hxxps://xisax[.]click/party/card

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://xisax.click/party/card
Sample260916-wl9p6stdma

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4436	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340553180461950"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{5CB49A84-998E-470B-A7CE-42BD68D84CC9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 1448	456	msedge.exe	84
PID 456 wrote to memory of 4436	456	msedge.exe	85
PID 456 wrote to memory of 4124	456	msedge.exe	86
PID 456 wrote to memory of 4124	456	msedge.exe	86
PID 456 wrote to memory of 4124	456	msedge.exe	86
PID 456 wrote to memory of 1760	456	msedge.exe	87
PID 456 wrote to memory of 1760	456	msedge.exe	87
PID 456 wrote to memory of 4804	456	msedge.exe	88
PID 456 wrote to memory of 4916	456	msedge.exe	89
PID 456 wrote to memory of 4804	456	msedge.exe	88
PID 456 wrote to memory of 4804	456	msedge.exe	88
PID 456 wrote to memory of 4916	456	msedge.exe	89
PID 456 wrote to memory of 4916	456	msedge.exe	89
PID 456 wrote to memory of 5064	456	msedge.exe	91
PID 456 wrote to memory of 5064	456	msedge.exe	91
PID 456 wrote to memory of 5064	456	msedge.exe	91
PID 456 wrote to memory of 5116	456	msedge.exe	92
PID 456 wrote to memory of 5116	456	msedge.exe	92
PID 456 wrote to memory of 5116	456	msedge.exe	92
PID 456 wrote to memory of 1032	456	msedge.exe	96
PID 456 wrote to memory of 2420	456	msedge.exe	97
PID 456 wrote to memory of 1032	456	msedge.exe	96
PID 456 wrote to memory of 2420	456	msedge.exe	97
PID 456 wrote to memory of 2348	456	msedge.exe	99
PID 456 wrote to memory of 4168	456	msedge.exe	110
PID 456 wrote to memory of 884	456	msedge.exe	111
PID 456 wrote to memory of 1716	456	msedge.exe	112
PID 456 wrote to memory of 3736	456	msedge.exe	114
PID 456 wrote to memory of 3736	456	msedge.exe	114
PID 456 wrote to memory of 1652	456	msedge.exe	115
PID 456 wrote to memory of 1652	456	msedge.exe	115
PID 456 wrote to memory of 3084	456	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xisax.click/party/card
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff941c5c188,0x7ff941c5c194,0x7ff941c5c1a0
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,4728864004706699295,793448094666383488,524288 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,14607314970179801552,3015720457056918625,262144 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,5272395869742133807,7891129982957596683,524288 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,12176607205042457705,4969523756257867690,2097152 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,1068890607629876081,6062056339310345281,2097152 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,14487344269408583258,15200479855617588119,2097152 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,1908466090650481379,15234025519768916828,2097152 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,5332956009739278340,14633550482710356787,524288 