hxxp://EFD-STUDIOS[.]COM

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://EFD-STUDIOS.COM
Sample260916-msxjraygqa

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
312	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340290741192198"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{CB476D41-4F20-4736-8EBC-AAC425FB69AF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 1760	3924	msedge.exe	88
PID 3924 wrote to memory of 744	3924	msedge.exe	89
PID 3924 wrote to memory of 312	3924	msedge.exe	90
PID 3924 wrote to memory of 744	3924	msedge.exe	89
PID 3924 wrote to memory of 744	3924	msedge.exe	89
PID 3924 wrote to memory of 1228	3924	msedge.exe	91
PID 3924 wrote to memory of 1228	3924	msedge.exe	91
PID 3924 wrote to memory of 4608	3924	msedge.exe	92
PID 3924 wrote to memory of 1852	3924	msedge.exe	93
PID 3924 wrote to memory of 4608	3924	msedge.exe	92
PID 3924 wrote to memory of 4608	3924	msedge.exe	92
PID 3924 wrote to memory of 1852	3924	msedge.exe	93
PID 3924 wrote to memory of 1852	3924	msedge.exe	93
PID 3924 wrote to memory of 3784	3924	msedge.exe	95
PID 3924 wrote to memory of 5064	3924	msedge.exe	96
PID 3924 wrote to memory of 3784	3924	msedge.exe	95
PID 3924 wrote to memory of 3784	3924	msedge.exe	95
PID 3924 wrote to memory of 5064	3924	msedge.exe	96
PID 3924 wrote to memory of 5064	3924	msedge.exe	96
PID 3924 wrote to memory of 1448	3924	msedge.exe	99
PID 3924 wrote to memory of 1448	3924	msedge.exe	99
PID 3924 wrote to memory of 1448	3924	msedge.exe	99
PID 3924 wrote to memory of 4140	3924	msedge.exe	101
PID 3924 wrote to memory of 3472	3924	msedge.exe	102
PID 3924 wrote to memory of 4140	3924	msedge.exe	101
PID 3924 wrote to memory of 3472	3924	msedge.exe	102
PID 3924 wrote to memory of 512	3924	msedge.exe	104
PID 3924 wrote to memory of 2020	3924	msedge.exe	111
PID 3924 wrote to memory of 4228	3924	msedge.exe	112
PID 3924 wrote to memory of 4744	3924	msedge.exe	113
PID 3924 wrote to memory of 3404	3924	msedge.exe	115
PID 3924 wrote to memory of 3404	3924	msedge.exe	115
PID 3924 wrote to memory of 1656	3924	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://EFD-STUDIOS.COM
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff865fdc188,0x7ff865fdc194,0x7ff865fdc1a0
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,11514575178187372803,17973661793565927732,262144 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,18278572609642521042,1138491565528958277,524288 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,18144834402991768124,12116900568074005876,524288 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,6652269595923774830,2202867498758597613,2097152 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,15091255887668694471,13919348292101208434,2097152 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,3145406352372966030,11786325178841006089,2097152 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,4835518127473075939,12831722482992544044,2097152 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5080,i,17804977182462362314,5507787702911073814,2097152 