hxxps://8[.]stg[.]html-load[.]com/session/k0/cqy/www[.]unilad[.]com/zao/qwhvi331tyxywywjnvt5gnvy7lyrqsjyw5tngy3xgvjnyncy71gycyecy71gy0qs7tn73ycye5t1y0qs7tn73ycye1ycewyegny7fgnq3yci331tyxywywqt07qyrzss1jnyrjnywyn1vg37ngy0fy7yce2oyel3ycwqy7y6vv2myivn2kyi6y762yiveowyioy6eeyf6y6mm2y6mye15mfy7yce9ykkkye5fy7ycpip3y3ylp1yevtyin43gvycyzyky2yz99qs7xfcy37y7n4yz99yzkymwyzykyl

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://8.stg.html-load.com/session/k0/cqy/www.unilad.com/zao/qwhvi331tyxywywjnvt5gnvy7lyrqsjyw5tngy3xgvjnyncy71gycyecy71gy0qs7tn73ycye5t1y0qs7tn73ycye1ycewyegny7fgnq3yci331tyxywywqt07qyrzss1jnyrjnywyn1vg37ngy0fy7yce2oyel3ycwqy7y6vv2myivn2kyi6y762yiveowyioy6eeyf6y6mm2y6mye15mfy7yce9ykkkye5fy7ycpip3y3ylp1yevtyin43gvycyzyky2yz99qs7xfcy37y7n4yz99yzkymwyzykyl
Sample260810-wp49vsvblg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3972	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308588147323165"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{F7290A82-91DD-4FC5-92F3-2767945208F8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 2188	1464	msedge.exe	86
PID 1464 wrote to memory of 3972	1464	msedge.exe	87
PID 1464 wrote to memory of 3528	1464	msedge.exe	88
PID 1464 wrote to memory of 3528	1464	msedge.exe	88
PID 1464 wrote to memory of 3528	1464	msedge.exe	88
PID 1464 wrote to memory of 1608	1464	msedge.exe	89
PID 1464 wrote to memory of 1608	1464	msedge.exe	89
PID 1464 wrote to memory of 4560	1464	msedge.exe	90
PID 1464 wrote to memory of 2292	1464	msedge.exe	91
PID 1464 wrote to memory of 4560	1464	msedge.exe	90
PID 1464 wrote to memory of 4560	1464	msedge.exe	90
PID 1464 wrote to memory of 2292	1464	msedge.exe	91
PID 1464 wrote to memory of 2292	1464	msedge.exe	91
PID 1464 wrote to memory of 932	1464	msedge.exe	93
PID 1464 wrote to memory of 3728	1464	msedge.exe	94
PID 1464 wrote to memory of 932	1464	msedge.exe	93
PID 1464 wrote to memory of 932	1464	msedge.exe	93
PID 1464 wrote to memory of 3728	1464	msedge.exe	94
PID 1464 wrote to memory of 3728	1464	msedge.exe	94
PID 1464 wrote to memory of 3936	1464	msedge.exe	99
PID 1464 wrote to memory of 3936	1464	msedge.exe	99
PID 1464 wrote to memory of 2712	1464	msedge.exe	100
PID 1464 wrote to memory of 2712	1464	msedge.exe	100
PID 1464 wrote to memory of 440	1464	msedge.exe	102
PID 1464 wrote to memory of 2924	1464	msedge.exe	113
PID 1464 wrote to memory of 3204	1464	msedge.exe	114
PID 1464 wrote to memory of 3928	1464	msedge.exe	115
PID 1464 wrote to memory of 3316	1464	msedge.exe	116
PID 1464 wrote to memory of 3316	1464	msedge.exe	116
PID 1464 wrote to memory of 3316	1464	msedge.exe	116
PID 1464 wrote to memory of 3688	1464	msedge.exe	117
PID 1464 wrote to memory of 3688	1464	msedge.exe	117
PID 1464 wrote to memory of 4144	1464	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://8.stg.html-load.com/session/k0/cqy/www.unilad.com/zao/qwhvi331tyxywywjnvt5gnvy7lyrqsjyw5tngy3xgvjnyncy71gycyecy71gy0qs7tn73ycye5t1y0qs7tn73ycye1ycewyegny7fgnq3yci331tyxywywqt07qyrzss1jnyrjnywyn1vg37ngy0fy7yce2oyel3ycwqy7y6vv2myivn2kyi6y762yiveowyioy6eeyf6y6mm2y6mye15mfy7yce9ykkkye5fy7ycpip3y3ylp1yevtyin43gvycyzyky2yz99qs7xfcy37y7n4yz99yzkymwyzykyl
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffc0f4ec188,0x7ffc0f4ec194,0x7ffc0f4ec1a0
