hxxps://ewr1[.]vultrobjects[.]com/mora/close[.]svg

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ewr1.vultrobjects.com/mora/close.svg
Sample260922-3aybbstfpg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4756	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345927669142215"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{AA9DE911-6EC0-4F6A-88AE-CBB1ABE2C77F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 1336	3140	msedge.exe	87
PID 3140 wrote to memory of 4756	3140	msedge.exe	88
PID 3140 wrote to memory of 4988	3140	msedge.exe	89
PID 3140 wrote to memory of 4988	3140	msedge.exe	89
PID 3140 wrote to memory of 4988	3140	msedge.exe	89
PID 3140 wrote to memory of 1248	3140	msedge.exe	90
PID 3140 wrote to memory of 1248	3140	msedge.exe	90
PID 3140 wrote to memory of 2276	3140	msedge.exe	92
PID 3140 wrote to memory of 1112	3140	msedge.exe	93
PID 3140 wrote to memory of 2276	3140	msedge.exe	92
PID 3140 wrote to memory of 2276	3140	msedge.exe	92
PID 3140 wrote to memory of 1112	3140	msedge.exe	93
PID 3140 wrote to memory of 1112	3140	msedge.exe	93
PID 3140 wrote to memory of 4260	3140	msedge.exe	94
PID 3140 wrote to memory of 1084	3140	msedge.exe	95
PID 3140 wrote to memory of 4260	3140	msedge.exe	94
PID 3140 wrote to memory of 4260	3140	msedge.exe	94
PID 3140 wrote to memory of 1084	3140	msedge.exe	95
PID 3140 wrote to memory of 1084	3140	msedge.exe	95
PID 3140 wrote to memory of 4160	3140	msedge.exe	101
PID 3140 wrote to memory of 4160	3140	msedge.exe	101
PID 3140 wrote to memory of 448	3140	msedge.exe	102
PID 3140 wrote to memory of 448	3140	msedge.exe	102
PID 3140 wrote to memory of 4968	3140	msedge.exe	104
PID 3140 wrote to memory of 3116	3140	msedge.exe	111
PID 3140 wrote to memory of 372	3140	msedge.exe	112
PID 3140 wrote to memory of 4976	3140	msedge.exe	113
PID 3140 wrote to memory of 2100	3140	msedge.exe	117
PID 3140 wrote to memory of 2100	3140	msedge.exe	117
PID 3140 wrote to memory of 1304	3140	msedge.exe	126
PID 3140 wrote to memory of 1304	3140	msedge.exe	126
PID 3140 wrote to memory of 3828	3140	msedge.exe	129
PID 3140 wrote to memory of 3828	3140	msedge.exe	129
PID 3140 wrote to memory of 4912	3140	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ewr1.vultrobjects.com/mora/close.svg
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffdef88c188,0x7ffdef88c194,0x7ffdef88c1a0
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,15856440766671669636,4044251297927751027,524288 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,12574996211679791720,4810610657681361264,262144 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,1612904849581691505,5253039779172041363,524288 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,16095047485019699983,1689489259823009578,2097152 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,14914240643044627552,16975683654558615851,2097152 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,16053117587807228809,15987408893585838251,2097152 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,10765570182964267812,17933625906226102627,2097152 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,2418697729216878202,9377661103850032930,524288 