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,16952430183150024630,14783794614920464692,524288 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,7075397545806836699,7040456105099931774,524288 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,14365683985349474468,1017740805656345107,524288 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,14365683985349474468,1017740805656345107,524288 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,17083703208659028639,9359195711312689857,524288 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,10014010620210367183,1048473682889878115,524288 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,10678881972705747973,17144869731478766879,524288 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,6840227452713766572,16562313617469763353,524288 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5272,i,8644623577766253388,6001073712839590347,262144 --field-trial-handle=2304,i,11350959633788603035,3624707749473242096,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 1024KB
SHA256 4588f1ff86f3369f3eda26eba8321c5f5d079ffed1a4f9c375776d37595cdd84
MD5 eb873d0fa2ddf7ff29d2aa9163d2ee67
SHA1 f5a93b5e422f5bff822f49e28c663abeb4af88d0
SHA512 d03c790969e593b52fbb25dba90c9b15e6c2865d680f363047ae2edf962026568c13f974a163eed831e666ab2950f9471beaf992cc2f333cd33fd09c322da056
SSDEEP 24576:FHE+ngCTyOEAnInsHoDTXMwcirlH/dw4IPRFdkVRYQ+gUpJC6BS:FVnTyO7ksHQTcghVwT5xQDkJCMS
TLSH
T1B42533BB0E942217B76F2CE05BE5879EB4F63D5188D3093346D0E495A2712F817BE683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ab0ba83c4b560f44385bf98c80cff0adeca1d4cdf19f35e8c67712077270d69c
MD5 4ec96cc4f22b94b7295120bb24d003fc
SHA1 497bb8a9d95ae73bb8893ec1035f695b8c3a9720
SHA512 d49d9680483864eab1cecc6c1bc55566cfd2cf716224e4917bcd505e9e8f9e3158ee89d5e77fe373ba5c2c88c39d539d0035d85cbfc68d12fa20a5a30fadb885
TLSH
T162818658AFC07861FB98BBB9CF9708473AB377880667EE53A851E8F44E4738050E8744
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593b69.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593b69.TMP
Size 3KB
SHA256 c1276434b36bf92c2e6b5728e592761fd862610705e072b8a7ec68aa89c9b62a
MD5 9d08263b2a8f34ad148e55c29b959e34
SHA1 03dba4cf6394f90b60435973c06c7c820e3f8dbb
SHA512 9bd4a22572d8eaa35844440599c8f6c5ca1d508ce6c5177a3c0ef34d677b535c26d8bd20c0f8b13df21934f8c5b7d1772670c04b1bb1b1c36bbcde6cd65b19b2
TLSH
T1F6618F90BFC078A1FBA87FB9DFE7048736B3A7C05AA7ED41A080D8F95E067905060354
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 46e66b9f5b59756c5e54c746b79c4fb8b99cd803f762caee0015613c828b9b2c
MD5 962897a036d8bfe5d1887049a5a10752
SHA1 06b68ea7d8a966c23c511a88dd0b9306c70daa01
SHA512 ec77a7dff44159c655b9c4a8cd5d586cb9d76ea70b88337d8c3cbe0e8aada7b658fcbe3e74d8c3f73fad2e054d8a2736c5fa43684822e0dd1f1dd15995a5f829
SSDEEP 96:DeOs8no1AzvYtkGBf4Uv0OBVMQPc3NfYuQxAw4KAOwQ:DNs8no1ADYtkGBf4Uv0OBVMgc3NfYuqj
TLSH
T112C18EF683E9962E881155F1EB242E5EDE2D0414977C382AC9F1EF9BE3E3461D101D8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9c8dd7fe59667a7a9ca7c7de92b1abf00d93cfab56cf15b5d424585ada45ddc8