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,15392346290714552848,9649845180730391945,524288 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,13578483748805809135,18178296085906939213,524288 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,13578483748805809135,18178296085906939213,524288 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,10465535936049346763,1907179528516632583,524288 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,16977002779664383874,15950880564681711283,524288 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,12471894788568191570,1055899309539776084,524288 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,2509369098059059479,15600817595549469583,524288 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,17520455676466632847,2255534851870676217,524288 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5524,i,9585518468643857547,6561986456119062688,262144 --field-trial-handle=2324,i,17183346049082903705,15692191337917934770,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0e32bad77dd195e329ea0e5e7b9499c6fe7ccaf6c3b807dcf64d4e191539e444
MD5 dff4b4cfde3a1fd0af40f25d0dc8c48a
SHA1 58b492eb95ae81c8a89b74dabfd260eca5a2b738
SHA512 5ec7e7fc4656ec4c62d1bc7539611ab712cf0f40b642494a4bfdf32d0251006da2664882f35da71653766be6fdbbdee564ecedc93f89016adb0cf7b03ad59603
TLSH
T1E151A3B908AB6451DB7EEF7093DE22ABF63097F077937E03A69AC57467373008145444
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fd85.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fd85.TMP
Size 3KB
SHA256 28a41464f337b2a7c386788e5ce2db43b9c2064982a0b1abe3e88e28b566daeb
MD5 596a806d3b04f6edac8603c53dbf1faf
SHA1 fc07de105509c2ac261dd9951d64b74c05f86152
SHA512 8dcd0b07456f44bc70f2b33666d4bfe837bdb09c417cbf26d3bc07df405a83cec7ec29c9aec31013646c42ed4820d3152a6d2f9c2e311d5bb9791dff6d6eb3a3
TLSH
T1185191B908AB6451D77EEF7093DD22ABF63097F177937D03A6AAC574A7373009145044
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c0d5cbe13c263360d99ac7bc4acd833f43766271586d8f600a448b6e76ff663a
MD5 81e8de58799e1e3d888c27bb5ec8f9b1
SHA1 020b892b7cb335be24ebd530975571b5560f2549
SHA512 20c75b143bb024cfffdc53925d2f07cb73dae7b0bb369be10f92a784b76a7784a25eb038bcbc70fc8a5fb2d82c8c38f68590c2752a3d29b34b2e78b64e698ace
TLSH
T14941DAF7C3E4866D9C1196F0AA196E2ECE6C091543183C2AC8E5EF0BD3E3475E10161F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 56659df00a3c850f17574fb56720a27a5e2595e2fc90cbc2cf1605cef2a4259a
MD5 d5c1e0f7dfe96fef59fa1833a37bd441
SHA1 ee2ad76194a112d4425469113fe6c07defb09823
SHA512 5c1d7a012616279065e191a9c80fb7c4e2277d2d2dfb2b0dddfc09ddc314f02a4e318cd38196aebaebb4d26ae37d94b2a23b2c0b263c7e79386dfe83089c6fd1
SSDEEP 192:sxZbvROWl/fKs1LRIdpQaHW6+WNP7z/YYBZ7gIgrJ:sxZD3l/fKspa3Hbn/fu9
TLSH
T1B122A6566E28A57B8CCBD21DBA15BF13E6F95032A5D41E48EAFCC61C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6f97fc9bf190be9ce3336e385b3ecc1777327f628c8a7522e33f8b343031b7bc
MD5 d8b2ecfe8df11c4ce321470b5f78d4a4
SHA1 6962ae40b1b53fdae2666f87e27c81369cc99531