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,11954061414758609587,4616817314322384632,524288 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,2096825796121232283,6315429431630917720,524288 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,2096825796121232283,6315429431630917720,524288 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,14161893868374463618,16981243680787656701,524288 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,2995731018419722559,12426291071272300485,524288 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,10379562285821106127,6207289721529901707,524288 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,3171865695222447331,12938994619210796924,524288 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,7569176784549136569,16074977744409132582,524288 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,3417654162558868218,2983849313931575857,524288 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6384,i,15480955466610920727,7869895541220040076,262144 --field-trial-handle=2232,i,7141497191982404796,8391425979137196782,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6fa1b02b96b249c932f11a4c4f1eb52f042c98bf33d02c325fd422f437c15214
MD5 dab629217416704f76a79a88ad8104e7
SHA1 7976f0ba766ba9c277031e8bb5fb53af02fda376
SHA512 08718b5a2794b585eb95d2cba2f1738b354033d24a471097fdf4f83b9cfe6ba984c2b3c4dae177b4e601dc47eb8b72225f8677ed39d32449fb3f874f22b26d8d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1C1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9963d11d402667a562c54f3a385818bbae5a78bfbda8db1440daf13c41d5fe3f
MD5 43483f5a5dfd6c96185123c37a8af64f
SHA1 ce207114930887451d4d0338a3e46a7aee02bddd
SHA512 30a86420b1d3c0435b2bd760003320aa7c9c9e1c52f36044aa70a907d7e26192a58e692f718e958de4320a0178d09fb9b39ac367e730282243343841c0b5657e
TLSH
T1ECE0DFC804E8C22EB299A48B4268CF0CC2C1370FD6C9BA9A2700888C7646084A382A91
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ea4b8ffa091663200ca6d29215e71dc7a7f5dae2aa947218db184ea9882de10f
MD5 0c2355d8e91c837c35f734701713cf2a
SHA1 b4c46b557987d0bb7a5a6746e187d2b71e9bd38f
SHA512 0fc21e621ce33b8cc2c3ce65f9a6f53a6fb5cd8afc33ec81a9ba1fd0d5f048b666d1e1c416d8bad04ead46686b8824596775ad8245d105365dd22cc20d62cfe9
TLSH
T1D56170805551E9D1FBD8707092C53183FE774A86CC839E3A12A4DBAA4A0A7D41F490CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a36f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a36f.TMP
Size 3KB
SHA256 af28269807168c9ad9a04234c1c8c55f3e4ef75f2608a39210fab466883d23f1
MD5 bbe95a4b54e35bd4c3c1ca6cdddf56ce
SHA1 96c4300ff9502912a18ec2699a12a747c84504bf
SHA512 4241dd82e6f73c0a6d8e614a31a126b63f820e1903eae8003cd95b14ea5e43f1afc8614c6b32eda5ecd583cab002972f6cf936652831bf4f35be46c0bc906b56
TLSH
T1776170809551E9D2FBD8707092C53187FD774A86CC839E3A12A8CBAA5A0A7D41F490CF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 42f8fe2be3d831fe4947237582adee22695be71d7d329bf753faa176e261e7bd
MD5 60f248ef68d057bc12b34ea44b8fd752
SHA1 1926f26a367a2714951b4c2ca53acff32d634f5b
SHA512 7d31f48bcc066417c46990418b785fa4a02628c050b3a109759ae5c0680d91ca43f3fe3f87ac61277baf5a1443b24ccb8f69993305498749dacc56370b2b3da9
TLSH
