hxxps://track[.]pstmrk[.]it/3s/app[.]fcmtravel[.]com/_o9J/r_PHAQ/AQ/16b7e3f9-eb7e-4c95-b7de-83671a80969d/1/xp6P-PcdmN

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://track.pstmrk.it/3s/app.fcmtravel.com/_o9J/r_PHAQ/AQ/16b7e3f9-eb7e-4c95-b7de-83671a80969d/1/xp6P-PcdmN
Sample260907-qlcgsaap2v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
916	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332608449704586"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{EE7E7C3C-B24E-4981-817F-1459E694EE6B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
864	msedge.exe
864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 4060	312	msedge.exe	84
PID 312 wrote to memory of 916	312	msedge.exe	85
PID 312 wrote to memory of 468	312	msedge.exe	87
PID 312 wrote to memory of 468	312	msedge.exe	87
PID 312 wrote to memory of 1764	312	msedge.exe	86
PID 312 wrote to memory of 1764	312	msedge.exe	86
PID 312 wrote to memory of 1764	312	msedge.exe	86
PID 312 wrote to memory of 4216	312	msedge.exe	90
PID 312 wrote to memory of 4216	312	msedge.exe	90
PID 312 wrote to memory of 4216	312	msedge.exe	90
PID 312 wrote to memory of 4996	312	msedge.exe	89
PID 312 wrote to memory of 4996	312	msedge.exe	89
PID 312 wrote to memory of 4996	312	msedge.exe	89
PID 312 wrote to memory of 4820	312	msedge.exe	92
PID 312 wrote to memory of 4820	312	msedge.exe	92
PID 312 wrote to memory of 4820	312	msedge.exe	92
PID 312 wrote to memory of 2092	312	msedge.exe	91
PID 312 wrote to memory of 2092	312	msedge.exe	91
PID 312 wrote to memory of 2092	312	msedge.exe	91
PID 312 wrote to memory of 1900	312	msedge.exe	99
PID 312 wrote to memory of 1900	312	msedge.exe	99
PID 312 wrote to memory of 1900	312	msedge.exe	99
PID 312 wrote to memory of 4924	312	msedge.exe	101
PID 312 wrote to memory of 1784	312	msedge.exe	102
PID 312 wrote to memory of 4924	312	msedge.exe	101
PID 312 wrote to memory of 1784	312	msedge.exe	102
PID 312 wrote to memory of 3004	312	msedge.exe	104
PID 312 wrote to memory of 2904	312	msedge.exe	107
PID 312 wrote to memory of 3860	312	msedge.exe	108
PID 312 wrote to memory of 2348	312	msedge.exe	109
PID 312 wrote to memory of 1560	312	msedge.exe	122
PID 312 wrote to memory of 1560	312	msedge.exe	122
PID 312 wrote to memory of 864	312	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://track.pstmrk.it/3s/app.fcmtravel.com/_o9J/r_PHAQ/AQ/16b7e3f9-eb7e-4c95-b7de-83671a80969d/1/xp6P-PcdmN
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffaf62ec188,0x7ffaf62ec194,0x7ffaf62ec1a0
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,11079088850495608029,15528704981675831277,524288 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:3
  2⤵
  - System Time Discovery
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,18185925648976543713,8950501255341230593,262144 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:2
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,15824513370826488398,7025723401743415881,524288 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,16680793590409238570,12949792171641785473,2097152 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,7204849760340060828,17470380289628566251,2097152 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,759143391224740000,3319585664072998243,2097152 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,2269233650153158386,13611070123599594715,2097152 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5004,i,6440606402941753173,10798597007243453458,2097152 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,2362907376135712296,16380351284820237372,524288 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,16123522331282526597,2747762478535758050,524288 