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,15761402914271281227,13496946162168249171,524288 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,14015818873374771074,4831849494273698436,262144 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,2726807600143989422,4741554055226102879,524288 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,17492985630612686824,7036533830235758058,2097152 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,6078297091310086615,8869682546102014840,2097152 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,13247014237382511658,5217447714013866811,2097152 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,1214407293056154496,15969656847163675835,2097152 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,14962348758424066304,11706039156346642465,524288 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,7580134301471137496,5478917973232586975,524288 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,15794900617709273793,11948042461091375779,524288 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,15794900617709273793,11948042461091375779,524288 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,17194866477835350057,13762684474853040360,524288 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,13735268455793636979,12470824313292325701,524288 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,10716181959578872084,3869697739144563823,524288 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=2080,i,18431457830710373331,16772180640088345124,2097152 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,3171776900915799456,12349779637561332527,524288 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6124,i,3684332069211466857,3040222858941935047,262144 --field-trial-handle=2260,i,10366268358177127468,8273610485398052055,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0f6e8797ec44866b70bb772777fccc9be92e480a6a74d7167030771d5c750125
MD5 139f17fb31df92791073000f1c84e70d
SHA1 e9e6e51d88d598a0b84044bc548b3e26e257f9e4
SHA512 30f90c4efbe6cb8610346955dea4171a79a315ef2747e4c055a5e807cc34af0e84a2234edf261f8a42231ace03a62a4fa6dc3295b65a412ffec3b262af4e0d9b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T10FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0817b32cede383ae462301d8c23e9392104483c850c8cdaef1c5cf6426568752
MD5 3655e785bc5287e7f1d02dce4e8c62d4
SHA1 d324917cec25c5d33370a3db77709a95eba7bde5
SHA512 fcb047e358696c82789f27de0823f927b2ee4fccc2a7e1f5fc2ba3fdcc735e17ae737727503865648b274a5908dec15694e771cca6ab2ced7c31c876f64525cc
TLSH
T1788163F4C44287E0EF6160B2CBDA461F35F082F9F813BF4291E41B746B167A146CB455
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d6dfc36112542fb09da2894c8728d13b50d32b9d969b111f1737a9cd37f4b483
MD5 88ccfb326a82c33871ab3981c2d45560
SHA1 c2ae8ae2ab4d5194689e7c121cf427a9f2bce9b6
SHA512 57dbcf1435fc5ec77771c34a5cbe848731c08c1679d3e30fec4663d79beb74c0d91c7f8949b43a09ea014c934edc66beba3fa4d65cb48f755d69118ed50fd09d
TLSH
T1DA6162F8D45207E1EF5270B283DB462F75F082F9F913BE4190E02B796B0676186C7595
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 10aa38591d5a9ce180a3f8ff455be9dede90081719b81abbfc3828417866ecad
MD5 2536d8bd27da2301166570bbd9fcdfff
SHA1 f854e881308b5ffc79bc54b1c0c94c2ef0373141
SHA512 facfb4cc58fbc8bf4313a1d4c00fba61290c6b37be8eb99ed0032dac07fbbd7ef18d9201420e131c9e41cfcd78b7726da1d39664206d87616673c953a4cb501b
TLSH
T1917167F343A5C92D9A05DAF09A18AE1BCE5C0515531D7C3AC9E0BE57E3E34A2E1017AF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7247ade69aeefb00034f5013cdde6d85c63ecce28361567770f09683eff9cd83
MD5 7b7fe82118eb5b77b927de8163fe0a1e
SHA1 f017994d62ea4c33da38758f6a87a41ffe4c766d
