hxxps://caremarketplatform[.]online/f0m/a0c0ba?86

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 08:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://caremarketplatform.online/f0m/a0c0ba?86
Sample260924-kv898aaa56

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
31	href.li
32	href.li
33	href.li

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5040	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347138075600643"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{6659BA20-FFC8-46F3-A260-58EFCA361D8E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 5572	988	msedge.exe	91
PID 988 wrote to memory of 5040	988	msedge.exe	92
PID 988 wrote to memory of 2248	988	msedge.exe	93
PID 988 wrote to memory of 2248	988	msedge.exe	93
PID 988 wrote to memory of 2248	988	msedge.exe	93
PID 988 wrote to memory of 5940	988	msedge.exe	94
PID 988 wrote to memory of 5940	988	msedge.exe	94
PID 988 wrote to memory of 5996	988	msedge.exe	95
PID 988 wrote to memory of 5932	988	msedge.exe	96
PID 988 wrote to memory of 5996	988	msedge.exe	95
PID 988 wrote to memory of 5996	988	msedge.exe	95
PID 988 wrote to memory of 5932	988	msedge.exe	96
PID 988 wrote to memory of 5932	988	msedge.exe	96
PID 988 wrote to memory of 2100	988	msedge.exe	100
PID 988 wrote to memory of 2100	988	msedge.exe	100
PID 988 wrote to memory of 2100	988	msedge.exe	100
PID 988 wrote to memory of 1740	988	msedge.exe	101
PID 988 wrote to memory of 1740	988	msedge.exe	101
PID 988 wrote to memory of 1740	988	msedge.exe	101
PID 988 wrote to memory of 4396	988	msedge.exe	105
PID 988 wrote to memory of 5884	988	msedge.exe	104
PID 988 wrote to memory of 4396	988	msedge.exe	105
PID 988 wrote to memory of 5884	988	msedge.exe	104
PID 988 wrote to memory of 2456	988	msedge.exe	107
PID 988 wrote to memory of 1256	988	msedge.exe	114
PID 988 wrote to memory of 1256	988	msedge.exe	114
PID 988 wrote to memory of 1256	988	msedge.exe	114
PID 988 wrote to memory of 4812	988	msedge.exe	120
PID 988 wrote to memory of 3960	988	msedge.exe	121
PID 988 wrote to memory of 3168	988	msedge.exe	122
PID 988 wrote to memory of 464	988	msedge.exe	131
PID 988 wrote to memory of 464	988	msedge.exe	131
PID 988 wrote to memory of 3104	988	msedge.exe	132
PID 988 wrote to memory of 3104	988	msedge.exe	132
PID 988 wrote to memory of 3640	988	msedge.exe	134
PID 988 wrote to memory of 3640	988	msedge.exe	134
PID 988 wrote to memory of 4692	988	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://caremarketplatform.online/f0m/a0c0ba?86
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe62eec188,0x7ffe62eec194,0x7ffe62eec1a0
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,15380453997849453376,4221678294999884334,524288 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,2238449269504780812,59311995773065603,262144 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,8123341250155130524,17203514929087649807,524288 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,9532658363283178918,13627816892977442071,2097152 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,5069096599321245912,5708035995505914056,2097152 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4936,i,10321582414155396757,17884566522003773221,2097152 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4876,i,15954373081461959397,17157029960021944323,2097152 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,16049533481096959246,13320927752648940529,524288 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,1864941658346746500,8656268433474598763,524288 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,15510939148004505146,8619743202684307978,524288 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,15510939148004505146,8619743202684307978,524288 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6120,i,14687547598448315761,1782791627655269364,2097152 