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,672317950962414064,16632832401788357123,524288 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,672317950962414064,16632832401788357123,524288 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,14749358908042168527,5581792674972645507,524288 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,15916893870649566336,6876597524561522438,524288 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,2970790847638986473,12613888622382401573,524288 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,64941884453041703,11199895735785366343,524288 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6168,i,1745360576133651989,8087316474844865938,262144 --field-trial-handle=2884,i,16465089945440743025,622518676920923435,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8cae76a4ae3853d3119021a5fac5c1c2eb4a9b71c96011f4d1159a1b10d2cd36
MD5 8725e2f5ccbb5a0bbf5a42667ce32c95
SHA1 3ab89ecfe10c0a4e1bcbc0a9d9c9d7a4fb21df09
SHA512 aa3334f13f2ef2827186c2544915e032e28a408858fec461dd10087ae1ca126aa9a61b0fb2dc08b9097f6f7ddc2ea74d4622d4aceefea3c730f4a8401f22e564
TLSH
T1BA81A39C219F3D69E75AE2F3F7C25B0378314195441F8EC3118AC47EA82676CC531C19
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9c61005b8d5fc22dea42e4586bffd2590b603d230d02f271f0c9d45ee596bcf4
MD5 5c918678825a675076c9e116a1a09a37
SHA1 c5a6badf6f821aad6873f9696872e42b932725d7
SHA512 3d78e19e4c02757456204ae817db650168be8f0b475d2570b0990f89d77624a47b86bd53dbc08836f5807b0f1c875b4828ec7a5dfd133e2cc8cb3b87e3f4f4ba
SSDEEP 96:DXO/Qcdx6gzBuuwkbG0CowUEJ1waU2boPwBE:D+ocdx6g1uuwky0CowUEzwaXEPkE
TLSH
T1D5918AF3C3F58B6E890156F19A15AE1ACE1D0A19821C3D198DD5BE47DBD3072E601B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4ef541b632457cda414ca019d3dbb7536a605163f234e1e0e971176dd40a5eb7
MD5 a0e5247179442a635da26e94e63ebb81
SHA1 cbe268ceb9d6c663b3deaf2a1369ace44eee5afb
SHA512 db7b6c29f7b9710e8a59a455d9192403678aae48c3933071174879ce62a7c38c686d7763b3f24cd12a9c9d5d471aa027968f414f566a79280694d72cbaf4d1b8
SSDEEP 192:sxZvREk//fjsZuoIdpCEHW6+WN0/0/Y4/uHxZIgrJ:sxZvJ//fjsZuZLHb//OP9
TLSH
T14222C7526E78A9778CCBD20DBA15BF53E6F94032A1D11E58A6FC861C05E7BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3d45613cd1521c6acfd598cd93ebab2366f65987860da481b9c71e8561816e07
MD5 32dde98adad3f846f0b546d12cd8b539
SHA1 6742f1eef9291495c3ca7dc7c7ce5cefae31c4d5
SHA512 775d8f5f3e77e6050647e68f7fd2cbd9c24ff50c5b57e4d41b93facc86cf81d777effa784d137111e5b5dd7b2d1e4d57d87c4ba39c43bf51848eb26a1c4af674
SSDEEP 192:sxZvREk//fjshuoIdpCEHW6+WN0/0/Y4/uHxZIg5EJ:sxZvJ//fjshuZLHb//OPO
TLSH
T12722B6526E78A9778CCBD209BA15BF53E6F94032A1D11F48A6FC861C05E7BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f8903c4248799686ae071108e623f2ecf302f56fc0cc81fb849afd7bf74c66ee
MD5 256576d22e48476dc047764a6e7b574d
SHA1 af652b851a741543bc26103a3b081ad64799a240
SHA512 755bc88793f551475619bf6fad94dab378791a8cee698008a08ffdaee3b5f293af540648c1ed97ed4fb6c3fd7dcc3707c6a55c47fdfa67445f49252865795232
SSDEEP 192:sxZvREk//fjshyoIdpCEHW6+WN0/0/Y4/wHxZIg5mJ:sxZvJ//fjshyZLHb//YP8
TLSH
T10F32C7526E78A9779CCBD209BA15BF53E6F95032A1D11F48A6FC861C05E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ed16b2564909d996475da37446bfb41372cb4888c682c9e7a822a908e514d0c0
MD5 abfd0b763a04b3bf210af3d7be625d76
SHA1 33909c4257dbc81fd27d1ea15f06e8b61c4b9711
SHA512 71a5403285b1459d10b977160fe4527ba488c64d11857fe614f5531cbd64a66644ea629834c02ec5ce48c0ab42947628d4b1d229ccefc6832b55c00fb4e9865b
SSDEEP 768:tQqirTNWvx7jr8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMALl6opTqroy+Unn:tQqirTNWvx7jru1ja5ALocTBvUn
TLSH
T1B4C2EA3F640DCB7E4FC01A9DEC5A6F963EA802CB5A588D4047FA994C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 57348c87b8ef4620d544bec716587c3f7dd92f534379da35c4b87bb018f64adb
