04414c8312138a98bba68817d06720f0f26d7f87632d9b53375a9c5b8b671e38

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NPS-setup.html
Size 240B
Sample260708-wt5q7aev2n
SHA256 04414c8312138a98bba68817d06720f0f26d7f87632d9b53375a9c5b8b671e38
MD5 9f8e6da6947a057d07f031cb4d7a1c61
SHA1 c9a31de16cb479b7f02f5be2f8e82dfb3993b613
SHA512 bd9c63fd5213f84b499c93983352db6d3dc18ea142aef8edfe7b0a6f1ac331ec1939bdf0bd355e8db7fa780938ac8fe69d142928ed525d1fa5621d9cb333aaf8
TLSH
T1ADD0A76EE18B205A152337C079C715C1752422A4B4A749EC6F05B4939518CBE858AEAC
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1288	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280080342303742"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{8E2EC692-6F4F-49B2-9415-84C6722BAD72}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 4220	2956	msedge.exe	84
PID 2956 wrote to memory of 1288	2956	msedge.exe	85
PID 2956 wrote to memory of 2380	2956	msedge.exe	86
PID 2956 wrote to memory of 2380	2956	msedge.exe	86
PID 2956 wrote to memory of 2380	2956	msedge.exe	86
PID 2956 wrote to memory of 4832	2956	msedge.exe	87
PID 2956 wrote to memory of 4832	2956	msedge.exe	87
PID 2956 wrote to memory of 3328	2956	msedge.exe	88
PID 2956 wrote to memory of 2936	2956	msedge.exe	89
PID 2956 wrote to memory of 3328	2956	msedge.exe	88
PID 2956 wrote to memory of 3328	2956	msedge.exe	88
PID 2956 wrote to memory of 2936	2956	msedge.exe	89
PID 2956 wrote to memory of 2936	2956	msedge.exe	89
PID 2956 wrote to memory of 3980	2956	msedge.exe	91
PID 2956 wrote to memory of 2384	2956	msedge.exe	92
PID 2956 wrote to memory of 3980	2956	msedge.exe	91
PID 2956 wrote to memory of 3980	2956	msedge.exe	91
PID 2956 wrote to memory of 2384	2956	msedge.exe	92
PID 2956 wrote to memory of 2384	2956	msedge.exe	92
PID 2956 wrote to memory of 4308	2956	msedge.exe	96
PID 2956 wrote to memory of 3996	2956	msedge.exe	97
PID 2956 wrote to memory of 4308	2956	msedge.exe	96
PID 2956 wrote to memory of 3996	2956	msedge.exe	97
PID 2956 wrote to memory of 516	2956	msedge.exe	100
PID 2956 wrote to memory of 5036	2956	msedge.exe	110
PID 2956 wrote to memory of 1576	2956	msedge.exe	111
PID 2956 wrote to memory of 776	2956	msedge.exe	112
PID 2956 wrote to memory of 1904	2956	msedge.exe	114
PID 2956 wrote to memory of 1904	2956	msedge.exe	114
PID 2956 wrote to memory of 3288	2956	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\NPS-setup.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b0,0x7ff8bdddc188,0x7ff8bdddc194,0x7ff8bdddc1a0
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,13860595287877487548,7036014625186702147,524288 --field-trial-handle=2736,i,4924704669808545469,2772910502533266225,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,16312921785931593265,3227099713341891373,262144 --field-trial-handle=2736,i,4924704669808545469,2772910502533266225,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:2
