hxxps://dri[.]me/t31nnHh9Yrb8jWfDAUBAxNcGGP6BBW

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dri.me/t31nnHh9Yrb8jWfDAUBAxNcGGP6BBW
Sample260826-eergksgl3z

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2732	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321899003431233"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{32D62D0B-752E-4A4E-A4F5-3867B8FA6B29}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 4972	3864	msedge.exe	85
PID 3864 wrote to memory of 2732	3864	msedge.exe	86
PID 3864 wrote to memory of 4316	3864	msedge.exe	87
PID 3864 wrote to memory of 4316	3864	msedge.exe	87
PID 3864 wrote to memory of 4316	3864	msedge.exe	87
PID 3864 wrote to memory of 3540	3864	msedge.exe	88
PID 3864 wrote to memory of 3540	3864	msedge.exe	88
PID 3864 wrote to memory of 4928	3864	msedge.exe	90
PID 3864 wrote to memory of 4928	3864	msedge.exe	90
PID 3864 wrote to memory of 4928	3864	msedge.exe	90
PID 3864 wrote to memory of 5068	3864	msedge.exe	91
PID 3864 wrote to memory of 5068	3864	msedge.exe	91
PID 3864 wrote to memory of 5068	3864	msedge.exe	91
PID 3864 wrote to memory of 4704	3864	msedge.exe	92
PID 3864 wrote to memory of 4704	3864	msedge.exe	92
PID 3864 wrote to memory of 4704	3864	msedge.exe	92
PID 3864 wrote to memory of 5044	3864	msedge.exe	93
PID 3864 wrote to memory of 5044	3864	msedge.exe	93
PID 3864 wrote to memory of 5044	3864	msedge.exe	93
PID 3864 wrote to memory of 5008	3864	msedge.exe	98
PID 3864 wrote to memory of 5008	3864	msedge.exe	98
PID 3864 wrote to memory of 5008	3864	msedge.exe	98
PID 3864 wrote to memory of 3292	3864	msedge.exe	99
PID 3864 wrote to memory of 1488	3864	msedge.exe	100
PID 3864 wrote to memory of 3292	3864	msedge.exe	99
PID 3864 wrote to memory of 1488	3864	msedge.exe	100
PID 3864 wrote to memory of 1676	3864	msedge.exe	102
PID 3864 wrote to memory of 3804	3864	msedge.exe	111
PID 3864 wrote to memory of 1320	3864	msedge.exe	112
PID 3864 wrote to memory of 4744	3864	msedge.exe	113
PID 3864 wrote to memory of 1076	3864	msedge.exe	115
PID 3864 wrote to memory of 1076	3864	msedge.exe	115
PID 3864 wrote to memory of 4524	3864	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dri.me/t31nnHh9Yrb8jWfDAUBAxNcGGP6BBW
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffcb86bc188,0x7ffcb86bc194,0x7ffcb86bc1a0
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,6103635586246432999,12243899403351785906,524288 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,2794975939337096058,2934389614057364495,262144 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1360,i,12049089701416244481,2397094256256794966,524288 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,4180865452483102262,13001511241465829114,2097152 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,13292664630527966728,6604930463480221284,2097152 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,18171969464295487346,7335397146907016934,2097152 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,13351545869387700463,12701506460725178497,2097152 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5072,i,12749283697149187476,16686637278568302847,2097152 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,16937344660882255412,14616796298254941896,524288 