hxxps://d9t9moqnaffc73eou3v0[.]oqch-adguard[.]co[.]in

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://d9t9moqnaffc73eou3v0.oqch-adguard.co.in
Sample260811-fe63psce46

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1468	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308973204953566"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{EA633B2F-9BCD-409C-A801-E5FA14A14DB4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1088	1744	msedge.exe	85
PID 1744 wrote to memory of 1468	1744	msedge.exe	86
PID 1744 wrote to memory of 4504	1744	msedge.exe	87
PID 1744 wrote to memory of 4504	1744	msedge.exe	87
PID 1744 wrote to memory of 4504	1744	msedge.exe	87
PID 1744 wrote to memory of 1956	1744	msedge.exe	90
PID 1744 wrote to memory of 1956	1744	msedge.exe	90
PID 1744 wrote to memory of 1956	1744	msedge.exe	90
PID 1744 wrote to memory of 4604	1744	msedge.exe	89
PID 1744 wrote to memory of 4604	1744	msedge.exe	89
PID 1744 wrote to memory of 4732	1744	msedge.exe	91
PID 1744 wrote to memory of 4732	1744	msedge.exe	91
PID 1744 wrote to memory of 4732	1744	msedge.exe	91
PID 1744 wrote to memory of 2732	1744	msedge.exe	92
PID 1744 wrote to memory of 2836	1744	msedge.exe	93
PID 1744 wrote to memory of 2732	1744	msedge.exe	92
PID 1744 wrote to memory of 2732	1744	msedge.exe	92
PID 1744 wrote to memory of 2836	1744	msedge.exe	93
PID 1744 wrote to memory of 2836	1744	msedge.exe	93
PID 1744 wrote to memory of 3608	1744	msedge.exe	96
PID 1744 wrote to memory of 3608	1744	msedge.exe	96
PID 1744 wrote to memory of 3608	1744	msedge.exe	96
PID 1744 wrote to memory of 1564	1744	msedge.exe	102
PID 1744 wrote to memory of 1564	1744	msedge.exe	102
PID 1744 wrote to memory of 5104	1744	msedge.exe	101
PID 1744 wrote to memory of 5104	1744	msedge.exe	101
PID 1744 wrote to memory of 1924	1744	msedge.exe	106
PID 1744 wrote to memory of 5608	1744	msedge.exe	118
PID 1744 wrote to memory of 5616	1744	msedge.exe	119
PID 1744 wrote to memory of 5624	1744	msedge.exe	120
PID 1744 wrote to memory of 6116	1744	msedge.exe	122
PID 1744 wrote to memory of 6116	1744	msedge.exe	122
PID 1744 wrote to memory of 3456	1744	msedge.exe	123
PID 1744 wrote to memory of 3456	1744	msedge.exe	123
PID 1744 wrote to memory of 4656	1744	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://d9t9moqnaffc73eou3v0.oqch-adguard.co.in
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffbf4cec188,0x7ffbf4cec194,0x7ffbf4cec1a0
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,4017819386574192507,9992575175985435581,524288 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,10209983721852286772,5495810998657116259,262144 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:2
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,3536448860557957547,13422740209753321727,524288 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3352,i,18324019135382508585,8512414324393707804,2097152 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3356,i,4947401590329157801,5389758428336439396,2097152 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,4435693799664138354,4620772960551696205,2097152 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,8436754388861504127,11434445201473827484,2097152 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5032,i,6556711911478072087,39085890567167327,2097152 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,12685891765647106112,3280860758807476601,524288 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,13118816381731018988,12145883124348755998,524288 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,10686020501804666881,2064376906695981093,524288 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,10686020501804666881,2064376906695981093,524288 