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,4892327130712197736,3092065624252475286,524288 --field-trial-handle=2736,i,4924704669808545469,2772910502533266225,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,13670785111228260016,14989213884438897273,2097152 --field-trial-handle=2736,i,4924704669808545469,2772910502533266225,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,1077859993641679375,10852294422991223926,2097152 --field-trial-handle=2736,i,4924704669808545469,2772910502533266225,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,16579770577567907972,10194217408444536555,2097152 --field-trial-handle=2736,i,4924704669808545469,2772910502533266225,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,6684716163779743173,12833794628736396279,2097152 --field-trial-handle=2736,i,4924704669808545469,2772910502533266225,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,18217594497404124711,2463161643118488877,524288 --field-trial-handle=2736,i,4924704669808545469,2772910502533266225,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,5305329223136859948,16966461962140009084,524288 --field-trial-handle=2736,i,4924704669808545469,2772910502533266225,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,12611916301900714653,14809582894462241066,524288 --field-trial-handle=2736,i,4924704669808545469,2772910502533266225,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,12611916301900714653,14809582894462241066,524288 --field-trial-handle=2736,i,4924704669808545469,2772910502533266225,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,8498588619752178210,4979513899833354225,524288 --field-trial-handle=2736,i,4924704669808545469,2772910502533266225,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,9505783191306154178,16787213653679088053,524288 --field-trial-handle=2736,i,4924704669808545469,2772910502533266225,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,6098524001934738713,27057859461952456,524288 --field-trial-handle=2736,i,4924704669808545469,2772910502533266225,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,3676154791276815421,6855077486500848163,524288 --field-trial-handle=2736,i,4924704669808545469,2772910502533266225,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5688,i,7483131312871261495,1233023981711196499,262144 --field-trial-handle=2736,i,4924704669808545469,2772910502533266225,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1bcaa34d602db96912489c5865a08edbfc5a54b824182856996a4f80da4b3999
MD5 95e61ec15ee2f521fb2b6a99788cdbd2
SHA1 15b1a78b16f07f9881fc8144cdd7f3e4cc289b12
SHA512 8e5bcb191602ef09adb7d68e4ee5affc530f850cd8f9cdd335306d48a565bb435cc6342aad399403a266a2ac8095955d7332624a345bce4a9eff421342be85ea
TLSH
T1E9616E37CA12C463FB6642B298C302DA747F89ECF4175E8D1113557D371CB29C229784
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585399.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585399.TMP
Size 3KB
SHA256 9bd6cacedd0beb861a12749539c906efe1a03c234017d1e254e432de1fc840b5
MD5 d17acc5c6343c3d2947b01be2123581f
SHA1 b13d0252568ae855bd598855ed238b201223670f
SHA512 7a0b072420a64d4a9ef80d66b39398dc718e557d47c53cc24b8d3848436a9ad39d43f740c534f22fdfec7a7d9a13d0c3a4205f9069f5005e350240ccee60b773
TLSH
T1AE615E378A11C463FB6601B298D301DA747F89ECF4175E8D1117157D3718B29C228384
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 76e71f38c2e4410da487aa155c906734ad67c8824adf2313831dabb4496ad83f
MD5 1e836ef5adff75ffa4bb45ebe5d7d32a
SHA1 d8fa735aeb8e5c816d77badc570bfc8e6937ff3d
SHA512 40ae0323c1cc1c91c12d194bd274c88e8fff303c28918abcc2893aa5050ee78e746369e75c70ce9b6732fb38bdabfa79445b7ce26d7c9beff3192c23d59053eb
TLSH
T1A221ADF3C3E5856ECA1156F0AA28BE2BCE1D0505432C3C599AE4EF1BD3E3479E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8eabbb3cf40b967964b0bf1e18b54450a8db6f033c0bc6b84e477a1dc820dd49