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,12292775438062038647,17006683369048026935,524288 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,10376147312217644306,13589026995222783650,524288 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,10376147312217644306,13589026995222783650,524288 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,13501602876888659311,17966514360633168520,524288 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,5113636238929347091,16681831942869878185,524288 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,6066038108935150630,16190792675232084630,524288 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,1068415555323081423,7143172028224326205,524288 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6284,i,13736627815236134053,5516768558821814697,262144 --field-trial-handle=2276,i,1359161332513409310,5535702382600746959,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 285KB
SHA256 38a8ebc24acd4a54c157c9e805896b50960ac6d9a09da62e8569eaeb0eb25be7
MD5 eb03c2c82ad4f2e7be681568125936ae
SHA1 2a8a660f36f3c96f04b2a903562848ed8956a15a
SHA512 10b477b298297d43d571c6375930db3e3983d739e55e9a25e5d38a21d0c37be87ca890a4f763b0b8a45328037b1cf6e40d0eef190132c147ccd459a76f58e37c
SSDEEP 6144:ZklTvdRApHlhaX1xxYXaiYfRoD5Lw28uNviIWYZX1PNlF9nu/Mk:Zklr0pFoh0ioFLwHNWjPNllk
TLSH
T10454235B93CB013761DB0534966220D09C52FFCA6791B03D9BB98FA8D766BAFC423874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 82ab8904eda8d579f2cf5dcedb9f62ec334de15f4f3d71d88c57ef5165fb01d0
MD5 e9ff4aad019b9c56a0d4c475a0da06a9
SHA1 387464bc9590b81fc2b1743e34db99db5c868be6
SHA512 2894c97dadb3250992d0522992747197b3046499a484a7b2f1b6b378a8ed25b5469e9363ed2117f9b2e9e22c16cb47a83954474cae95c287add89755437e031d
SSDEEP 96:1moWUNGDshi8+UGJNA5u/uZ+ceirv2/HEsoqh1:Qoz5hi8GJNA5k//ksBL
TLSH
T1C1C13D0C001DA8E1D3913DB4F4E1A11472B8A1BE37BFBED1613084BEE715FB262158C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59232e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59232e.TMP
Size 3KB
SHA256 b66b43a7a4ac8c208c9f356fa269961376f5a659cd6eca46492c82d757af4f92
MD5 30c25aca7d41994a5f661e4099bcff0b
SHA1 374d52981839c30b72f902c28dbcbac743cfebb6
SHA512 3f4a3b28b0e3ca1fc037fbd71daa618f4883fbffc1bf9ca1cb5cea25082131bde3ad9031d94f00cd68945b3823df62efd34f1a19c016635d6883aa4fb96d2b58
TLSH
T10C71270C0112CCD1E3E256F1C0F2F245B4B0B26F3B779AA12274C5BC6519F726769C0A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 b0519c7cd798ce8e905ce3db6c2aa69a58a5c83e4aea5cad06526d5edc463801
MD5 f94a54d32873666ab3ab339f95ccf8cb
SHA1 e53361b40eeea7aff4ffb2e49f3297fda854df00
SHA512 d1eef6c44258c6ad876d673c28b535dd4df15cab4ac9b93d9f119c66215417b566337b89463734c8673e45193118ac6bb4d11869250db851325283e0e7cb6269
SSDEEP 96:D3QOupu1uMuduw+uUyHzBuxIuduZuRquauAuRIuRUUuBwauVmfubsu7uDNud:D3rak9o2hyH1wIckQqvdQIQUUujFrwsk
TLSH
T13AB18BF683E8D65D991216F5AA163F2FCE1D091447283D3AC9E5AF4F93E2470E204A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 099b04cdf5df0c5c3bf5bff0cece0a091bcf3a9b63c8bad891069192441dc906
MD5 63ad731f47627fbfdb8aaa0f306684a6
SHA1 cbbf89b4da4b9c15729bb40b5069b13353bbf415