SHA512 e431954dbbb10509b22c54c6f5267cb9105052d11293d63e68745e924f7e57fc3c0471ff65c33aaffe0d3c304408e549607e1b882f44dc741af89aef3800869b
SSDEEP 192:sxZbvROWl/fKsYQRIdpKaHW6+WNP7z/YYBP7gIg54J:sxZD3l/fKsraZHbn/fgK
TLSH
T10522B7567E28697B8CC7E25DBA15BF13E6F9503291D41E48AAFCC61C05E76CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ac921ed04c3675b7eefdee91f9e34fba736355b21947c70e742bdd14138de737
MD5 ec3dd0bd1a07a3ae265446698a85b269
SHA1 2734b2b22435f0c5b640cdc858ff722ece1ea4c8
SHA512 0d3ccf9fa7493dd0157c22a606de08e9f563afc7a566702bfb2eaf3cdc46c82931837624558a4615009d11f316caae1de95bb18c5401c4b9921ac50e886d715c
SSDEEP 192:sxZbvROWl/fKsYQRIdpQaHW6+WNP7z/YYBI7gIg54J:sxZD3l/fKsra3Hbn/fnK
TLSH
T12122B7567E28697B8CCBE25DBA15BF13E6F9503291D41E48AAFCC61C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 6d21ca85c3ecd1f44247e3224398ce675515cef1d7fb03254b387606d22800bc
MD5 09b7226e78988bb9aa5049fa3d0396fb
SHA1 c433aa1bcedb5091a3568e15f1dc9bd5b159d84f
SHA512 5903f69ee95fa756edbe5f1f78c1402e49fb9d26efaef83d015e59d1fe2ea22360e2223b7d3ab6f51c47916f645d543501b6b635db10dbbb7cd763c63a31eeca
SSDEEP 192:sxZbvROWl/fKsYLRIdpQaHW6+WNP7z/YYBZ7gIg5SJ:sxZD3l/fKs8a3Hbn/fuw
TLSH
T14D22A6567E28A57B8CCBD21DBA55BF13D6F91032A1D41E48AAFCC61C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ed59d56d52d3f98b744d68afe01e1a623202046f8fb6c0f092eeafd83ca1c854
MD5 d8677a7c58617951166733e86ae3447f
SHA1 9965e2fa593946ad3fd72d2738327605ea30ac17
SHA512 17702aa0733ac9c64b4c9c755ab645fb2fb138136ba8e2c931dc03ede618246595d283d4a43a0c4be68c0f2d3d9390d86b94e8572501ca6146e4f347dc90f164
SSDEEP 768:dayYR7jWv3NRB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvX+ropZfG:dayYR7jWv3NRBu1ja/CL8OXVG
TLSH
T1FEC2E93B640DCB7E4FC01A9DDC5A6F9B3E9802C796548D4047FA994C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 6011587234a77be065d78793a9aa4317de3bed6ccbbdae2496b091d295a65064
MD5 aecf13bab4076497bf2137fa3a2bf16f
SHA1 eb7ac52fdec9da43091d8c564f62805456747066
SHA512 a720a679f8466e54619ed3d6451226011351676eb1e16f9ffec2d83e4d34a20d52d10310a65e86d2741a826eb95d67d830ec480dd4b722e70d9a4f8ff69a06a1
SSDEEP 48:KgvSbvRxRqbpkZIS/qK9f1VqxP6YcdfDyLVUplXD34brOrIS94K9d1P4x9oYePlI:KAkgKdaOiKMK7KkCEKTqKOJqKiIq
TLSH
T1CCC1FE5036BB165178BD299885B68B1B124132B77119F63BBFBC11B19E7EE040CFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599551.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599551.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d9858680f6b57bbbacf0d6adbec78d1d712a1488bc8dd4f1bf61e8d0896189e1
MD5 3cc4cd6b644fdfb1666d02cf2c27305b
SHA1 0369cc11346349e2c12c086e754aae045cdc7673
SHA512 59bc27b596717872f6206a794ec3d8ab20a8a2e531fb84bc4595fc08349b8a7155555299f914bd67727ef3fb49a8854ed185421038027c325e2e919639da603c
SSDEEP 384:b3yFaeO8RsNvPoGi5zccQX5+DtH80gXmH/KMyP6nC:b3IzhR01XkD9QI/KMyCC
TLSH
T164827C75B8B8AC7B9EA264C1B4473513AFB85067D6882FC4D2FEAF2D05CD198130A912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 75ecd01c4363cc3c5ba35f7e3e7cbd328569a0d54b59cba14e9aed02ed534127
MD5 2d807b0a07b005d93e241ae816d5d02f
