hxxp://maestro-trk[.]bloodhorse[.]com/trk/click?ref=zqoqmnmb8_1-9520x315fcbx057981&

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/08/2026, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://maestro-trk.bloodhorse.com/trk/click?ref=zqoqmnmb8_1-9520x315fcbx057981&
Sample260828-awkcda1ygw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3624	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323508336148599"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{54AADD16-E336-49EA-966B-A93B40829BF9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 3808	5856	msedge.exe	80
PID 5856 wrote to memory of 3624	5856	msedge.exe	81
PID 5856 wrote to memory of 4120	5856	msedge.exe	82
PID 5856 wrote to memory of 4120	5856	msedge.exe	82
PID 5856 wrote to memory of 4120	5856	msedge.exe	82
PID 5856 wrote to memory of 4212	5856	msedge.exe	83
PID 5856 wrote to memory of 4212	5856	msedge.exe	83
PID 5856 wrote to memory of 5132	5856	msedge.exe	84
PID 5856 wrote to memory of 5132	5856	msedge.exe	84
PID 5856 wrote to memory of 5584	5856	msedge.exe	85
PID 5856 wrote to memory of 5132	5856	msedge.exe	84
PID 5856 wrote to memory of 5584	5856	msedge.exe	85
PID 5856 wrote to memory of 5584	5856	msedge.exe	85
PID 5856 wrote to memory of 3904	5856	msedge.exe	88
PID 5856 wrote to memory of 3972	5856	msedge.exe	89
PID 5856 wrote to memory of 3904	5856	msedge.exe	88
PID 5856 wrote to memory of 3972	5856	msedge.exe	89
PID 5856 wrote to memory of 2884	5856	msedge.exe	91
PID 5856 wrote to memory of 2324	5856	msedge.exe	92
PID 2324 wrote to memory of 5612	2324	msedge.exe	93
PID 5856 wrote to memory of 5472	5856	msedge.exe	96
PID 5856 wrote to memory of 5472	5856	msedge.exe	96
PID 5856 wrote to memory of 5472	5856	msedge.exe	96
PID 5856 wrote to memory of 444	5856	msedge.exe	97
PID 5856 wrote to memory of 768	5856	msedge.exe	98
PID 5856 wrote to memory of 5208	5856	msedge.exe	99
PID 5856 wrote to memory of 4664	5856	msedge.exe	100
PID 5856 wrote to memory of 4664	5856	msedge.exe	100
PID 5856 wrote to memory of 3296	5856	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://maestro-trk.bloodhorse.com/trk/click?ref=zqoqmnmb8_1-9520x315fcbx057981&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffbda6ec188,0x7ffbda6ec194,0x7ffbda6ec1a0
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,10373308626256229922,15700550376165516999,524288 --field-trial-handle=2132,i,3561118665674872975,6813312558424918179,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,14485122065694769515,8951723056373220652,262144 --field-trial-handle=2132,i,3561118665674872975,6813312558424918179,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,14094342723088426575,12454768656033602523,524288 --field-trial-handle=2132,i,3561118665674872975,6813312558424918179,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:13