MD5 1eeba0bef86568dffda16fd36fedf058
SHA1 1ff6c6b1aca8a5c6a6f7a9df9d950c7e00b29f2f
SHA512 8406e9a4e351580a86c4b50e387540d343ededc3f3c98492a64be8111b57f249a5722fa7d2b310284b8275f851d334d06ac492eb9c53b952b348d35c29527a0b
SSDEEP 192:sxZwRwW2b/fisuUIdpDbHW6+WNYmz/Y36SB+aIgrJ:sxZwB2b/fisuNXHbp/XYh9
TLSH
T14622A6567E38A97B4CC7D209BA65BF53E6F95032A1D01E54AAFC861C04E66DE230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a424ed475d31452f48ccee02e934a7ee95954242dee326a662a353403bd2372f
MD5 bebbc3f8f454e7a2dd8b58a3f1d56ca7
SHA1 6c4d3601f9687048143878bb85369ddf09448cd5
SHA512 ff7808b2378dfd4ba667cd785f328af36add8a57fd4686b78f7205a9005f17d4bafee8e6751d3343ac0af97e0efb62213a4e4f1c2d922b62588d01e4bd937775
SSDEEP 192:sxZwRwW2b/fis8UIdpNbHW6+WNYwJ8dY362B+aIg5+J:sxZwB2b/fis8NFHbudXch4
TLSH
T1F522A6567E28A97B8CC7D209BA55BF13E6F9603291D11E54AAFC8A1C05E77CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1f5f9b8ea5f31fd0e943f6a3dced9d474cd205736275520537e4811bd6bb4178
MD5 a6781d1f41c8974f09623d04a17ea4b7
SHA1 fb4a03f1df5bee75c3e5ad89d307a59fdf94a5c0
SHA512 650284e427350a80023a98d98e44795bde639723f7793d797d3f61fe1434fbbbd48e77549132a575c606c21a03f7d32a25b625d9bc8a4161f8c1ffabd7c4ab32
SSDEEP 192:sxZwRwW2b/fis8UIdpDbHW6+WNYNjtY36UB+aIg5+J:sxZwB2b/fis8NXHbKtXuh4
TLSH
T1C522A6567E28697B8CC7D209BA65BF13E6F9503291D11E54AAFC8B1C05E67CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4dd03bd85f3419164448004b6debf8af855d9296f761501092915fbc55394a92
MD5 4253e304577508a14e05e34f5e9aa173
SHA1 ef6f52810e12c7d87c345899d7a68c9074f3dc00
SHA512 96b1ef9acc64fbca926aa5228a499c158f1f883b1792b27c3c91cf5558b173c56e96ca438fae88d78b06a26e5129e4f71a48e4a01e5e47528510da842b146b49
SSDEEP 192:sxZwRwW2b/fisFUIdpDbHW6+WNYntdY36hB+aIg5MJ:sxZwB2b/fisFNXHbKdXPhq
TLSH
T1CD22A5567E38A97B8CC7D209BA65BF53E6F95032A1D01E54AAFC861C05E67CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 cda23799259fd4a1624102277feedd1aa6b8e1bad68b75bb7c53f4448d4348ce
MD5 819390f7a460dbca1a45487fb5d6ac20
SHA1 4d92959f4878344ba3da9ce8415aeb27def8ae1e
SHA512 2997fb5a94d0f3a5434a064554bbfa95b1c310f0f415468d08a8e2eed5d4ff2dc91de17a3edc34e991b60470e59f5ddb7d7e278916d79109cf90d6f5e4d09422
SSDEEP 768:MiKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/XroQW:MiKlm7QWvUYe0u1ja8/L/E/EQW
TLSH
T1A3C2FA2B740CCB7E4FC04A9DDC5A6F976EA802C7A6588D4047FA994C02C77EE51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599b7b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599b7b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 365c1e33208b1b5b9368b10658f5a7d5ce31654771cccec84b2dfb2df90a5f39
MD5 03d1c4ecd9c9526be2ec8388581d1c03
SHA1 e60e86db80bc54a692d06d300123bd0b2a71e14e
SHA512 ca5509009e051ab6b9835b54494afc4563dd3413b338554c9b29515c683cc8b64c63b70d8cac37db29b1820eca488adf154c6433fefddb9a7213b66956cccd7c
SSDEEP 384:5iFiZcIhCsNr8TUNTUlIl+W8hlxbEi7h//z8ExUXQOKsa+VYVmok:QFQ0ywgCVt/D8QOKhgXT
TLSH