SHA512 4a67bd4e64f881227c7aed9e9fbd29421990613c5c3d6276b88c35cbad65c9a95543d41e36b3b2a20ff1f7c96f17ef811dbcc62adef5e52d74b28d5d5dacef12
TLSH
T1E47168F343E5C92D9A05DAF09A18AE1BCE5C0515531D7C3AC9E0BE57E3E34A2E10169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 327c9f9c94c317f7ec7ac5d00f5eee21dcc1a698ac2030a761447d6eef137eca
MD5 6c58eec66736d24741d30f8c888f7357
SHA1 f160a6ad8fffdebb37cc8d29dbd67f8f07f7f7d2
SHA512 4f829a3dfd046486a2a09e9564064c89daeec86fc3f08deacb2d87ee2e37d80c9a55a54d37ff28c30437bcb0dc2c562447b9203a042b9236a5ba8e81ca9f4ac6
SSDEEP 192:sxZNRgyM/jK1Ml8Mkk/fcXsuZwhIdp4cZHW6+WN/rx/YzPVbyIgrJ:sxZNeMk/f+suZZDHbF/h9
TLSH
T18752D751AA34A9BBCCDBD209B9457F53D6F90473D2940E54A9FCDA1C00E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8e6dd812081f7a44321704363d006429c767af173f7d4d9fd68e0fb7393d3ab7
MD5 6b2aad46e76f6d6d095b68e1480869b4
SHA1 298a897954ab1f282d1efae587c6a11d7b4b4a0a
SHA512 2c432bb17648a1941bb733befad99de1dc4c7b626146c63c9dddb161ef9c9ecd3f31a471063f11aa6427244534418240b9faf1514c0cd9780733d343cf9aac0e
SSDEEP 192:sxZNRgyM/jK1Ml8UQ8kk/fcXsKywhIdp+WAHW6+WN0OwQunlZYz5wlyIg5fJ:sxZNeqHk/f+sKyZQHbNgZwD
TLSH
T12D62D752AA346DB7CCDBD219B941BB53D6F9146292940E94B9FCDA1C00E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 47589dae86b3821b12a5c5b5561cbcf1d76a6a48b0335d84cda7ddf3567f7727
MD5 b135cfcf268721fb757a95d3904c76fd
SHA1 e8c2a0331808788ffbbdf2504411818b72c7c82d
SHA512 a80db18d8d86ec3625410e090a04c9871d00cdda4ea4d86a6eb44d2b508a87c2240385968a561c9e94093dfef64c0043c03410732ee7c6dc18c9f7538de3370f
SSDEEP 768:jqW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjUroIziOY8:jqW7kf0Wvqidau1jaa5LA3j/T8
TLSH
T143D20B3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB7EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 dc54739bb597d43756557b99ece6bee4fff3a6db5d45da9a3f7f1372fb5ba1f9
MD5 7638061c39142941a2a81aa9e7a961a8
SHA1 fa93f1808f287172c6a7be888d1f541645709670
SHA512 d9ed2fde1bdd147ff3ff97ecf4184e85ca880a3fa1df03b93292bc9ea26c1d55be924a5a248b1defe0e254886c84dbfcd76258ce84b218aac6eb5fbd8e30615a
TLSH
T123A002A0894B5952D4009775934E218133A44A23028D274168BC90B8DCB725152C3611
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597526.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597526.TMP
Size 48B
SHA256 0bc79b52cef8ba395502527e3831e9df44d77a80ac7dc39359d426dedb71b1c3
MD5 4238a65cd73248df2fa1b90b2f40255d
SHA1 c93523609bb14cc4b71e49ea5740b5c494c6063f
SHA512 8b4569786a5ff7549dea1c67a5830c8188b4077ce0f92aceb87b53cc349677e5f6672621d2a477607f710a8b14a21e5b987027ab750c3e28ad0939340940e125
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 e0275d63e3a911f45dbecea141d3dde4318337dab878aefae47f936cffd97a68
MD5 ffd4d255b74fcd3a94be41e3f3b8ff63
SHA1 b6938bbd5b5d4873233dd7c03319501ef6ee0cfc
SHA512 246451f07b376d1082d0adccbe2d2c59a48b3d99b572f2fdffe2ecc6ede94867e6d02f71373247d3d18613a283aec9667d334f2dd75c631afbfaa3ca7af1467a
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTXjIBKM4MHyhkI7KRS8jydrIxKkIc/:KIbCKcXj+KM42CkIKRSCOrWKkIw
TLSH
T198B12066323B06063CBE2D6CA65E8A779E4236633458646F3BF801651D26E121FFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 14b1b3c1fc6633292d187fb8806143d12a2b9b248e07998c03461019519c549d
MD5 3cc67722323d75a16a3cb32c086358c3
SHA1 eadc575cd7807e355e3c51685752be1a6e8faea5
SHA512 244f8f9f0a7ae6ac47b387ccdaf067f829f810798c60b869a2ea86c6617bcfe4e4cd24d7d47e4624955ef4bfc4f1521fd317cecc9a9b530ed5e233a0bedb6e13
SSDEEP 384:iZcIhsNPttBbGVxDdmmaHCEJr+pU6HlytEDq1h:QhwaNIhh+pUoy6DqH
TLSH