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,9963852962680833196,4727105011065773798,2097152 --field-trial-handle=2132,i,3561118665674872975,6813312558424918179,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,9816107952257428543,6699586967345662494,2097152 --field-trial-handle=2132,i,3561118665674872975,6813312558424918179,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,6037343483467384097,4999231321346627695,524288 --field-trial-handle=2132,i,3561118665674872975,6813312558424918179,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,11506859680008808925,1718457382585119736,524288 --field-trial-handle=2132,i,3561118665674872975,6813312558424918179,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,9614470707110563322,11937440847055836401,524288 --field-trial-handle=2132,i,3561118665674872975,6813312558424918179,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,9614470707110563322,11937440847055836401,524288 --field-trial-handle=2132,i,3561118665674872975,6813312558424918179,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,2867598903647559534,733561211759411960,524288 --field-trial-handle=2132,i,3561118665674872975,6813312558424918179,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4928,i,16450821222336849970,933424058736920537,2097152 --field-trial-handle=2132,i,3561118665674872975,6813312558424918179,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,9770504951160572330,8464795894420372321,524288 --field-trial-handle=2132,i,3561118665674872975,6813312558424918179,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=124,i,2234518172978249945,9567019365584747102,524288 --field-trial-handle=2132,i,3561118665674872975,6813312558424918179,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:14
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,187870824910980658,9430537258031888974,524288 --field-trial-handle=2132,i,3561118665674872975,6813312558424918179,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,13983381644174811282,16078852791815589760,524288 --field-trial-handle=2132,i,3561118665674872975,6813312558424918179,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,13084139798857794014,16297347352386385835,262144 --field-trial-handle=2132,i,3561118665674872975,6813312558424918179,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 87ba13f6cab10a56b1930a69806d5fb9830b9dd65127df62106b75bdd4945940
MD5 eae4c37a78ada441386cffba90356e21
SHA1 43ee931de39dd2335d8e96c23202d3140a66f865
SHA512 856a640b238d7fa6af5152bef1cfca132f45d7f98f1c7b907204fb7bde9d9690939748fe609a2f0c049020302f8c3959490940412b49e4152afcdc6697cc98db
TLSH
T1E2E02BAADC30EC2714F94B2DE4950B87EB5013971681845F3B3E850C8FF173A0289C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f228936cd1d38e7a1f11d6d188caecadb70f13e4361165beaa34e136790bd9ff
MD5 1798f3287de7064868ac0bdc8a3fe08b
SHA1 395b8067afc6baa3373a0f019165e2c4fe4b237f
SHA512 558dbf3dab600012e6810bf27f09fcff6c62741900bd2ef94faca54425774eb62a6361f436432f2a3f93cd57ec0c6fa1828ffd36109b70e8b2b1d179416742c8
TLSH
T14E81F92D06917703EF2C163DA0E5193C7872A05B399B3F2221B078B1A42B76CE94EFD4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d1c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d1c2.TMP
Size 3KB
SHA256 d7cfbf0deed680d5ededa7ebccc699b879428660863b6ef713c00411f19732a3
MD5 896382d77ae7676775aa12cae9e3c6c3
SHA1 9ac33f9b26855b0a265f5fcd747fd0bf9b6fc20e
SHA512 7d81e8bfaa1c0ce83545f5dac25d737778beb5a330a826717c75410c480f9c40163d0e33075b799c0599e2f6ab9aeb516adc1a5b87f4824431098000372d09b7
TLSH
T15E712B1D01917703EF2C163DA0D4253871B2A85B3A973F6321B0B875542BBADC91EFC8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 da8e5c629c87c1b1d6225610e5d658578834e0181585fcfebbdbefc3108098cf
