hxxp://webmail-pnra[.]gov-pk[.]workers[.]dev

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://webmail-pnra.gov-pk.workers.dev
Sample260811-dc8gmsca94

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3744	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308903869013557"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{7CEEC1A8-5F73-46FB-B631-453970CF3346}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 1968	3684	msedge.exe	83
PID 3684 wrote to memory of 3744	3684	msedge.exe	84
PID 3684 wrote to memory of 464	3684	msedge.exe	85
PID 3684 wrote to memory of 464	3684	msedge.exe	85
PID 3684 wrote to memory of 464	3684	msedge.exe	85
PID 3684 wrote to memory of 1816	3684	msedge.exe	86
PID 3684 wrote to memory of 1816	3684	msedge.exe	86
PID 3684 wrote to memory of 1604	3684	msedge.exe	87
PID 3684 wrote to memory of 732	3684	msedge.exe	88
PID 3684 wrote to memory of 1604	3684	msedge.exe	87
PID 3684 wrote to memory of 1604	3684	msedge.exe	87
PID 3684 wrote to memory of 732	3684	msedge.exe	88
PID 3684 wrote to memory of 732	3684	msedge.exe	88
PID 3684 wrote to memory of 4372	3684	msedge.exe	90
PID 3684 wrote to memory of 3504	3684	msedge.exe	91
PID 3684 wrote to memory of 4372	3684	msedge.exe	90
PID 3684 wrote to memory of 4372	3684	msedge.exe	90
PID 3684 wrote to memory of 3504	3684	msedge.exe	91
PID 3684 wrote to memory of 3504	3684	msedge.exe	91
PID 3684 wrote to memory of 1436	3684	msedge.exe	99
PID 3684 wrote to memory of 4916	3684	msedge.exe	100
PID 3684 wrote to memory of 1436	3684	msedge.exe	99
PID 3684 wrote to memory of 4916	3684	msedge.exe	100
PID 3684 wrote to memory of 388	3684	msedge.exe	102
PID 3684 wrote to memory of 3752	3684	msedge.exe	105
PID 3684 wrote to memory of 3752	3684	msedge.exe	105
PID 3684 wrote to memory of 3752	3684	msedge.exe	105
PID 3684 wrote to memory of 1852	3684	msedge.exe	114
PID 3684 wrote to memory of 3204	3684	msedge.exe	115
PID 3684 wrote to memory of 4812	3684	msedge.exe	116
PID 3684 wrote to memory of 4164	3684	msedge.exe	122
PID 3684 wrote to memory of 4164	3684	msedge.exe	122
PID 3684 wrote to memory of 2548	3684	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://webmail-pnra.gov-pk.workers.dev
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x23c,0x240,0x214,0x2f0,0x7ffee8dac188,0x7ffee8dac194,0x7ffee8dac1a0
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,11220250083854880082,5426642201995356050,524288 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,18194461729913161112,6703920801842836136,262144 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,17240255549951395992,5965772940295732136,524288 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,2519390020136333703,14966266693952878807,2097152 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,14522752138712073054,18396091550427209954,2097152 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,13556506627022196259,15215377330242431188,2097152 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,11329809334885162862,6718371802833086942,2097152 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,11630460572666602012,5543975461755875620,524288 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,1809033381482861524,10111159081852294463,524288 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,9168180354884777927,13505021142883939424,524288 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,9168180354884777927,13505021142883939424,524288 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6404,i,1314393711869577984,16932209909483957427,2097152 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,4338985959357924391,10549464331248552300,524288 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,18068880469874048294,13102821569652884242,524288 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,12380070497297722365,8451745680120804128,524288 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,16104441617463108196,17769836625405205177,524288 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6192,i,18004471208890382549,84500418985562343,262144 --field-trial-handle=2120,i,7155206368259845103,9580632194750286287,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 774d10427cd298499dd55e5eb74f7bd01c0a9ae116714421d32bf90393a12608
