hxxps://surl[.]li/erkjnj

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://surl.li/erkjnj
Sample260811-qcdy9aep21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3984	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309272078749340"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{1FE52867-94A4-4EE6-A189-A0910F0A0456}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 4228	3156	msedge.exe	83
PID 3156 wrote to memory of 3984	3156	msedge.exe	84
PID 3156 wrote to memory of 752	3156	msedge.exe	85
PID 3156 wrote to memory of 752	3156	msedge.exe	85
PID 3156 wrote to memory of 752	3156	msedge.exe	85
PID 3156 wrote to memory of 4804	3156	msedge.exe	86
PID 3156 wrote to memory of 4804	3156	msedge.exe	86
PID 3156 wrote to memory of 3604	3156	msedge.exe	87
PID 3156 wrote to memory of 3596	3156	msedge.exe	88
PID 3156 wrote to memory of 3604	3156	msedge.exe	87
PID 3156 wrote to memory of 3604	3156	msedge.exe	87
PID 3156 wrote to memory of 3596	3156	msedge.exe	88
PID 3156 wrote to memory of 3596	3156	msedge.exe	88
PID 3156 wrote to memory of 4600	3156	msedge.exe	90
PID 3156 wrote to memory of 4600	3156	msedge.exe	90
PID 3156 wrote to memory of 4600	3156	msedge.exe	90
PID 3156 wrote to memory of 1224	3156	msedge.exe	91
PID 3156 wrote to memory of 1224	3156	msedge.exe	91
PID 3156 wrote to memory of 1224	3156	msedge.exe	91
PID 3156 wrote to memory of 2264	3156	msedge.exe	97
PID 3156 wrote to memory of 2868	3156	msedge.exe	98
PID 3156 wrote to memory of 2264	3156	msedge.exe	97
PID 3156 wrote to memory of 2868	3156	msedge.exe	98
PID 3156 wrote to memory of 4204	3156	msedge.exe	103
PID 3156 wrote to memory of 4324	3156	msedge.exe	110
PID 3156 wrote to memory of 4324	3156	msedge.exe	110
PID 3156 wrote to memory of 4324	3156	msedge.exe	110
PID 3156 wrote to memory of 3952	3156	msedge.exe	115
PID 3156 wrote to memory of 3936	3156	msedge.exe	116
PID 3156 wrote to memory of 3964	3156	msedge.exe	117
PID 3156 wrote to memory of 2864	3156	msedge.exe	119
PID 3156 wrote to memory of 2864	3156	msedge.exe	119
PID 3156 wrote to memory of 4560	3156	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://surl.li/erkjnj
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe71f3c188,0x7ffe71f3c194,0x7ffe71f3c1a0
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,6655809568507561429,10841404336268848246,524288 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,17067000341723415397,12825323328184837087,262144 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,8222452990097239588,6580760026758855031,524288 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,6371119376778975707,6389387969560477258,2097152 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,594856723964534549,1504666689549729361,2097152 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,4068972108118694337,10628786768925607652,2097152 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,13956235556761348085,9461737814594249331,2097152 