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,6562405758683470669,2850601949569778093,524288 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,7736794888614373715,8592335981452771225,524288 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,11102919377987436360,4052534851260070346,524288 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,17829359375953961296,6819359334613011372,524288 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,5182199224115003387,14715188769195590913,524288 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,184493486061720838,11392890979292436265,524288 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6588,i,14278833377903481042,11944607537476250698,262144 --field-trial-handle=2280,i,8857092614190581587,3240102229886915936,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 51629e51cfb56b20035a67cb764f769165ba61d4d17a22122d9e01e076dce17f
MD5 6ce629806621c017f83f98187e662d5a
SHA1 4756a393388eaade16a7a23ba499b6188c60c9f7
SHA512 c787b5cd6a22fd13e54d4c3fb96f0b52d732ba2f64332a0da7240c95843b9c01f02ac0e219361d0119098e46de414d7d3e2bd870abfc048e6e8ad45458d5fd5f
TLSH
T1AAE0809A05D5C65F510765CF45994B4CC190771E97DCAF4D6B04884CB14274763919E1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 db6f7a4282ab28242231209b6cf197e5e50bdb00de7b64be0eea4b014839b662
MD5 de89df2c430709822e515f3b2a5ce447
SHA1 16fb497b4b3253c762a5b714c96f20a3397d118a
SHA512 a12507d7a87e016fc19477dd7752e56b39228a49d4c5ee41335ef3c989ecb9a249fe74623bd207be05f3fc38a46a2bfa687a7106a3a1b7ce670c187e4068d37a
TLSH
T1A1F028B9D821EC3B18FD1B3D20950B46FB50237B2A51984B3B3E911C8FB1A7B498582C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9e8a11ff18dcd27f50a4a61921a831b7cefb5130505d229c920f3e7c067a0fa2
MD5 eb424c0a767ea72736ee24dade13ffc0
SHA1 f715ff4289adcc9a821de4121532e34060db0bee
SHA512 948e1ed52dfa07b3292ab0972d58b97e2f4276c70e19c9dc778f337307aa9cd96f67bf93b4159124bdf5128f6a3bc636260a7de0ed64608da1b85b3894621a08
TLSH
T12751E88596A1C09DFB94B3B185DF208A3A7846BDEF825FF21DA4E87C5C0EB1442394D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f1dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f1dd.TMP
Size 2KB
SHA256 1d19a7e1acbafd2a3093b2aaa0ac7d5d7a7c69b1bb97b4e241e22fb9fbd0ac48
MD5 a90ad6a96b8211fe420d4a4cbc522d1f
SHA1 fed97556fb1b94d9a4a7fa678a68ff76bf358cc6
SHA512 798728832603b97c220a5944ce334c2e1ab60115cd67e50d24698961fd68fe8a96a9dd25e447574c790cfde268cbe0e88864a51f0828e783378045d30c89c718
TLSH
T14D51FB8596A1C19DFB9473B181CF218B3A7846BCEF825FF21D94E87C5C0EB1442390D4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d04050be60137e9a6046d77c14a246f29850933ddc8662d9c16325f5ef576d48
MD5 60db84e9ac0222464a63fce647a7acd6
SHA1 07801c3567a775b71f92a1ce0721e1b8e2cf83bd
SHA512 8785d52a10e6e33139305783a6dcd25accdd9ba87671f17d1ebd08174dec49d7e94a64ce809cd64351591e05d500e0b411d9ee4f1843c0f71085c47ca409627c
TLSH
T1CA51ADF7C3E4862D8A5156F0A718BE2BCE6D0524432C3D5AC9E4AF1BD3E2472E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b7ca1f7d-3ce8-4a97-9eb5-196af89fa89e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b7ca1f7d-3ce8-4a97-9eb5-196af89fa89e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 75d05c9c8aca5f104827ba7fc7bac073325a31d4ec001f4c5b324f1e91e5d778
MD5 b5a0910ad5dbe73d2227873c4f8b0162
SHA1 3341aea9f8b3d5c20052a8807c93bf9ffadc7872
SHA512 e62c2aec0cffa682a8760a09aa6f391f36dc8dd31653e6d83954c9522061ea9dc784b6228765f749822ce914f73dff8ebd1f1e29d61e8afe906858751dfa43f9
SSDEEP 192:sxZpRKkJ/fOsoaQZLQ83zodp8+8HHW6+WNnLzAc/Yoo2SKQZIgjtUAJ:sxZpDJ/fOshOjc6HbP/DSXjtZ
TLSH
T10842D6566D38697B9CC7D219FA15BF53E3F9103290D00E44AAFD8A2C11E7ADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a7be6f66d22a46eac36aa0ff241d6c85c71c69a2f4c67db27eda0c37d96409f6
MD5 d68a5322bda33e4abcb2611911ca9462
SHA1 4985fd53392a802012916efa1eae50c81c49d7e6