T1E7C23AF268D7987AD9AE4783B77E2E028EBCC067B5845A50B3D85A0DCC9617FC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bc2946c0e0edf315a1fbac8e996646087877687e5de770b937c2254b25c21d17
MD5 4f84eac5775418a8232e6b05990360ef
SHA1 2ce161305a26d05a0c8276493eba7f4e9a116ad2
SHA512 c82e18e109fce64cc479484bbdd8313cef706baf7664b0a8c798329e5b0c3a2e1c6d0d524943c9150111fb9934579e9292edf8c1a7163409e27874e4bed48d00
SSDEEP 192:BONN6JUm0QmiUyjfso//jjzorB6ywxWjBCHaU6:BONN6+mEIso//z8ExH6U6
TLSH
T1D602C738B8287C7B9AF3AE49B48737139FA5106BA6951F40DAE81F1D01D725C1306D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5967b393f3825cca2d00f6a264ef7d269fe264e4545cab88e5ba811f2967b5be
MD5 3d99343c54af07b12e7717c360ee3666
SHA1 757444c62439dfea466c53d99f3e28403017e49c
SHA512 bad7eaa20315e0859a0cacc5557de68954d108c520b338030bb7409a9b8b5c99741965c97044f20438dd19d92a1a615804f5c4e402455b9a3942e58f4f9ef621
SSDEEP 384:9ZcISsNmUnW8hlxbXq7h//z8ExUXQ8Ksa+VYVmok:lSI4t/D8Q8KhgXT
TLSH
T183827C357C68ACBB59E39291B58737039FB48067A7C86F54D6ECAF1D01DA2980307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 93fcad8758647168ebd260fbf8d17debea1bfe32b3c59d025db0a6fda638dc01
MD5 75911374e94566d76a09555acbd3f04c
SHA1 1ea789306608ef6857afad13cf99aff3b1898050
SHA512 238260ecc6da4633c658568753af43a54bb889ba61b7183f4998610549834305d97903d6dc20edcf35f86ebbf1e9ec22b53d084656201728afa948e9774fd65a
SSDEEP 384:3ZcIksNmU+W8hlxbEq7h//z8ExUXQEKsa+VYVmok:/kb1t/D8QEKhgXT
TLSH
T1F8828D357C68ACBB59E39281F5873B039FB48067A7C85F54D6ECAF1D01DA2580307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 70cd267d6198c7636be42522f311c47f9e1b2cc82c2fd626e4c238a04d864800
MD5 c093a6af4fcd6144769f3fe16e29a3bb
SHA1 5ff7a5705ed1a16792c94a61e0d4318ee1ebfc15
SHA512 fc910f7e417296fcfe77e84943333687b507f19faa6d37c06fb1ec2f5ef2084ab6441ca93b9b63b39c568a43d1ba67acdd96410146330dc4ed55967e7f8d06db
SSDEEP 384:9ZcIksNmUnW8hlxbEq7h//z8ExUXQEKsa+VYVmok:lkI1t/D8QEKhgXT
TLSH
T145828C357C68ACBB59E39281F5873B139FB48067A7C85F54D6ECAF1D01DA2980307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6f0865fa07239cec29e23ab47dd4400ff122923b3fd80976ad234e84ce881716
MD5 e611abd59acce7835f9800cf677a9971
SHA1 64f3dee15e8ab39048c6daa69c4a3491552d0e4a
SHA512 4300051d0751621c504ebae6af2c8a35404c8b557001e3536fd9cc40f4ba843d494f96cd4ad8a91249587f82b9fe19ee4574cb053f4d2ded34a3594ab9c4ead1
SSDEEP 192:BONs6JU9QmiUywfZo//jjzorB6ywxW5XQNNxU/3U6:BONs6+7rZo//z8ExUXQ1KU6
TLSH
T19F120B39B878BC6B5EE3A595F08736139EA0412BDB896F90D6EC2F1C02DB15C5346C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1e64026-6478-4e2e-93d7-5cf438eaab98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b1e64026-6478-4e2e-93d7-5cf438eaab98.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3a7f7a23a35105f62380514c13a6c85efd53c081258a9dd2a99919dbc9c4ca3b
MD5 2093aeaba04a847821d6a01e123792e7
SHA1 501a161a0c37ea7f7ebb8462a289a7e437ca7b32
SHA512 7d5de254240fcee9afd5900471be16725fa9b538f1d60f43e5f5f534c5b70f8785f0b643e56d29969b5d56272ee194f2fa793ce883cc04263155a23b17c2e1c6
TLSH
T126410758AAE91118B3B76F5A9BF7A86E487B78772F07D05E10010E4E0673B40C972B37
MD5 SHA1 SHA512 TLSH

Submit Download