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,7319340169802116523,17501218251699387869,524288 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,9553646170642948022,8490428340373565557,524288 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,13815513815872288691,5493321129262916642,524288 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,13815513815872288691,5493321129262916642,524288 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4884,i,3369260306112800640,8506726980292315823,2097152 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,17734214614808125777,16819313693266314201,524288 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,13755760355257824408,14942976505355848446,524288 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,685497605628243235,2033648152844858077,524288 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,18244181545820377809,10730441569316229763,524288 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5812,i,2412802276946475272,1336619942262706044,262144 --field-trial-handle=2268,i,12521859467353935503,11399024769670933307,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 15e4c74a9c98805f1f781be6b9ee62ea20655393e9bf39c2931193281c72087a
MD5 57814318271d1d805c1023ce22baee3a
SHA1 29324c3373c42dce9e04938300f6dc7816e9114b
SHA512 e613772a2f342da8acb665c9722b393fbdcf124d1d12e1e4f4d6430d160c8f15dd7079d83d01774925dfb29577a1334b295a805f6953dc0bf74f2781b05d3646
TLSH
T13D715EFE18E30FA5EB21F2705AC10242B13085EBF613ED674D80D7FB6D12731499A158
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 ec0770ba9851903240a79654ffde17bf76230d34db36a08b7825bd44b001ec71
MD5 2bfae09f028479fc78bab47fc3ed8731
SHA1 eaed08a1f9e019517cce486a8b5c875e6f550c7a
SHA512 ab8fb221bed54580354d85c4b66ea7e56b2af36c80c66ca08ba9d0d2f816282f27dbdb9ab3064fcf9404ef1bcc4d7e1bdd66995968d035cf27ef6208ea9a8f77
TLSH
T1FB715DBE18E30FA5EB21F2705AC10242B23081EBF613ED279D80D7FB6D13731899A158
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58654d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58654d.TMP
Size 3KB
SHA256 6d7b53abf54956a6bdd046b7883d461b1a08e1ac1ba34ff6ebf9d1c1fb8dbed4
MD5 c75c069d7cc9fbd70b74bd09659ca567
SHA1 38b6d513c25c643f31b74bfda7a4e66c2890dc41
SHA512 7681e6b78fa69c0d028235f76a83c384abd84be861d98f55ece5182c508fd73e28a91da237c5fe431c1347e63e1c49326b2bb6e43a172e43a317c94a5f55ab5f
TLSH
T17A716EFE18E30FA5EB22F2705AC10242B13081EBF513ED234D90C7FB6D12731899A158
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c74ebc38bc4a5bd0c94b1aa4c6d0ba39dffaf235810c65927e06309f920200b9
MD5 4d4957aa2c0698580d0144429375dfaf
SHA1 acfe12c047aa03e39b9f491e68908b9745563c66
SHA512 ac101c0a75503145ced595b467bdd2db8a0d20de0d62e93dc805fbb8137036027d25f3edb4e6f21ecb185947d1e8acb2b0e6be7c5ce868e3878a93b04b89747d
TLSH
T1CD61DCF7C3D9812DC95252F49B25AF1FCE2D0A18422C3C26C9D9BE5BA3E2431E21575E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 e6532153ffd212da303e9d065cedf48c7f2d12143739e354aa282b5252df94f5