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,16109211898812426385,9842608553047989673,524288 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,11680100176123936064,425176742499299757,524288 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,5662288587165458006,6750917238588101632,524288 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,4703911583778579908,12756152730756418737,524288 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,6726459338932040456,4536668053599849901,524288 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6192,i,18069478336298281233,9916642917626868809,262144 --field-trial-handle=2776,i,18199665040736742616,11327784312503721505,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f32c5d9efb1ab4f2e9cb6d708b48d04144a1c342b53574c8f51378e2f5200543
MD5 1934dac01a2b87c4a5d01b5f9dee7345
SHA1 8432498beef51f6efaa4ba284d0730ca1d247cde
SHA512 b9726cea0d61e129fb351e2da16880567ce03098a8427f45cd8eefe34db3a75a068fef93bda213b60962fa33e65956c3999468f337fc087334bdf402fe5ce1ed
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7d:fwUQC5VwBIiElEd2K57P7d
TLSH
T190B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6bac4028d4c216e0cff43150ecbb0aee24c883a1f1034f8418c4d44f24a68724
MD5 f59b2342af22d6f57d656fa0b3955463
SHA1 4aac32478e4041b48fd8fe633a0d91caf699f938
SHA512 0ad7246e42c52858d54cd3b7591cecf156ceeda491be7da319b79350c056b80dea83be09fd64b34b7e5ac210c68d6bf097846add5c34533cd980f55f965ee958
TLSH
T14671916F8D0201D3EF210131D5DA1A03373E8DA94903BED1225498BDB82EB67F0DAC78
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a8dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a8dd.TMP
Size 3KB
SHA256 9701cc54f0a4780afb19dde2792bf2903d8021f50ceaece82126564e53c38717
MD5 20b2ec51cd00a4e5411fb65be5de3def
SHA1 8fb3fa5299dc61c30449dadb79c1ee52ee6fe66d
SHA512 f0c280c3089ac7b1100c7c24d11fda13edf2f486184613f606009928409592cb71a4a47d08984575fcb59af9f23fe8d2535ee714fe3852a65707d76eb44896fc
TLSH
T15A71816F8D4201D3EF211131D5DA1A03373E8DA94903BED6115898BDB81EB67F0D9D78
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b5b5145a6219c8421542cca350c5930286f92f2c340a367ed479a4d744549eaa
MD5 5a45747426372895bd50ba3dbc6f84b9
SHA1 dc2ee9bb4f515686adab313f515c6307d31d9df0
SHA512 0cd950d3fa2c02195f7985f115a756b4e374178c6ef058e56cef6338eb83925951b800ff4ba2755a1b48c7a7f441127dcfe1843aa6d55c626bc13825f511a5b5
TLSH
T1CC3177E3C2E6866D891152F0EA286E2BCE2D0A0442183C5AC5E4EF5B93F34B1E10194F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ddff0de93fb949768618bea2d6e93db49acd0e619434e4b5ea8cacd9ed59cb20
MD5 ba9300dcedc831c2b74a95a2cf604114
SHA1 81c676abc4f77fb25fdeadfd94c999af99e75833
SHA512 9c4d1d819ac5c64f054fdc94f4a7854905089b079dd74306f8c43557eff80804ef75dceb646b64333d50d20e33d14cad913bf3e993cae394c9de1a34ac5dd4e9
SSDEEP 192:sxZXR3yM/jK1Ml8MkG/fxs2aUsIdpe+HW6+WNCLH/YwHl/jIgrJ:sxZX9MG/fxs2n1BHbg/z9
TLSH
T13652F9116A346977CCDBD309FA417F63D6F9457292940E54A9FCDA0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 34986ad8db5b052ef8ea552f52978d0364a8cb24e80808a7359678f98428c549
MD5 c1302972ce15b892d9d8c4396a36e2f8
SHA1 03a7383ee8d775da190e7d21f16402f5ab344fd3
SHA512 6543a97a03ffd793b9340af04efbb9edbae85467244d972183059313eaa8451b40ae08a0d9a3e302bd9274f4eda4cb93caa50447e2e7dc42bcaeaae32a09752c
SSDEEP 192:sxZXR3yM/jK1Ml8UQWkG/fxs1a1sIdp8+HW6+WNCLH/YwhOljIg5eJ:sxZX9q9G/fxs1q1bHbg/wU
TLSH
T173520911AA345977CCDFE209F941BF63D6F9447291940E54AAFCDA0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2d9c06d2f096f306ca3a5fd06a2d954210af02e1ae4ed776cf07883ec7a48ada
MD5 47f26d20ad7589af8645cb5bf2946b0a
SHA1 79e9b2c2bf0d8fff8f1a8a4965caa4097a68d656
SHA512 6d140924f558de230c70e54681eec4450bdb093a18c0e5c7269d77bbbc8c8412f3867ec69199418e09ca8446cb362bdd40299f6dcc1aa48439dc1b6132dfd51a
SSDEEP 768:xm4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dCrohEcjaa:xm4jeXmWvmKLEu1jacPLZQdZVx