T12C11AAF7C7E5856E89015AF0AA24AE2BCE2D0505432C7C1A89E4EF2BD3F3476D10295F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 cfce8263db717f24a9b8f9018de309f38683a7dc2f7fff4a985e45cf0203a868
MD5 c2f269c74c5cb9684ba26b0877bcbde1
SHA1 22f482c23b180757d6101520dbe10ce032996d98
SHA512 53b2858f869497c2c6a7cf976dcf163a1ba4777c2be33a8b9702eec3ef1decf2a7ce4e38725f145da1c62ed8ba96442402605057b6ef88a6f2c0521fcf65777c
SSDEEP 192:sxZDRJWR/fUXs3rlIdpOSHW6+WNdP8/Yap99aIgrJ:sxZDOR/f2s3q5Hbq/I9
TLSH
T15922A956AE28A97B4CC7D21DBA25BF53D6F9503291D11E48EAFCC61C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 cb090a31c7d2859a0d116da3903c24eb1c88fb20245407b782047ed9ce9bada9
MD5 9a770e768f50c80c0dacc162f882882d
SHA1 ca57ac8264facd99794e32f85fe767c08d179d8f
SHA512 080ccc6868cfdb1888dbd7d46240f96a8c5fb539d701ac745a9d29b8250e48e6b0b1665b5600461b2e83a0eb300e2bda22148d4e918432e755df1f5c40c83cc2
SSDEEP 192:sxZDRJWR/fUXsKrlIdpMSHW6+WNdmEXYaph9aIg5qJ:sxZDOR/f2sKqjHbjXUw
TLSH
T1CA22B956AE28A97B8CC7E21DBA15BF53E6F9503291911E48ABFCC71C05F76CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b19adab87d636634c82c547031de80e1bb091acccaa2bfe4c6385536dab07e1c
MD5 9d97185acc9ccc3a4c725953b1a2f7ea
SHA1 24faab31c4641587411e8ed93d4dab0ed780be32
SHA512 c16a5c84a707d9bc43fdd863a184ab75d6d4f1516ce819da7b25b311faac6c376d36a9577e965d49a5299b151a1300292be2f41a54ae9e757219248301f1305a
SSDEEP 192:sxZDRJWR/fUXsvrlIdpOSHW6+WNdP8/Yap99aIg5IJ:sxZDOR/f2svq5Hbq/Iy
TLSH
T1C622A956AE28A97B4CC7D21DBA15BF53D6F9503291D11E88EAFC871C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 47e3314bd9ba773d8a0f1bf98da61afd3afe329262b9d0f5f160a2ffed7dc116
MD5 676dd4551fbb11244cb2391f4c7ec026
SHA1 c761e5a76702cee6580313b608d27449cddc9d3e
SHA512 e2bac5bdcb6d059f3c4c32677fcb483bd9851e78639e283765d4852dcfe3b378812abe368711ba5f45d1e7e225edad1b21acafb987b63ecc2d9ecc3e63c67c4d
SSDEEP 192:sxZDRJWR/fUXsKrlIdpOSHW6+WNdmEXYapa9aIg5qJ:sxZDOR/f2sKq5HbjXFw
TLSH
T10322B856AE28A97B8CC7E21DBA15BF53E6F9503291911E48A7FCC71C05F76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 56cfe9a657760552d6a03a6dc3cb307157911cf3ce931e072d74d3a8a59c6aa7
MD5 66ef19c66a0527abd2083aa613e6cde4
SHA1 9365ee99e699695b66cce34e9a8c6960fd5e98fa
SHA512 fddfcf8ef80e49268891a4dfbbad5f3da7d4056a5e9943e85d9b9f2acc7e83e11ec27bebbb2c18cab3f24620ae83a0b91f07d294074a9c4865c1790b776e88ec
SSDEEP 768:VvWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Cro4dfehmR0:VvWPcLKWvKeEeu1jaClLiF7Z4dWhmR0
TLSH
T1C5C2FA3B640CCB7E4FC01A9DDC5A6FA77E9802C79A548D4047FE994C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6d096d29acbca20b8dab8c18d92457f6609dd45e17c1b8ef2ce96068b81e288a
MD5 d839ce5449345f4c2150fd26869cab94
SHA1 f2a1568e11d9eaea5cc4037bd03dd42d107b00d4
SHA512 ced6ce96e62f0c4e85abdb3df619574dd8c25978e1c1e1b09e31002dfc2811066984d370eaa43b2b7e6fd58fe495b1c68ed13cac6ab8f581fea45e4b06da1e4a
SSDEEP 96:KkRMNhb/LQv3uDJZQKRFJjQNpZeDR9iG0KHqM9OKG0K6/:yPXS1G
TLSH
T1A791755570BB5201387E288C82E59B5E134231B37468FA3BBBBD00E55D2AE091FFD9C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf91d4b6-31ed-49a3-956b-06300932a6b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf91d4b6-31ed-49a3-956b-06300932a6b9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8fe96dc-b95b-42f3-aebf-af335dc7d83e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c8fe96dc-b95b-42f3-aebf-af335dc7d83e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d9146ee278aef8ced663f718bdb33b600b17b9362accd57ffe1501fdb94f0f01
