da27f3015d4d7260
SHA512 8de5535a737add2517696bda187c848b1c0dad96ac818bb5644ffb82f0e1ce9e4b139b8a876de500ef9a7651bad1d50f6e56f0e450b743c1e12bcf030a6ac24e
SSDEEP 384:BiFPZcIsK8Ni8TUNTUlIlF3BJ9X40HBm20Fpt3jITif1nTKwBODNZOCRWP:oFH3jwgvs1bVjIGf1newBKZO8WP
TLSH
T178D218F248EB543AEDAE5B47A73E2D078DBCC163B1806654B79C5A0CDC961BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 769f56a226d4195c675aef61d0c46749a9be886568369f16eef1143eebf37173
MD5 bf0f7640fd936cac81f1702764604c2e
SHA1 3df76752257304b6302f3505eb668e24eefc9fd1
SHA512 4226fab2ca5e97d7a3252626edbed18b9e949ef40182aaf10833f53b9b87082721fdbb870207604ac38e521cc94a21b506474c14d87ae3caaa8f3ad1aa1b2dc8
SSDEEP 384:JZcIpK8Nai3BJ9X40HBf20Fpt3jITJf1nTKwBODNZOCRWP:BQG51bVjIdf1newBKZO8WP
TLSH
T1DE928D725C3C28779EE3A948F457361B9DF88177F2C42B5895ECAB1C04EA298131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ac27ff083fe4c67244ae46224e07a7d88c7b9ee959e44659a070b3f92fe61b84
MD5 337d1a614ab4eb2b6bd9cd7edef4b0ae
SHA1 f7aa8f50b197f710945c2b47ff72dca55eb63a5c
SHA512 3461aad944877eeb3dabb58e7ac8a10dcc49e2f61a5835651291baab7f58b53e9719167cad89f86bb4889497e9480f9dfb8f1865359fbc2fde6ed88dde441e97
SSDEEP 384:bZcIpK8NaF3BJ9X40HBf20Fpt3jITJf1nTKwBODNZOCRWP:DQD51bVjIdf1newBKZO8WP
TLSH
T1F3928D725C3C28779EE3A948F45736179DF88177F2C42B5895ECAB1C04EA29C131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6680fee4513d88ad4cbf3019a4b6d403cfeca7e6384f5e1baa24d436db2ec168
MD5 4901c076e8bf6b272ae8afcd2a37fdb2
SHA1 217417d58ba39cbf670198c429b108d779b0ce45
SHA512 4ec5548e22bb5803b26a5c37e86138caa09693d1fc26dfd0704b1065aed919c2bb234d8a8a6b9e922e55bce7ecae6fc0979ab597ff977b374849972179ce0193
SSDEEP 192:qGNq6d9402QmiUywv8uTBF2oP13j2GwGriU6:qGNq6740SvxTBFpt3jENU6
TLSH
T1A502F93568782CBB9EA36D49F4473B176EE5217FA6842B84D9E81B1C00DB28C2307976
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e4ed29161ed80061af79995330813a18b180c2784f0129345312fde75e2ab25
MD5 81a5a70e5b5947f17fea03833ae7637b
SHA1 47b01512e20fb52696b8aeca541a622c635d3f7f
SHA512 6eadcffc2b39780b25df6a46995d4ec05ef1e1634c6cede1699281b08ef01a163ed19a4860ea2b42e7cb2b302701e7c17cfb6fdc1da10f39c8786f840a22e4e9
SSDEEP 192:cGND6d940LQmiUyz8uiBF2oP13jITYiD8iqK1U6:cGND674090iBFpt3jIT5f1U6
TLSH
T19B121A365C78686B5EE36D54F0433A236CE1823BE7C47B4495DC2B0C45EF29C230B966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7535fc89-8333-4e9b-a630-4a7f12e9b318.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7535fc89-8333-4e9b-a630-4a7f12e9b318.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download