SHA1 00e6145981f56080b48b72468403fd0a5d59c313
SHA512 6128ecbabd99d3841cfcaca7da0f5f93a8bf20b842af7861e54ebbc790b9b6917ae39d37c7d327728fe960c81b73a7d393d21163f0a40cdefa7afc8db37048fe
SSDEEP 384:RiFZ3yFaeO8CQsNR8TUNTUlIl0oGi5z/cQX5+DtH80gXm3/KMyP6nC:4FZ3IzhFQwgkGXkD9QY/KMyCC
TLSH
T107C22AF658D7983BDAAD5783A77E2D139E7CC057B4446A80B3D95A1CCC891BFC30A801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4d4a5d62ac9de8ecbdf1dea5f826394032d1ebc8161d08ba8e4f15820bd65266
MD5 86f6ac7f673c390a3504bee701ed2f64
SHA1 c6247fba4aa5ae0bcce39f86c36f8157ad67f8a5
SHA512 d3f8f5bdf8be07070184444d616a2e7d4a65c4ec8fb1029ade20a394d81239c897ec6903165404f49a5d87c946c4351432531ee58995f041021c4d47e07fce45
SSDEEP 192:EONI6nnHGQmiUysGQYcX5hQDP1fjzorLoaMc7RU6:EONI6nCiQNX5+DtH80CdU6
TLSH
T10202D934ACB87CBB8EF36D46748626139FA4217BE5952B80DAF85B1C00DB65C2306923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 455714bf58fed4e7bc0f4bc865d2bb3c78abb8afef17407eacf73dee3f7c180e
MD5 ac36d995402c68dd8f243480a930caa2
SHA1 61de6a97cdf2536af17e4743ef953c8900265831
SHA512 e78771b97e44329a9eb1a7af48d464cbc85d04189848126bc1fc910475f7bb480c837ec12fc45c53fa458e907d669d35b6ee6778ce192a59f172d8120d36bfdd
SSDEEP 192:udYYsNvXQCYD0nHCVzQmiU1p0T4bcX5hQDP1fjzorLogXXbKqPyV/5KnMwhP6GwF:MsNvXoGiXccQX5+DtH80gXmH/KMyP6h
TLSH
T17B625C35B8B8AC7B4EE26591B44735139FB8506796882FC4D6FDAF1C01CE29C130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3a7d2bc95dea7d65cc71286611e49bc2ca1f649fd43f2c47ff590f76ce92f61c
MD5 345f14b6a333475e9e9cdf4bc02d40b5
SHA1 a51aa31b346d568da83db3d95dfa352c3466a0af
SHA512 953d34187e8a70c9d3577638f0401921a1e43d50a2704594646eefc0314f92fcbb0267dad8e31615c4db2e27615b932dab88a8339fbeba1248c63c713f93f323
SSDEEP 384:K3yFaeO8RsNv0oGi5zccQX5+DtH80gXmH/KMyP6nC:K3IzhRF1XkD9QI/KMyCC
TLSH
T155827D75B8F8AC7B9EA264C1B4473513AFB85067D6882FC4D6FEAF2D05CD19C130A912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b0e8424b27652270b877a7eb063a4f4d37f12ec47d1a294045d61c454964bf24
MD5 4d256cf95677012dfdb72ef5e1193f9a
SHA1 89ca0a29fd7b5282b41e832d871e93f02565515c
SHA512 a5c0887d84c02ed9ad834ed9a051dfb945bc6bb9857e1ba9304f90c5f4f8aebf394c728f54095aa093d70509cd76143161713c24c55ea361efb4dad7bbceb682
SSDEEP 192:EONi6nnH+QmiUyYGMYcX5hQDP1fjzorLogXXbK/g3V/5KU6:EONi6na4MNX5+DtH80gXm0/KU6
TLSH
T127121B35B8B8AC671EE265D5B08735139EA55127EA897FC0D6FC2B2C01EE65C130A922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

090265c5-b56f-4d00-82bb-eeb7acba2095.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\090265c5-b56f-4d00-82bb-eeb7acba2095.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 07e6a746b55fc490d21fd75c7a1f5ae31c8ffb141f8080d8e91a24fefc73f031
MD5 a4b6fd9c13862665329d4a5947eff9d2
SHA1 89ec913a10530e953e2849f4db2121862ed0c042
SHA512 ddbc7be5337d1a5ac5a81daf728ea7e65ed1338a163db08178b4a6a548626c890e7671d41ff551d5b96d184003adbc4340f8d99a0cacef11547dbd1595c13146
TLSH
T19C411A58BAE91158B3B7AF1AAFF6946D487B7C772E06D44D00010E4F4A63B44CCA1B33
MD5 SHA1 SHA512 TLSH

Submit Download