MD5 c00265ac3080b40dcc3558e36ad6e519
SHA1 83489a85522c46ee66c7471098d8594e2e8491dc
SHA512 15c52201b71d52af0fd061ae99aa3700b50f7a950dd1695092c0f8a943445b47a99d2aaf9fba3d5eaa107690db32ccdcbae842bd7d2cc7d35b25f4125ba77114
SSDEEP 192:D1LSe78S4e4uaaij69IG73KOJ4urs7XWEev3V8FgZW335OFOPgXT:D1LSe78S4e4uaaiG9IG73KOJ4urs7XWZ
TLSH
T117D18DF783E4862EC81152F097147E2BCD190524972D3D1BC6D9EE9BE3D6476E140A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1ab8e5303d2a1470f4ce39e43ab2bcfa5c63c4a342138582072b2250b2c3830f
MD5 f96eb328049ad71814cb20fb2173bac0
SHA1 68dfc9a0543ded32a574d1bec2c5e47ab47f2d29
SHA512 99c18387975a969560ce35238468e0f8063cf7ef9545278aad2b9eb70ca740427e42fc56abc15bdb0f9e4c3f032f761df1b9447f550c000481aa7371db533118
SSDEEP 192:sxZ0R9yMqZjK1Ml8UQBFy/f2seGE0CXUrzodpLy9/3hk6+WNThpG/Y0d24zorIgL:sxZ0GqHy/f2seJ0LwLq/3PTO/5xu+C
TLSH
T1F47209156A349A7B8CDBD219FA44BF93D3F9156391514E44A9FCCE1C00E7AED210782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 50e34afa249f6d5f6ee6a13b3bd7222070e1b09ac9cff2d7e04bae5039338d85
MD5 e5145c8e389462be9f4ef658b0ffeb14
SHA1 6957a834d97676efcf8b8fbf6d22668850234ecf
SHA512 70070b1b17257d4bcd243712d9da02593a1da28f93d572777060f9979be04022cc23637540043fae07036086879d98f5523684b337bca413f83568e5d80c2134
SSDEEP 192:sxZ0R9yMqZjK1Ml8MFy/f2s8l0xE0CXUnzodpLy9/3hk6+WNThpG/Y0dqCnorIg+:sxZ0+dy/f2s8l060LsLq/3PTO/5FujC
TLSH
T10A6209156A385A778CDBD219FA45BF93D3F9156392904E44A9FCCE1C00E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9ccdadb3a910e3d30a01eb0ffc2785b7d747a4691544f987fdfdb23355e0f9bb
MD5 23e66a4d688432e532016bf097212c88
SHA1 bbc73e20fa87f8116a1f3454c6397ecf0f67a3d7
SHA512 04c6d24f173ffc5c9cdcca7447fac24c05af5b46e499c275d6777211532e9874a019a3f7c993a6b224b85b2dc20d055be85fce255d4447f323b856ee68f88fee
SSDEEP 192:sxZ0R9yMqZjK1Ml8MFy/f2se0xE0CXUrzodpLy9/3hk6+WNThpG/Y0dq4norIg5l:sxZ0Gdy/f2se060LwLq/3PTO/5pu+C
TLSH
T1DB620905AA345A7B8CDBD219FA44BF93D3F9156392514E44A6FCCE1C00E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 203cce1c4bb7086bf045d43912169a83adc65717c7b46dd51e88ab586e835b9e
MD5 c9821a650e1491ab2fab27fefc745a82
SHA1 3ea8a2b8ff01a01991c000fb740f506901f57279
SHA512 ec28c1925e34ca9914b2b22b4d8ebdbc04e95fecb3a0206730cad06b2a23429bff4d7e4a301a29b943a6e02bb5e5710113a1d59e8c719f29fe83597336591358
SSDEEP 768:ciWKy8Eq2+dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1A:ciWKy8Eq2+dWRm5rQW7u1jaKTQLpCFsy
TLSH
T117E21A2B280CCB7E4F841E5CEC266F966EE8018B66A84D5447FA494C03C77EB511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 4dbd9a4a403f4b4d33e36ea3de2b7fc6f54ecf873928cc8e1a6095e5681b1910
MD5 4039f38a97760e9273ddfc6da26425d9
SHA1 7a7c15f299ba7b43bfd565ccb4ddcacf8b5f2f9d
SHA512 835d10af87526eba024a119ee9a41e91c89f4f9182246dc4e049112b3712ebfc9c1f419ff345691d8dcd38b75d209b620aa5a87bd96abe58766837e790361f5e
TLSH
T107A002201B905001D5800E7920C127426768CC600156731348B10448CFA11D09E21100
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3e6da4dcde7015be0462833365efd92ed1c3bfa13629aeddbe8360bebdbbe287
MD5 df45545c25060239f9213773d62cd3c1
SHA1 fdabe995eae3b71f829188aa71d4c6386656106a
SHA512 da38d840f6d95e79088b9cf3cc35cbb080dbd9efe16da984b970c21263a225ab5d2c4b8cd3bfe07217153b0d9664d47b791f630d1604fc70dd544ce183f05892
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7GxF:AFBHhTofhno2mB21q3Llbfe3sLDdeEpM