SHA512 e8c970456790c7ce2864d8d24c2fdc908d7771836455cce8d33e610789d2cace32e34f99cd1e4793bf8b9618ad48d8adfb24be307690bcb9c56b1bbb8776cb59
SSDEEP 192:sxZKoRYyM/jK1Ml8MkB/fJsiqiIdpCz9XHW6+WNVcA/YLVTJ+hIgrJ:sxZKoWMB/fJsiqLqHb9/uM9
TLSH
T10E52EA116A386E77CCDBD20DFA55BB53D6F50472A2900E48AAFCD91C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 38eef2c1cd919e60283ef6c1ac28396653c6cfcffa29cfc49f7e377933b310f0
MD5 29fd83dc95ed0471ae1b368badfef21f
SHA1 57bfd685af13ea2716a519daaa9372711acbfc98
SHA512 0bf5d5e3aabe52315c81f8660184d72412134f095448f7dd97a234e15ee15b0d16a2a45d5a4076a8f8e4c673d332850db4b57bc5389561d08679063fd43c9727
SSDEEP 192:sxZKoRYyM/jK1Ml8UQskB/fJsFIiIdpAz9XHW6+WNVtCdYLje3+hIg5CkJ:sxZKoWq3B/fJsFIL0Hb6dNM4o
TLSH
T1B052FA11AA345E77CCD7D20DFA45BB53E6F50472A6900E48A9FCCA1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 732ce4acd5803a3977be6cb323ea60a99be32f587740e7f441105f28c11b1f9f
MD5 5e60e1a551a003e6bd4352dbd05a164a
SHA1 4667dcd23948b3ef249c5be60f5db060510b2a05
SHA512 1f79fc2f746b6b853a68ffddd39e45b4a3fee0de8cecf3359233c22f9cca7a47bb56ef358f2514f4f1259bf64f03644c5daa9cbbcd4922c4667e6ad66ba6e115
SSDEEP 768:Xfs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNQroJG+:Xfs6pD1WvxzWju1jahILIsN7JG+
TLSH
T1C1D2FA3B680CCB7E4F841E5CEC2AAE977DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 5KB
SHA256 f640ea763fe9c65819c617dd0cef4e0912da030408de3800903433c527248c61
MD5 860671273346ab4b30f1a3a95b0f1d9e
SHA1 288dee2dc9a2a8eb5b149e2f85207b907e4c1171
SHA512 4b1951b23c907cfae16e559033b47e89d9e437a73f9a1a9e2c5fb82800cd011fb0104894647a7b3e46b412f6ca1d5d082e71df7312fc617178723e1512e38c0d
SSDEEP 96:xf/fmks4k+ByD5ylEX+Z3vLLVtNVJIgHBnQHDJX6KR1OLdQcFk+l+OqS6zR/:xHfB8Db+JzLXNVJvHBQdqKR8RFk+FqtJ
TLSH
T1E4C129DA17B52071CB8396F497CAD0993F79909727DAE081F58E84250FC3B9443B5DCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1
Size 3KB
SHA256 c7524b8d2f8fbc1b66b0f91768eaa7b77de129c6fd3648fb57de403f9d5d0d92
MD5 c19f426038a0283c530e2e809af1420c
SHA1 b70677dd39a68486fd3a4acc03978f8d08bd818a
SHA512 44b75eb2112067380536b0d3ce361a509cd5125954619905d7a2b9007896580325d45629fe590f41821b02cc310735061c27971c9b64a472c075803e6a4e4b5a
TLSH
T19971C64283E1791AEE7607F59591022BB737A545BF83E21B0665B3303CA23B3AC8A815
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 1b1a61d79a333df3a85ad224fe3b7a031e18c33c1d2e179132b3b7878f15e96d
MD5 9eb0c5f6b67bd63e9341700485fc8629
SHA1 9421127e2e826679e3d99c35c46c12632fadc9df
SHA512 425be794569de77080523296af524ab761f0210b7ed84d83ec6b600389efc04884f2ac4d8d966b0e547cef8b81360bb0c929ffd858d1d646d077941cd660f673
TLSH
T1AAA0022ED15402CEC46082F0A45213E42261DC2006063212CAAC10A4F95135047630C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d8c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d8c7.TMP
Size 48B
SHA256 c6941f14a7b10555f015038596e10760946d4487605537952f24f291cdb8d39f
MD5 d3250744419305d456ede0196f8b460a
SHA1 6c0ce56b0612ae9a3649913bb3f272ee9001d34e
SHA512 b526a7f00cc9a6ca46bef998c6c2ec4250be897691899c6a6bed5e9ee67f870cdc27bc6a185b9ee3b9195dd70175750bc15889ffd7f688dabc7fdfaa8c0efd3e
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 5aea9bcb0b865be8fb3f235e4496d34b54613b5248907fe61ca2297fc45940cb
MD5 6d29fab18ce3063d0791bcdd865e6c65
SHA1 e1816e74d0b1a6506051419b80f5d6dcd1238807