MD5 1ebf050e9361279dc8496dff2cf3c266
SHA1 afac4f6684edb95df7db1d7eada6474d1eba36e3
SHA512 a1e4f01f86c93dff24aeb693fa5fba4a441bade804d27f862f2a994292b0c2171520c2cff07261f8f838e14a1304b1cdfad7a2f207ffb96abd90fbe38dde2f0b
SSDEEP 192:sxZ5lkJ/fAsjICLnIdpJHW6+WNGYIwYhOIg5+J:sxZ5uJ/fAs0CLoJHbG4g
TLSH
T1C422B6126E38A87B8CC6D21DBB55BF53D6F95032A1D41E58EAFC961C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 82fc2e0814c2acfc9c2d7208267b32090be26b9e6a8d73eb3181496f21cc91c9
MD5 7124a4afe8df34f97f21fa5a4dac2f94
SHA1 b61650ef170f130d2cf26f450b938b1454c35755
SHA512 b4be8681d91fb73534951e6f8500cbc48cb4f01495798983dc1a38befac9114026f26273d5e5f6a5ce7116a71d0c905cbc451d53563abe131158b5fc95dd9f97
SSDEEP 192:sxZ5lkJ/fAsjICRCIdpqEb6HW6+WNr4Y/YIxIhOIg5UJ:sxZ5uJ/fAs0CRrcHbT/Z6
TLSH
T1FB32C8126E38A9774CC7E209BA55BF53E2F9503291951E58EAFC961C05E7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 df5ab80b3ff2ac5654666b2ad504c5278060b931cf3ee65295a1fdc539cc479e
MD5 8a77a1d09d2a47118438b3f51b6587b0
SHA1 a381996a7af3e26bc62d4a4a8964b73c524b8853
SHA512 6535d369ba442579237f5fbfde344f7117e429f068a3b2e1c0cb8967a2c75b5bc20804a7bba61e31b790346f51b4a6d58e01786792e85f3ca5aba59b2430377a
SSDEEP 768:pkyqbblWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR7WroJA9:pkyqbblWvJDjTu1jah4LAs7tJQ
TLSH
T10CC2093B654CCA7E4FC00EADDD5A6FDB3E9802C7A6588D4047FA994C02C73EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 38b34325df7ad16a66523f5c0af4b07ec028ddb8838f995e56c9f5144bb519f7
MD5 e5e55385b733060a5b0f84930992a321
SHA1 21e704426d8085d4c9e28099429f19b0524f39fb
SHA512 bc7e1e26164933d0f37b8df2bf15a48c8c6f14eb14cd39b5745b48a1ac02e87cfd34be3eaebf72fb2567f74eae78566a348aa9fe0a0290eaf7f41177c69c7bc1
TLSH
T1F7B022A08B828803CC0C33B820C2C3C8333A0C2C02C202A3E0C0002CF0003C88CB0802
MD5 SHA1 SHA512 TLSH

Submit Download

ddcad716-b5d6-4b2a-bcde-13c1a6d311ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ddcad716-b5d6-4b2a-bcde-13c1a6d311ec.tmp
Size 9KB
SHA256 8fabe6ab807ec437c5f41d6e039bda9454660ba57e935ce544988e981870fbfd
MD5 1eba81f13f33803627a87b65303dd136
SHA1 f099749eefe57dc51dddb59787509292d53daae8
SHA512 ff6485e748165b8fe74cdec9c94be394222fec1894663b7da7ffd81d718a18fdc9a01fd5d8fbca2ada5c491b715e32629e733a139c038da6ca8a116aecab9a40
SSDEEP 192:sxZ5lkJ/fAsyCLnIdpJHW6+WNGYIwYhOIgrJ:sxZ5uJ/fAsyCLoJHbG49
TLSH
T1B722A6126E38A97B8CC6D21DBB157F53D2F95032A1D41E58EAFC961C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2a3b9e07707ec6fd52ce8a4ffca2acbd1ba434205c6309da5ab8c36eb8881579
MD5 996859a64e85fb5347bb74f254a06cc7
SHA1 525f4c088fd58b8a31816eebbfb72b9f7e9466f7
SHA512 a85618570a397ded27023864cedb11e25cb9beb26521320d404a2a94d55386918e9a75f49ebb7a58721e995e145cc1a9a2224cc9dc9b0626c8a002732cf9603d
SSDEEP 192:ukLsNleQqPDkRbL2QmiU1Jet4VRN3OmNOmSC9QjMYSRTqVEU8:xsNle3ubeCiVRN3OKZ9Q4dU8
TLSH
T1413219326C345C774EE2A644F54B32139FF891279A892F94C6ED1F1C06DB69C231AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e0313cf7ef4942bae676215c2ce5fa55d04e46a4906f263d57c765b9a46c9f56