TLSH
T14DB27F56717B12023C3E290CA7929B370E4272A33458A56F7BB900BA4E67E615DFCDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9660817e9470bac2790bc8685bcdaf90874cabd7bd170d3342fe189ccd919bbd
MD5 7d30bb6c67143f45c9271e4d8bc04cce
SHA1 99bfd15a2a469a2176e2a47cc4b2ea3faec988fe
SHA512 d74c0923fc29a5d257180cbf3b32e586f0f5ac84258706dfb158d40468f1ffc88fedd49f28e0dc48242521dd60b1590a8110964266034fff6c64e29747a3dbcf
SSDEEP 384:n5EiF9CcmyWCs38N18TUNTUlIxBydgs0jkpfb7oV9Ph7OSmdlyNhkP+lFYS/TsH8:JFccps3awg2pJoPMcNhkoFYS/r
TLSH
T1C9C24B32EC98C9B7ECD74EE9E64A7903DEE041A3868C9AD4DAC81D5D00DB1AD570BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 293785a6f9a75d8936719bbb488fcc5ad9e26c7fae77f5875bd5140a510ec295
MD5 2c4815a7ae3780f3bef7d255e022dab5
SHA1 a5a228016ec292766d1ecb051b6725c5ebd768a7
SHA512 f334c3edad02bedcb38ba35afc383e67b4e936c4bc37d3519e5b5ac1bb8cd0179e6cadf47631f65dfc97c4da9f0fcbbb3ece7387a9875a1485b2d9e65833f9d5
SSDEEP 384:n4iF0ZcIy38Nh8TUNTUlIRey7tHjkpfb7oV9Ph7OSmdl5N+HBbsKBk6Hy/7IgboB:DFyy3Kwg7gJoPM3NgtkP2
TLSH
T189E2B4F298D789B7E8AE4B97A77E2D0299FCC153B5489584B7C45D0CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1ad282490c372c9b0faa7d5dda4cb8a81fb04610d31aa6c98b58286d27bf4b99
MD5 f7a0c7889253f80e7faa776cb687b527
SHA1 56a1647b09a8e60dd564f03f86967a188e30865a
SHA512 7d85c2ca20a15a773ca3ceb5f1b4e0dcdc177f3505030bc191d752ee470a05bd6b7de0d64db3ea75286644d8682ee9fc3cb3daa4c0d5bef913a94e07a3b51a2b
SSDEEP 384:n5LiF0ZcIp38Nh8TUNTUlIRey7zHjkpfb7oV9Ph7OSmdlqN+HBbsKBk6Hy/7Igb2:QFyp3KwgJgJoPM4NgtkP2
TLSH
T1C0C24B32DCA8C9B7ECE68E96F74A7A03DEE44193868C9AC4D5D86D5D009B1ED130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3b44e79e48953935a32f197e17574cde46d80abb94a2fb6ff35936b186fe95c4
MD5 1b39d7e170ec09cd6cf0e40c69ea07c1
SHA1 6750e577f18fa691d785d86a66b06265caa05910
SHA512 34e45bc3e4c55ba15196185c1dcb38d8493b47b0bfee5b4c23105272d259d27c5f5b19279e0b278c42feb4ce2a2160dc3d68173d285274aae0772738814f6121
SSDEEP 384:nkiF0ZcIp38Nh8TUNTUlIRey7zHjkpfb7oV9Ph7OSmdlqN+HBbsKBk6Hy/7IgboB:/Fyp3KwgJgJoPM4NgtkP2
TLSH
T1EBC24B32DCA8C9B7ECE68E96F74A7A03DEE44193868C9AC4D5D86D5D009B1ED130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2e9b12058ca88e4400f224fac7ca9f7ef9feae8a43c692f0ebdf0e0d80b1d492
MD5 b94da691b3985db0e8cca1549cdb25c2
SHA1 b5011b4aa2d7cecc014784a358c59163e0b6c014
SHA512 0a5ea376eff9b8142e32ae2f82c98ab13cb198dd9f405043cbe19686bf6c655f49a9f13e0bd33e6b004bebe8f1158d5a8ce812117bff8141b50a03acb89abf10
SSDEEP 384:n58iF9CcmyWCs38NzA8TUNTUlIxBydv5otajkpfb7oV9Ph7OSmdnuhkP+lFYS/Tn:xFccps3CAwg0O7JoPMnuhkoFYS/r
TLSH
T134C24A32ECA8C9B7ECE74FD9E74A7A06DEE011A3818896D4DAD81D5D00DB29D130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c9143764f4fa85497062b78d958a9b6738152731563dc30f4814baee8efd7e66
MD5 88388ca5e2ab20102ed6421487726150
SHA1 7335c4eaace185f0b9fa6263c488d9db7b6c42ac
SHA512 bd05d28c3c064757b8aa6bc0c0f9aa73865ab1e84a750a2b547126cc7d59acd848408a791085328db0e628b9328e3cf4ec3876ae4f4254ba1d4e84a232124fd5
SSDEEP 384:n5LiF9CcmyWCq38Nh8TUNTUlIR6yOzHjkpfb7oV9Ph7OSmdlAN5IHy/7Ig+:QFccpq3KwgqgJoPM2Na
TLSH
T179C22932DCA8CAB7ECE65E99F74A7903DEE04193868C9AD4DAD85D5C00DB19D130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2884-307-0x000001E9A4E90000-0x000001E9A5E90000-memory.dmp

Download