SHA512 efd7c1f38c00dc23ed56b68771144b5e536c8cd824d16ec1e7c826d9188037cc1a718fe25caaec44e8873fe9e8a3917fa1212cb0cab1b712345062f3141809cf
SSDEEP 96:KUAAKtePONWKuYKaq4KHqQhyKiQCWByKCkRZ:ii9J3aJxy
TLSH
T1B8E1001232BB03123D3E691D9359876B6F4276A33458F42B37A810B60E66E344DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596671.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596671.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 db1da4648ac492d1074af4dc2340424dc5f64ae7655cc68afb23d42db3f56d52
MD5 e05dcd8641f86e75e355211d15e03d5b
SHA1 0f200e044c75a74598984f29b15ad7d18a7d2c4b
SHA512 c43f11fbb158ced8bc54d82ce53824162feb7f62b45830ed4d3dc5228ca723e1aa91d8fe9771780b1f35db9ba6ebed61d62387fe790278ec4f9ec4eb7d64fb10
SSDEEP 384:5ZcIhsNJUqsonfa9ndQcM2r+HBbsm4iom:RhMyRGmrgUiF
TLSH
T16D827E715C78ACB75DF3E146FA8735034FB881779AC92F84D4ECAB1D00EA5A8131B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 da4e7901da61368b87b619bb76e18eecebebc1a6cef766aaa150a3ece4697343
MD5 653a0263ea95f420b08835fec46d9a13
SHA1 7016f71cce5ac2f621ba0d0f3a25fc357c8c8a0b
SHA512 ad284c2a363a47f72601672b14b4a7789b1f3607f8ee9eb4fb8e0b95774b3493ec27da51061c8891d8f224ab7d808d8d4c2a55b353b7a4ef361da5e89591fa89
SSDEEP 384:0ZcIhsNJUfsonfa9ndQcM2r+HBbsm4iom:yhdyRGmrgUiF
TLSH
T1A9827E715C78ACB75DF3E146FA8735034FB880379AC92F44D5ECAB1D00EA6A8131B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1027f73729c81694738e8bec139a879e8c708bd295161d14fd10a9570ef84db3
MD5 fc6742df1368b4d5cb48c6d9f665299e
SHA1 b78c15c42d4071b37e612b437ecb92bacfb5722e
SHA512 f61a5afd148eb1824bde2187334ff6ce21d82e034da16728f3cb534c96570732b4194cac9e0802a322ced430371308bcf4ce5ed7dac347f8925a0afe3ceb9ecb
SSDEEP 384:UiFiZcIdsNq8TUNTUlIlfsotfa9ndQcMtr+HBbsm4iom:vFQd7wgjyRGdrgUiF
TLSH
T197C218F248D79876D9AE9743E77E2D034EBCC063B9856A40B3D8590DCC961BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ab5f1a697665b49e6ff8eed03e81ed709c4230a660817b9d13d1a6aa6c798468
MD5 588e08855a27a14bee4c8277b2647235
SHA1 c85a31eb355d227cc9961e853a3ae1e7c6f61370
SHA512 0e0886489a9710efc2f4c1720c179124a752ad605a15254a7e2c9fbf2ffe18eefa98eb01eb82dda10c2d841651c6e575df25b41ca4b3264c5a0bb6b82c400df7
SSDEEP 192:qONa6O7+3hQmiUyKeGttb0h+FdPougGhCU6:qONa61AGt9ndQw4U6
TLSH
T1CC02D7396C786CB78EF2AD46F68736175FA8117BE9962B80D6F84E0C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f7d711e297683ebe6032d0e28c339d339c963a461175f6c5d8266d5bdabd6fd1
MD5 acc41fa227949de7f6d281f8ab61eb3b
SHA1 a8b9a5fe172eb0a43943c3475d0fae4db8ac83c3
SHA512 36587639088b875d44badbdec8c5fe0e1843cad481442e54f5b9bd39fcecc84a7a278d693a2d1eed4e57c0735a9d276b1359f5694e2886dd981afdbb31260a42
SSDEEP 192:hONL6O7+3ZQmiUyBe9ttb0h+FdPoYRh2v4cNSrqmQU6:hONL6hJ9t9ndQcMxrU6
TLSH
T16312F8356868AC7B5EE3A445F5C735139FA54137EE8A3F80D5EC5E1C00EB66C234A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7ddd4a7b8bf6b28c59ff9b745afde0474250f9731a68798f48f03f006b7e90a9
MD5 a13b96498d891cb1dd16a3bbb7535a85
SHA1 3e357dbbb61051ac432e3aa48340dfab74405bf3
SHA512 611d1f75b128d8de2fc7c3634bb1123128c18695812e90a16e932731bdace02c06c73ac739c01f49eaa732e3269de594a6937d991e41d17e19e7224291c89882
TLSH
T1A641FC59B6FD1148F3B76E56ABF6686E987F78362E0AD55E00010E4F0662B40C872737
MD5 SHA1 SHA512 TLSH

Submit Download