MD5 1fa8e503baf35517ea17b7f8968394c2
SHA1 d4b18c4a161c208f6170b6b5a34623fcce1592b1
SHA512 029351914f150c2b09e118d3004af7ecd609e23e6913996feb215e476c1472d044dd904f258d512116a438a437876acb8d4c64fe47a082b379929b34e9cec905
SSDEEP 96:KkMYKRWCKOkK3qPezCucIsgoQpzWWgKu1WUgymWZ0+tkholBv33+BHulfh+KXLfl:qbXSezCucIstQpCWq1WUFmWZ0+t/d
TLSH
T11DB19453317B52013C3D241C95A4DBAB5A9771A33008E9AF7FA810A94E2BE2D5DFC4EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594d2c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594d2c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 686f9ffceafe5283a91f38239a97626a07fcc97540c79719ed5ba633944fa20f
MD5 722253bdc2aec6590290345b7977599e
SHA1 0e9e5d1897a975f7d1d4086c2ed1dafab5e89b87
SHA512 1b5faea4c4c4b89d648dacaff9c2bfa0b0a83a372bc88ca65f00daa06ea28b6769b9d0b29fb587ec58a7c7598adaf9c3dd6ebb58441286a9a416d890600ca71a
SSDEEP 192:ucm+xasuheOwQxMGsNCcfQx888mvlGQmiU16XOp4k03Br9EOLI4qMqva+4LcYLW9:OZcIhsNCcfOIH2kMrSDKsa+VYzlYoE
TLSH
T16D828D3128A86C7A9DB3D686F98733134FB8D16793C97F9494EDAB1C00DA6D81307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 47ce81839677ae2a7c5cc365194beda10a4905ce16cd2432a5c4b71339006d7e
MD5 2a5fcf5504dfaffec1a1454c82d11689
SHA1 d4755e111ae932d5b8f1b3b0268bc81d9373103a
SHA512 e662c01bf250b554d81e7b947a59d429450bed07af258404ee90664f497ee411c383c15680b0ec1967c5b398ee6ea3da9fc31567e8f6159e2b435054e918300c
SSDEEP 384:miFiZcIpsNa8TUNTUlIl5fOIm2kMrS8Ksa+VYzlYoE:NFQpTwgbaP8KhgBb
TLSH
T124C219F218D7987AD9AE8743B77E2E134EBCC163B6856A50B3D8560CCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6d5ffc6a7c156d68e5967e4941bfa4ff03dbc28b06d9015fcc1e936098df2f16
MD5 21ee642c6b27785cc521b8ad77afe394
SHA1 cb38ad2c41387b9048c77109cca1c4b6700807d8
SHA512 65143c5dab6b8ba9775fc2a53bc06bc00734b8407b7cda0a4549c2e3613bc7b9690ef7eb374c22729fb7ca930b6e33ca30d4b60ffbbe3bb6458715f4b0f4fa80
SSDEEP 192:uvm+xasuheOwQxMGsNC5fQx888mvlGQmiU16XOp4k03Br9EOLI4qMqva+4LcYLW9:hZcIhsNC5fOIH2kMrSDKsa+VYzlYoE
TLSH
T143828D7128A86C7A9DB3D686F98733134FB8D12793C97F9494EDAB1C00DB6D81307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 312e34bdc0e038d5a85c6e47834ca7a72fe72e94ef04d8580d557429b0111e37
MD5 f479886bd3ed287fc9deb8306999aca2
SHA1 f496af80a08bf1a36163454c4dfe52e43ca9367f
SHA512 41f87f336d46d444b0ed4f7ea5132114df7f96b9ca6d0a92260fb76ec1d141251471cf08f70ad59c2b60422ed9efed002fb0004fc6b416f2d55bc66f00d54261
SSDEEP 96:kqONkLQsjpfmUTGK5ih/cIPURHl8h4otop5Hk2JDJBwPwivh50xy0SFYKcAxMbsW:POND6kHQmiUyEePi903Br9EOcR4qMU6
TLSH
T1CA121A3164BC6C7B6EA3A845B48736275FA58227EBC97FC0D4EC261C44DF69C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 38e5b1d74383d073429fcfcf2816a07395d3806077de4bf5c7fa515b861ddf40
MD5 12be62f3742761a33b1e7f6af89bc952
SHA1 ad37fd1fe79305085a041575e4f92732e0b9f953
SHA512 59a53c466f4a720bd167205f3564a18c968d5e28bddc980520a4a77386b43bc5ffd06e68e4afe035e3d02e887016de9fa6f38dd6e4f54b4ce6114bc14b3ba229
SSDEEP 96:ZqONkoQsjpfmUTmDK5ih/cIPURHl8h4otop5H5DJBhPwivh50xy0SFYKcAxMbsa+:gONo6kDfQmiUyJPZ903B4QiyW2+U6
TLSH
T17B02E73968782C7B8EB3AE49B58737275FE9113BEA952F80D9E81A1C40D725C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e727a00-352c-4e2f-8acc-2e20b695bc91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1e727a00-352c-4e2f-8acc-2e20b695bc91.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e01a724458525c2169e25cf872e7387664ffdeb64a50d027cf66fbf47fd3c269
MD5 229ab398a279913f36a51234a276fdec
SHA1 6a31a732685d27dccaf10ae2fbe3e1c561259ef5
SHA512 a1acc93d2a2a723aba1ebbe0dced7d70d7bf83bb65dfcbff9037e4ed42940f406564b191bba048b5cc331dd89b3e4500082af69ffe38f27b77bd6df1869ca43c
TLSH
T1A8411758BAF91158B3B77E569BF3A86D843E79772E06D05E00110E4E4A77B40CCA2B37
MD5 SHA1 SHA512 TLSH

Submit Download