MD5 679e899c3e44c6c007c02dbf0d19beb0
SHA1 02d818872030d91a67470897285f4cf6ee734168
SHA512 7d4af1a858d31d479baea46429dbcad0c8c2c3684b57e12b15967f0b2fb98abbbb2ec62def3fde20540174ce3140108f90168f58b959b7439c55e125240c7cb3
TLSH
T15E71B3653352A4B5EFE5493CEDD24AD979B0B0890A139EAA01706B3D2BDEB5F0C211CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b6c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b6c8.TMP
Size 3KB
SHA256 a26029c51b4a11dad091658a189d695547bd887a6aab1778dee49a87b68f615a
MD5 310bc866c34de6e6fe457192e1d7b072
SHA1 9c42c5afc833dc467496c775d36e47a0c0bd3d7f
SHA512 7feea977d8efb29adc8afeb1d3498ea644ccd3189ed7fe715785f5fda4bed917aee09e192079d355ca049098cacf186cde7d75a555a5faae8b03cda835dff39a
TLSH
T1E771C5653352A4B5EFE5453CEDD14AD979B070880A139EAA00705B3D2BDEB5F0C211CD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0f19a6a6bde20ce521b2ca6bc70adffa35a5330b1583a6e79253421353168f0c
MD5 0768cb186e4660a78dc40a244c17d510
SHA1 c51a9e78d3a322b94b62741c1d64022edcf3a3d5
SHA512 90671b8b9d2642aeee429bf63e94c04faff28cf414d91dd09f036aa882ef1702430200189269a589c1f3edd319ff14e7ec67b83180d793b66ce27c1d922d4a65
TLSH
T14831BEF3C3E5926EDA1166F0AA186F2BDE1D0515432C3C1AC5E4EE2B93F2471E102A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8db1419002428e0b4862f9a8d930fe800abcee826c7e82804e47ca2c993db157
MD5 fd5aa12f1653c87166f58f0653772f3c
SHA1 3b9bcff1acd3c0f3dbed5de2c550913af6f66728
SHA512 b3ec3b8908ffc171f76f3cb982e6846e4e49aab40c11ed7332613daa2da7db0c2589dcabdae925b6cab88c658007d7be657ffd22225938757d20bc28b448270e
SSDEEP 192:sxZRRgyM/jK1Ml8Mk0/f3sQ6ipIdpJHhl6+WNGY4kplMIgrJ:sxZRGM0/f3sDiiJHMGt9
TLSH
T1B842E8116A34697BCCDBD20DF9557F53D6F95472A2A00E48A9FCDA1C04E6AEC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1dc3eae4c39ff025201805bfbe98b2c43d31de97f09c8065dba1d3a1d7112b55
MD5 c0e3ced02450880d83cea8a78821deb6
SHA1 622f037f713c71fa8b84ef9b07cd852e981cde57
SHA512 ec1a4e5a37bd229bfcb79bb0046adda6865a3c5db9e40b2a7637af86b65907672cbdb2bf3d873bc507d995aa78684df33968f4ea4b1aa705402105636cb71244
SSDEEP 192:sxZRRgyM/jK1Ml8UQDk0/f3s86r8IdpTjHhl6+WN2YR/Y4WmlMIg5QJ:sxZReqo0/f3snrlvHM//oy
TLSH
T19852D8516A34597BCCDBE20DF951BB53D6F8547291A00E44AAFCDE1C05E6AEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d09ab4942657355b8586beea8027c3f8006dac90130866f89d745c419c659bb5
MD5 05caa6805bf568b55899a58785e8b273
SHA1 f18351f6b65c7fe56b76806fed54b58f5010ebb0
SHA512 5289f9f0645ae7f1bc53021838024d629b227de40b7a3e7287a5da7e2512ee57b7c18ba8d6ee19dec612d2a93314c77ce992910e4f0ddbb3d47b8d3dac6c6474
SSDEEP 192:sxZRRgyM/jK1Ml8Mk0/f3s86i8Idp9jHhl6+WN2YR/Y4IplMIg56J:sxZReM0/f3snilpHM//hI
TLSH
T14C52E811AA34697BCCDBD20DF955BB53D6F8547292A00E54AAFCDE1C04E6AEC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a7ec89c7f0344e9fbc754e64f4bfb91a66e020b8fbb1976d0a65e538bdd7c435
MD5 895f646a7a4b705e22144f1f0c4a1e55
SHA1 b9c03b53bc9fa7d73a120c11a3e018b932afee36
SHA512 94a0cfd91b9d83ea7c0a8e8797e6d45bff0e95af0f3898ca9ef51b6f95a4b6eb299a46c859159e448e6329d689a46e73ce9181968189f83f5394e68a470371f9
SSDEEP 768:Tf8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdUroOkfUnz:Tf8iJPNWvx76ru1jahALocd/RUz
TLSH
T117D20B3B680CCB7E4F844E9CEC266F966ED801CB5B984D5447FA884C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b4d286ccd6137b04f70f63f9ae94c63ce2781549e039ba3039f9ad3b2c4da041