MD5 76891de71a9b2a300a370f07b26b3f75
SHA1 6172f6a5196c29c729074263b778c1f0d73f07fa
SHA512 26facd2bcacc8e647bc58ec5a4e28e2193c0d7c8b496de9dccfba69e381f9b7069a68398b03c7f6828a9985936055a6210bc18ff48215dbcff51991636c2e382
SSDEEP 192:uwALsNobQHZE1QZTQmiU1ZgKU4zIGm1ZFhfZ95FS+w97iC/cjqCmk8Y:ZWsNobp1kFbbrzIGm1nd/HS+Yiz3h8Y
TLSH
T101424976ECB8AC369EE3A544F5863A139EB4812797C42F90D6ED5B1D00DF29C130B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 56d42176f8bbeea21217afa53abea54b70768ac7f711de0a27fe36cade47bedf
MD5 ddff5b0036854e51ee4270f2bf31a8cf
SHA1 640fe0089d4e67be4a429bee596df4da05c11476
SHA512 aedfd2222219f01322a93396b94b243937eb10badab93d10da6e8e2c1280a10fd8a0f744c37a0f7db467ad54c7e3b7eb3c780a1ed585b2d484a5042a5102346a
SSDEEP 384:a+iFiZcIHzsNY8TUNTUlIlbp1kFbOrzIGm1nd/HSfpMiz3h8LoT:oFQT9wgHiNO/endafpMiz3yLY
TLSH
T1F7B208F288E79836D9EE9743A77D2D034DBCC063B5846A80B7D8561DCC9A17FC30A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b8b2b94c0edefdd6aca412b5f9fee42cfee737a70bd310d8d0b7fe6dd3628197
MD5 0278c0244b2446fd68213ae74cdb4006
SHA1 7c2940d48cfea44a7ab4fa71f7fc5c93ef719705
SHA512 582840a4d09ee6d09f95deb6b2c3ace3d5ee34dfe7df7dbdc47e2558cb2bd861de36ddb981d474da442e8d230a7d3092935e860d4a89c8c382be94a2081b10c1
SSDEEP 192:aONH6IE7QmiUycjTPuIGm1ZFh0C7sntU6:aONH6DtFPuIGm1nnstU6
TLSH
T19D02E835EC78BC77DEF3AD05F4877A236EA5112BAA912F84D9D81A1D00D724C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b20e9075174925f472b670cf3aa7c1eb3e6bb859ca814e7d6b6ebe38d5469a0c
MD5 56092c301490e593b0867cf2a7839968
SHA1 36a88ef7db1d4290ffec256b7c1c837a8622fd14
SHA512 c597eca2a25b3d7af211d0e3cf91307b548d6b846dfe9cafa5714831420c623030bc1fec668131f0078cec45c735cfa2c7b5445627afabdada39c2a52b56c3d0
SSDEEP 192:aONJ6IEpQmiUybfjTpuIGm1ZFhfZ95FSv27HC/cU6:aONJ6DH83puIGm1nd/HSMHzU6
TLSH
T1BE12E776E8B8BC779EE3A844F4833A235EA58227DBC56F90D5DC1A1C01EF25C530A917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 9fe2875b2663ba3e95b6a8c495ecbb4915338cd5d80e1bdb10399185d836f608
MD5 1bd3b54797f3896021b537dddfd11376
SHA1 44aad6ab04e7f7f9c2b7b5dec4ac37ad9524c0c9
SHA512 fdb049f67956c1d00896c8567b890f66a7bfb060bf0ab2631f04980ffaaa4685f3da508043c8634c5ef18679a6cb82efc183edf22f1777653f087ec3f4dc0908
SSDEEP 384:ijZcIhsNobp1kFbbrzIGm1nd/HS+Yiz3h8LoT:sh5iNb/enda+Yiz3yLY
TLSH
T133726BB6DC78AC7699F7E144F9823A135EB8812397C86F80D5EDA71D00DB268031BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f1d9684-9692-4216-a89d-18adf9d42a5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5f1d9684-9692-4216-a89d-18adf9d42a5c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 141e3c88e6a0a5a0574b249b99920da22a680b6302a6641872adb3e6ce7ec0ab
MD5 7e809f11c2eb2e21da0c52569999fa4a
SHA1 8d57e45ff9a1dad12017a77aaa93c7895fce7b8f
SHA512 f617156fb563ba4c18af8238dc30ba2fe17d18bc34860f9bf3110bbfc8411a3b5db6a00eee607615953d35d59668974e43ae14017cdc84cee60f9a125832d122
TLSH
T19A410958B7EA1148B3B76F5A9BF6A86D887F79672E0AD54D00110E4F4A36A40C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download