T152928E3158745D77A9EBB141F4863A134EFC812BFBC86FD4B6EDAB1C01DE2A91306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 54a77dd23e2c5e2fa4688308eed402acbeebdb5b54fa680a8f1d5582a7252228
MD5 13dc41f1d2df64797d021aefaffd0c39
SHA1 6138d069a270bb569a1f65214f4122c684c1dbc5
SHA512 4f740cc3fc30a8b53a242b79404735a5465ba13a63a8859054a0ef40924063beb801cb875a58cbbeba095cba246c09f08aa7079121a47bc590f8b40dec9e53f8
SSDEEP 384:CFiZcIlzsNx8TUNTUlIlgtBbGzxDdmmaHCEJr+uU6HlytEDq1h:CFQdQwgA4NIhh+uUoy6DqH
TLSH
T1A7C22AF148E34936E9AEA743E77D3D124DBCC027B5846A94B3D89A1CCC9A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 414f2099984085e8f90fcd0afe2e8a92607c6fb7a77c8fb197f5d38d34578a7d
MD5 092217db8798284385f46f5dc9ff668e
SHA1 b1344a0b060509a2f2b53da486008e609510ebcc
SHA512 2df132d4ea8b40febe2128d8f4ca09476b5acfc3ea15bcc834cb28c6729fc6f22b5c0da336e2a91d60125ee21664f1f494318e5754338579660eb367ae813ece
SSDEEP 384:gZcIhsNPgtBbGqxDdmmaHCEJr+pU6HlytEDq1h:ehJFNIhh+pUoy6DqH
TLSH
T1E7928D3158741D77A9EBB141F4863A134EFC802BFBC86FD4B6EDAB1C01DE6A91306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1d3a28488943f8b07942631ea3043fc80c139bec36b509198d9156d0e73b20c1
MD5 97dfb82a7272a81bc4d130add73a93ae
SHA1 2696e7af0c4f8b6cde5e8a4355cc586a9eba6ad2
SHA512 44d7e474821a265d8c7a251d1aa1ddec8ce122cec66341ae9d427e69d96e6a50081c786a0e1a3db20c0d3aaaa3bd7bc495428085cd7c1c8984cb450703cba7bc
SSDEEP 192:7ONq64BgQmiUyGKD5GBPK7H+FdGBma2dEFC1SJr+lWwPqvU6:7ONq6egqDIdmmaHCEJr+pUU6
TLSH
T14A122B359C746C7B9DA2B141F48736135EE8412BEAC96F94F6EC3B1C01EF69C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 977d7dbff8db7a7d7f0f6114113a71dfe8913ec6645d45e6264af6da094c013d
MD5 0465d8f6119d90cd6788de89b5cabd9f
SHA1 a84fe4d48cfd651194e4eb111bb966321a22665f
SHA512 1f1314c6544f494b7306d2d494e3875bd75a365a4287bdfc33528ca5977681be88ef0d10568a8da10bd320b8e25ed72a83047199254a6618c024f040a7ae31c2
SSDEEP 192:MONK64BAQmiUy31KW5GBPK7H+FdGBma2EaD0+U6:MONK6eAMgWIdmmaOPU6
TLSH
T14A02FA34AC786C7B9EB2AE45F48637175FD8112BE6D55B44EAE81B1C00DB75C234282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5ef8988a961b39274e1fd18c9873c5e9b0fff2238449363eaef51bf624072819
MD5 e086f937eb71aa6b8a0fd44d128b5ffe
SHA1 8aeb3f8d6336aae8d066614652ddc3e8ec2078da
SHA512 199b1eb356d7aa9d40271e8525b75caef8c4a661e07a90a450a8d6956df97500ce0e9abdc80934e3068b43a7ec59f379556951f7694e8f6769700a54715ba66c
TLSH
T1BCE00202932001A6C004127000471F201FD2C021016103464B30015C6C37340BD51B00
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe597aa5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe597aa5.TMP
Size 392B
SHA256 ed28a12627122f44a7b62d09fc5e65fdffe49ba945d9003c878f01176f6e8fe7
MD5 444cf83bc74688f0577c8265fbb71d64
SHA1 395f89a1b80a9eb120faf9821c3de01bafecae26
SHA512 f3fa103b0e486290ff06bf22f34b846bce42e10cec9ab13c1fa94d905f03e09cabf2dae8b7a84ce4cd2cb28c8809bb2a98ec11ebda5db6c7a9d310d393210489
MD5 SHA1 SHA512

Submit Download

e28e271e-8ac2-4737-8490-7f49d0f5ddaa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e28e271e-8ac2-4737-8490-7f49d0f5ddaa.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 93bf83d6ba8749a53e80d9f78799958a253bf08e998dee8a969dc00389148256
MD5 9d6a5d12fc055e1e94e2aa4b36ed789e
SHA1 6c8d9a012d0b251ef8612adab9ec74bc322f1c91
SHA512 2fe52d77fdc3ffb34a80b596041dbf50ad15c6d50e8d7808acd8108279fb1dd89ed0184eb2c689a0905b36f4ba0c4108894aea10572976a0a195a845bdfcf08e
TLSH
T1F741035DA6F91148B377BF5AABF6A8AD497E7D772E06C55D00010E4E0A22E40CD62733
MD5 SHA1 SHA512 TLSH

Submit Download