SHA512 5062c72d7dc5ea4878b223b73b28689acd4f371ae22fdb61963993546e8f5474b5f4148aee9736c5781c5822dc8bb35dd9e9cea4e148e969fa6843448e4de047
SSDEEP 192:sxZpRKkJ/fOsFwQZLQ83zodp8+8HHW6+WNnLzAc/YoV2SKQZIg5utUAJ:sxZpDJ/fOsFwOjc6HbP/iSX0tZ
TLSH
T16C42D65A6D38697B9CC7D219FA15BF53E3F9103290D10E44AAFD8A2C15E7ADD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b8e2f7de173ddb482d77a5214cd5989515e3e84fcc5d0d1c07b9937cc5aedd34
MD5 5f01be87653b77b80b1d7ea684cea70c
SHA1 d4c32abf56d2c4db09a60fe4955b4d0d1335a381
SHA512 17dcfe1ee5d9f635ee20f45100f24150bb88945e5fbbdc46c0fda6202dcfa7afeaeb893ca15a7b6a5b4d4e6b6ebc62b94d754805aaaaac938ff59bc21b054e53
SSDEEP 192:sxZpRKkJ/fOskaQZLQ83zodp8+8HHW6+WNnLzAc/Yoo2SKQZIg5utUAJ:sxZpDJ/fOsdOjc6HbP/DSX0tZ
TLSH
T10942D65A6D38697B9CC7D219FA15BF53E3F9103290D10E44AAFD8A2C15E7ADD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 6b7130a9f43d956175f65eb46156b857cd4617a8383ad1190e02f8d12b9fea42
MD5 3276982d59735299ae151bd34f2b423a
SHA1 3c09e0277800490e12965e9981525807b0f84d84
SHA512 2f56e6cd0f8377ed723d07272be147d8fe76e338182767e7c97774a9bd409b59a801c8b7b3d98be0f5c5f732619956e457cfb2cbd4eee040aafa51609e1c966c
SSDEEP 768:SL29ObJffppdNlrtONqq7+agMIdMZWC2Beot6a5g6hQ:SL29ObJffppdNlrtONqq7+agMIdMZWC7
TLSH
T1D7C2215571BB421039FE295C82B6972E164231733119EA6B7FBD00B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 92e777c3638e79773e6579d16429ac73d778743dac59d51dd85a0d59015d874d
MD5 7034aa0b571441aa4561032ea3f88090
SHA1 edcf3264736effd662a478a6a2ef2989657b4148
SHA512 e40ba3b022ae4e6379de7cc0c2ac6eb94a22e545ee7ad4cb9633fccf60f7ea5fe06b6449cc016a07a69f874021d253801cf27215987c99196802f0c12ee2936e
SSDEEP 384:n1iFiZcIJsNN8TUNTUlI4maKMFEJwzfvBCT40HnzDBi20/upa7dLKk/KgL/7Izbq:8FQJMwg2UiBCb3Bi20Sa7dLKk/4q
TLSH
T11BC24A72D8A4DABBEDEA8BD5B30A3A03EEF04253998C9AC4D5DD1D1D009799D430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 3ebedc391a22e1f79e6c0cad07e1176fd61057cdb560651327e3317a77404d44
MD5 b0f7fab3c8487b27ef6979d63a2c7721
SHA1 4bed831baf05f4591b08e702a12c3f334f73fbaf
SHA512 8b78c3044d3498f4461fbbfb2065915bcfe17777690af60bdca88314640b30a2cd5e3f451ac1528547dded4479a40edac34a743210cc0db7003379cdacc9c62a
SSDEEP 384:nqiFiZcI43sNN8TUNTUlI4maKMF5JwzfvBCT40HnzEBm20/upa7dLKk/KgL/7Iz+:hFQ8Mwg2JiBCbYBm20Sa7dLKk/4q
TLSH
T14BE2A1F298D78977E8AE4B87A33D2D0299FCC153B5885A84B7D91D1DCC825BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 92caa8a0de46d3fbb875a0ff87e208729f757d223aba2d7c4f9519913b21a0b8
MD5 fd303b9454c996f00a85aea68ff86b6d
SHA1 da1bf8e13b0d5d4ed3cc226ba9777d4b70c66aab
SHA512 4a7fca02164e31bee5ca17cd666e2d67beb0963647c81601fb070ea5d96550264d36071b61e73fa4d3cd3e26fd57481835dd17f361c37c922c25cfe945b91af2
SSDEEP 384:nwiFiZcI63sNR8TUNTUlIm2aKM4WawzfvBCT40Hnz8i2sa+VY1wgL/7Izaof:LFQ63cwgcNNBCbYi2hguY
TLSH
T1DFC23A72E894D9ABECE68BD5B74A3603DEF0426395CCAAD4C6DD1D1C00D75AD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6db05176e4031ed0dc2e853d6ea9e6c37c11f84ee6824dde0c41d8865c31c226
MD5 2b198ec12105e7d7fa73abd6da3e656c
SHA1 53fbc86e785b21d66196faa0134500263f48ad1d
SHA512 3fc52c492f00fe91e55779c68b723abe1334d8827846a831785a1f04ea6d33e12a2651345e102634202d1594d8686c559e64b389c52d5066239abe444f2a5513
SSDEEP 384:nMiFiZcIJsNN8TUNTUlI4maKMJEJwzfvBCT40Hnzgi20/upa7dLKk/KgL/7Izbol:3FQJMwg2wiBCbEi20Sa7dLKk/4q
TLSH
T11CC25B72DCA4DABBEDEA8BD5B30A3A03EEF04253898C9AC4D5DD1D1D009799D470BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 75df5faecdcfd8d0b177599acb77199320cf0cca6e7c8833bc8a75239bb6878b
MD5 dc4338b4bb2084043254d8f7649b2d83
SHA1 149c98199d7bf373f0bd69c917931ffd5f9227b3
SHA512 8cb4fef0cbe321ad06fa781924580b5f51872da631cdbdbe2914d4edc2a3429ed15e8f8f7a07252e9f0ee4591e0a3fc54083368d06624a25dd43fa2111aabca1
TLSH
T1A3410C68A6FD1148B3B7BF559BF6A86D487BB9771F46C45D10110E8F0A62A00CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2456-205-0x000001A6B5AE0000-0x000001A6B6AE0000-memory.dmp

Download