MD5 ea6c5089697896c5b000caaad10b84d1
SHA1 33ab4e7a39300af7e9e4ce686429922a51d9169a
SHA512 0459e709663c91dd821419a012f553f02640c6e2531ec75482c1f933f8b44b7514b03ce1dcfcec333627576f5c43c38bd50fcd31ca69f7b4a646fb5a68e4a568
SSDEEP 96:KoZ+Ky06SCsKnqWQ1WKQmGRTqjMNSRKlYNwRx4ALSGy4PwjvBhBaTp2:093Opv
TLSH
T1D791404175BB12462C7F290CD1E4A767DE8272A37114A52B7FFC01B28EA7E210CBD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c66cbe383d5f1f603bd7992c90ec2aa563a16f19161ca6c0e3b699c58141bf31
MD5 74633e38da69e2b521a0474f87aef6be
SHA1 50c2a0a7606944246d123a0227c323ac1c419492
SHA512 6bba8ac884182b1c43d2525909ffc7e5aaf78418141673c4948af73c9c4d0a559c52272323aa9f8f3d8e4e77cb55aa3f9b73468172a4bac0191267f2c12e16b7
SSDEEP 192:u9zLsNN+QVTZU3gmHMQmiU1tKo4k03YHHNvLIbqVk3b:usNN+uTk86XkVHtkuk3b
TLSH
T1EC423A72AC786C7A5EA3A546B04B36175FF88127D7C52FD496DDAB1C00DB2AC2307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f0548dbf2b07564bdfe63610fb653e1022e2936df437002dbc45419385f23ad5
MD5 a43c822174a5e9323141ffeae9b4e320
SHA1 6fd1a2a0f815918c152f28865319c30f0b6bd5d5
SHA512 bb4f2dfceba626dd10112acf60fa0d2a2df39872ca9bdaa6c9a7404a5c105afbb8a635b189c5d40d1f6156ceb0d3a5ef1db0a66444f059385a44ac2eec30433c
SSDEEP 384:SZcInzsNN2uTk8lXkVHtnuOOPrXLpe8C/S:gzchmuOi9P9
TLSH
T16FC24AF158EB2876D9AEA743A77E2E175EBCC123B2841A8473E8960CCCC657FD306415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 928c4cce6a770d6ba6f836e78e299954aaf58f531c94f7762c1588870fa2e027
MD5 5a99f494f107b9a7634688ddd0111fa9
SHA1 257139cd9c0a21c54800f5cc32a4fd20d2029a59
SHA512 77c3ea4bcdbd7be01c14dd67884f874234f836870d891b15c4532ecc90e11466e0c7135ddbe1a2e76c381d666d180185a5f9208129aed84a4fdc6cae505ba27a
SSDEEP 384:bZcIhsNNsuTk86XkVHtkuOOPrXLpe8C/S:DhAGTuOi9P9
TLSH
T128929D71A8B82C6A6DF7E946F48636175EFC8137E3C52FD891ECE70C05CA5681307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 93eeb7c3a26bff5f2a76a75dd5b29bc6f843e0d97dbc4618bd2427aa249a98db
MD5 1e4cb3866811f4d5eb863968162f952a
SHA1 b2fc6d724a8823b4de9e4b4acfbc9d1cd9e4c5fc
SHA512 2ad3a549899ea204d96a19449e2661f97966b7d0b7bdfe641a246ba33a1fb97d60b6127c235136e04f819eb368df3a9245ebed8f316cd196611f440a80660461
SSDEEP 384:zZcIhsNN5uTk86XkVHtkuOOPrXLpe8C/S:rhFGTuOi9P9
TLSH
T17A929D71A8B82C6A6DF7E942F48636175EFC8137E3C52FD892ECE70C04CA5681307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 72ea5e7e426c23ab2f19cb1b02b2ad92c107415aa7aae2470a24ea909512b9e6
MD5 7686bdba6c23b674cef57a7d07afb136
SHA1 4e77b7710784c40fb2f30b7a2d84bd2ad5fcb1f2
SHA512 96b5dbebeb0c19370a4b1bb0f7b2af49b4d28802bfcde644c8b8fe48d345b8fdd5f6e4954903c773aeac2d5ecfe5e14dd01103a82afa5ffbd6d3e19d12d2ff35
SSDEEP 96:ZqONkmGQsjpfmUTmDK5ih/cIPURHl8h4otop5V5DL+BhPwivh50xy0SFYKRAxcbG:gONp6kDfQmiUynKZ903YRQi3QU6
TLSH
T12D02EA356C7C2CBB8EA3AE49B58737275FD9113BEAD52F84D5E81A1C40D725C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 acb16dc7c6b3537a57a9a3f11741d36b4673c7fc552ed84b4d87356db882c272
MD5 dabbabb453873fa032978f0b935271e5
SHA1 6ec89cd57b1a55b30f0b89617642a26f221ba30c
SHA512 a17d2196f442b380fcadf910163cc53d1c6db95a45874b4183dd148242f00a3cbe8b9df0e120a12af219ce22102e48b732cf36094eb6b3adee1ac28f56bc7b7a
SSDEEP 96:kyqONkwQsjpfmUTAK5ih/cIPURHl8h4otop5V6DL+BFPwivh50xy0SFYKRAxcbsI:kJONY6khQmiUySKl903YHHNXcRbqVU6
TLSH
T123122C3568BC6C7B5EE3A946B48736175EE88227EBC97F90D5DC2A1C00EF26C1307516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d704df90561f8be6ddda0f182d790c7a500daefb6ac923dfb45c9889bc919bd1
MD5 4913fc13107fbee009d72c274f6af537
SHA1 b45768cab2f6b577a9416c8337fdc8ef6cd766f8
SHA512 f17f599e2d817857d6cdf294f6fcdbc6a7106f9dc50d913759c0279a7eeddaf40ec5a6ca557a8ebe96fff5a07234ce9dfc355a5d213cb402f80a8c69d4c76c30
TLSH
T114415A59ABFA1104B3B7AF5AABF7A46D587B7C772E06D05D00110E4E0663A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download