MD5 d41a2001771c75999553bbbf55f15cab
SHA1 cb75fdadbf8b835b92df8210c8bee8d8a12085b1
SHA512 07f46dd9360bbeaf1e8b7b5c63dc52753a706f426189f6264701fcadf6e49ec78d8e3233a5e5222db8ad8c4f05f2df438f3c047ee1037c747e7671618f09aada
SSDEEP 192:tONK6JkRtQmiUy8bW+RN3OmNOmFHh3kROFU6:tONK6UrzW+RN3OKBpRU6
TLSH
T1F602FA357C382C778EF2AE09F98B27135FA4206BE9952F84DAD81B0C01D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1dfc6be21babee7ff9ffdd5f0c54cdfae7e91cb421e9adf827e100a504032f11
MD5 c83377b7b5e53eba2e788a7ac95927a3
SHA1 80c6bcc3e4fdcce856215b0fc60e469ecafcc1e7
SHA512 152f081db2c796e2243090784616cd7acc3d293b0dc0b96b2082d18205cfe7908673ccd0abbce440078979964754e1dfc3735de0ea50390e61776170123c5c77
SSDEEP 384:xZcIgzsNlC3ubemiVRN3OKZ9Q7dOOPrXLpe8C/qV+:Z8cwH3Om9edOi9Px+
TLSH
T170C206F168E71C76D9AEA743A77E2E174EBCC023B1841A44B7985B0CCD8657FD306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 935c369f8e8be7592453a5781bca8ad78780cf4453950b400d72ad5d087fe906
MD5 05ba2778ad6dc2de8cb9da5c1625fa4d
SHA1 f575d08786b420a68b1c54ac897faf035c9ef98a
SHA512 d8eb5a150d2b6c8037410040438f14a1c2439f13bed4a9d14bd7a19b965ef5d8952e754c1b6a66a3c27f524321783049b40c67aa619c035e0582839ef27e635c
SSDEEP 384:4ZcIhsNlC3ubeCiVRN3OKZ9Q4dOOPrXLpe8C/qV+:GhwwH3Om9vdOi9Px+
TLSH
T1F7929E3168385CA75DF6AA45F94B32179FF88027E2C42B8895ECAF0C06DB95C131AC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 add5bb07ade4f716027f44b82ff7af5ae0f6b48b01e40af0553e90d6e73f03f7
MD5 31e940c71df58c0d5d19bf74cccd20e4
SHA1 f7f1d35931d29ea203541667edde9fc4bc495fcf
SHA512 24acf4c5c0ce7f52658c7226c299814f546e96331461a580eba53f003316fd303efd736d632102073e9316f29f67c68e51df444154cb399e19ac452bd148add0
SSDEEP 192:CONA6JkRPQmiUyRb++RN3OmNOmSC9QjM3VcTqVEU6:CONA6UR0++RN3OKZ9Q5dU6
TLSH
T1F1120A3668385C774EE2A945F58B32179FA45127EA893F80D5DC2F1C02DFA9C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9de378b7eb1f47a243e7ae4878ce6390062f9e7333cbd574fc47bc5fdd2928a4
MD5 b56a9f0a1af47b81a2d290515ba62da3
SHA1 502ec96c073af435804bd82020e9dfaf4f9e747d
SHA512 eab785a648ec24d1f0e312319e8e0c35946f63f87bd13755d8bb433a3b6b57f8cfbca3bd9972969af0c0211038d200a529dcbf2a87fcdc52a5aa813af8135b5a
SSDEEP 384:OZcIhsNlj3ubeCiVRN3OKZ9Q4dOOPrXLpe8C/qV+:shhwH3Om9vdOi9Px+
TLSH
T18D929E3169385CA75DF6AA45F94B32178FF88137E2C42B8895ECAF0C06DB95C131AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a52520ff-50c3-4258-805a-0c0bdd28aab5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a52520ff-50c3-4258-805a-0c0bdd28aab5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5e302835213915c080d5d6a07c3efcd7d444f5f63970d0f3c6c80be5a033ce17
MD5 a0e6d3f1acacdc7ae325be3d52edecbf
SHA1 e721a819e62cc98105b5c20f389b656124b7fcb5
SHA512 e723e1b41ddd2aa92c6785cebe6bea2a57abdd49a8ef23f3affa7663cf8351d090058d669959e3c30d4df4afac83c387a15f087ef1eabb702599793a3bc6c009
TLSH
T1AB41075CA6F91148B3B76F5BABF7A86D487FB9372F0AD09D10110E4E0A62B40D861737
MD5 SHA1 SHA512 TLSH

Submit Download