TLSH
T18CD20A3B280CCB7E4F844E5CED26AF976ED801CB5A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 29f881f7120701baefd1cae475b1d0114244194d6161f29cfcc85f05ab344a7d
MD5 e7158a993cbac2fa5c6a22ffd5188605
SHA1 6811a5488becc1044db34251c3b88ef39fbe5207
SHA512 70df454de181aee68141315552e4e31fe31da85a9a3fa5e6ca52ebd083f54c8c429a11272deca3c0e4ce49f55eb810ce7d3c5c704525c7e2737a48d8109d7b85
SSDEEP 48:KMUIjKJSUjyxEIHK1+cFQIjKpCEHyn3i7XBJJ+z:KMUAKJSayEQK1+OQwKpCWqz
TLSH
T1349172217ABA0201BD3E250D82E897175A52BEA3351CB52B3BBC40B64D67E114DFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5945d9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5945d9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 ebc5f93d4599f09bebb33a60d51d1e5f1feda1bf717fc1f3fabca2f4b31a6f4e
MD5 aa4fed6f49b426ad411c69b14fead8d3
SHA1 298da5bc7125d6c4d8501e05812084319bb0fe69
SHA512 d8aeb6c917dd2ccdefb8d8da721137041717863a37d425a2b5c0c04429ce7748d41b9fa97d94a0ad0ee2cc090dfb0078850756270d4f59a2b503d3905fe0e5a1
SSDEEP 384:JiFiZcIvzsNN8TUNTUlIl+lSUEwuf+68R+XGxJrElFXOOPrXLpe8C/XtPjU:gFQLgwg/RZEhuXOi9PetPjU
TLSH
T194A27D3298A89C7BADF6AF45F44A22139EF84177E5D56B94E3DCAB1D00D75AC0307C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4fc3fc03621fb1819dcc0d8029411265b60fd56dc42b7a18891f58742287958f
MD5 95aa4aafbb7cc54f4d6ed21da9484d92
SHA1 fd1fb8069bf894013468c258459b8c65f7fe2a6c
SHA512 cb270e0304b010c10688e8bede3656953b3d76a46f25d945389a0a9f49893fd28ec97aa970cb26b02d6a01f2c807d9aa252864cbc20d69cc89b71c2b74af3a61
SSDEEP 384:LZcIhsNzZlSUEwuf+68R+XGxJrEvFXOOPrXLpe8C/XtPjU:ThfRZEh6XOi9PetPjU
TLSH
T174928E31A8786C679CE6F655F48722139EF84127F6C92B94D2ECEB1D04D766D0317C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8e8644882291b8c6dcebadb7e9a95de259f27ee01af665da0b15efeae03401c7
MD5 cb22036fc8420cc70560302b4511014e
SHA1 b8ebed67786769fe16aa515903360a3ac1845342
SHA512 d7c17cce405c95b177d09eaf1c2aed7fe2d3e30ae325b1fa8cf723fc4bb5ef90387f56a4098b03abbdfb9784f02f19cbe16ea613e5a4a87b34dddb3b383784ad
SSDEEP 384:uZcIhsNz+lSUEwuf+68R+XGxJrEvFXOOPrXLpe8C/XtPjU:MhyRZEh6XOi9PetPjU
TLSH
T1EE928E31A878AC679CE6F655F48722139EF84127F6C92B94D2ECEB1D04D766D0317C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 92ea2dc672284a4ba8e55114d0b53cfe2f5e5b78ff42146224e1dcc3fccf8b66
MD5 dd529ac0cf55e8c0ebf1f71cf0b1cc25
SHA1 340d947635e2b38fdd7907c710c26b309cedbd7f
SHA512 58ae01304f6afab8c0678021aeaa9d5800e2695872d3e8f5f3b3b6f7068eb146c3fc5bcdc8d9d22b8899d4cb3b0194bb838daf9b80f4ccad71b60687a42c3e6e
SSDEEP 192:EON86hZ0QmiUyMapc/+jVIjzorRV5wOZ23U6:EON86oKpu+68R02MU6
TLSH
T11602D935A86C6C778EE2AE45F48727235FE9212BA9956F94D6E81B1D00C779C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ceae3bc003ee2b80eb0cb9728cb30cd7117267a703c7d81e4970a0ab87902834
MD5 10acd4133964eda3bd6190ea76697441
SHA1 46941668c9476e329858c192bd01e8ff6a7015f4
SHA512 725aef789ac71112c0713ec7032fe16365d7d35b5d21fd36710aaf6352281a0c031d1538944ed0b81cb920f8828c2724dfc363611952b33577ffc25bdf5e6d64
SSDEEP 192:DONu6hZmQmiUy+aLc/+jVIjzorR+XKFuSJrE/5cOqaqfU6:DONu6GCLu+68R+XGxJrEy9XU6
TLSH
T19212FB36A868AC775DD2B651F48732135EE91127EECA7F94D2EC2F1C00DB66C134B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fced810d-de9a-4d1b-89a9-bb8ae8a33c18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fced810d-de9a-4d1b-89a9-bb8ae8a33c18.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 32f68925677c03d76a9d03bd2bdf147bd1a6680a5abfba0a6e306b9da1418845
MD5 9177e8ab2cb6b96e755b54278965e689
SHA1 555ce490deb48e36cd2715bf766a7d379ccaa7ef
SHA512 a8a05643df540cd36c6578ad4f612f0c457ef021c19b19311b541dc9998114ae9434fa062c8d2d5dd677ae4ea9fd765ee0fd61d84b19bb1fdd63e525a325c195
TLSH
T12741EB99B6FD1148B3B76E5AAFF7A86D587A78772A06C45D00110D4F4A32B00C861737
MD5 SHA1 SHA512 TLSH

Submit Download