MD5 2a5a8dbd10563ad835046ceaf6229c16
SHA1 1535c9ed63efd46c797a0e5618c33e5f5e4fe219
SHA512 c0f46ff633d164742945d98bc1e4027fdc4eb1a1e2c9fc7c5982732aea6489a719577df003afbe092757db4431ad53bb00943e984e825eba86d1b1999be5b923
SSDEEP 192:sxZzR7yM/jK1Ml8UQhkJ/fLsxAEKDlIdpHHHW6+WNGYC65YrqjIg5QJ:sxZzfqyJ/fLsHmWnHbG7AK
TLSH
T18252FA126A385977CCDBD209FA41BF93D6F9547296901E44AAFCCB0C01E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1cb6f9a06cee162d3f9154b0c353d30f8a0b0268c260ef6e80c12ff72157990e
MD5 0f53f3eebba297375e5f0a99c4ce9ee3
SHA1 ebff45817695ec75d61c097331d8a144ca0c2a0f
SHA512 d1bc47396439dcbcfb10f780d04e2d75fe1bd21831ab6c901f2a008f1716e1bb4686841ee7b15d513b697acaa2acc47ce0da2f6a280309ce176120b56d851e12
SSDEEP 768:Ap8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKV/roI:Ap8bqn+WvSCt6u1jaCZLbWVsI
TLSH
T118D20A3B280CCB7E4F845E5DED26AF962DD801CB6B988D4447FA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3053de2-fcbf-45ca-a0d6-11d49cd643e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3053de2-fcbf-45ca-a0d6-11d49cd643e7.tmp
Size 12KB
SHA256 7b5378187c82fce24b5c8dc8c5197c4910f9e0e9040b533f956d76eb0a425768
MD5 59b68dd89b7eb64bca93a2db3febbe23
SHA1 acc31dfb739a92227c49b25c6d1fae6b3827a5fc
SHA512 70e2f6ed316f79a22cb51310ddfae9a8322bbf134a5d6707be1f8c58818c9f0813901c5f509665a02912d7e918018c9c96b17ed9a536e243b02ad40547e6c907
SSDEEP 192:sxZzR7yM/jK1Ml8MkJ/fLsYAEKflIdpdHHW6+WNGYCk5TrqjIgrJ:sxZzfMJ/fLs0uWpHbGuA9
TLSH
T15E42FA126B385977CCCBD209FA457F93D6F9557292901E48AAFCCA1C04E6AEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f037.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f037.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 61939d6d4b81df77a877f203477fde716e1bf146a3a8663b5b84898f9357ea09
MD5 b0ac079c1dbb48c122b2e621baca9e16
SHA1 957d3e37135c089cd3e731289a29b3e3a37bc376
SHA512 ff9cab6e027639ff2e237493b39cef525a1ebd53e733d6be1e06a58dfdb25ba0ef703d42aa8bc05113bcd8bc1ff73c80e30aa5ed432e9c2e87a5b0cfaa77daa2
SSDEEP 192:uOLsNKy6Qehj41biaAQmiU18s9r4Ea+jN+FdChHtFKam/Crqu8U8:DsNKpNZreQ0Ea+edyjq/O8U8
TLSH
T125321B366C785C7799E26558F8473613AFE450779ACA3F90D6ED9F0C00DB69C130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 d53c3365e9adfc0005ae0b68a0b097acf2a42be26591bf09d85e1918bc845135
MD5 2950f8c0194c6b2f1af9e8ced4faf745
SHA1 71484064de4b18823c721d05c0b42368476b72c3
SHA512 e66322dffa73b43a59e5b21e5a3d79de0f8811973194a72d5a6632282a25259fcde9e49b52bbbc9582d43de1b3fb1bb815a55bf17d2f5ae15d8477f27f64341e
SSDEEP 384:JiF1tNn/s3n9SezsNS8TUNTUlIlCNZreQ0Ea+edyj5/O8Scjmwc:gF1j+91fwgWEQPa30d71jQ
TLSH
T1E3A25C335C58996BAAE65A89F94B3213CFF850B389C66B91E7DC9E0C00DB5EC1307D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 598869856c7e8dd178c4cbe66da3ba05b60876f9bde37faf71c0262967fec2c4
MD5 0f32ae72bfd27fd58fc7d1818e88f05d
SHA1 9a8e51bbb03d07d9d5c5924e31c8544d426a3fbd
SHA512 d1796f711dd00c7cc27b534811ff5a6483b5a7e01453d828a28352b50e704e07a4917d51f061738a39931d28dd15f302dcbe24cc458c780cdf0b17cb6b00b29d
SSDEEP 192:eONb6DbdQmiUy8bFUBa+jN+FdChHtF5Nz/Crqu8U6:eONb6zdJUBa+edyjv/O8U6
TLSH
T1F812293668786C7B9DD27954F88736139EE55127DE8A3B81E6DC5F0C00EBA6C130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f5c131d5d7d45279fa13183c94212d222acf2ae230c2808e181d83f2dc08e7ea
MD5 a9a70b6256916ea770510386c8a15d08
SHA1 f2be5ae128f111a55c77c3efec429fa6642c1459
SHA512 11529b08ec8e3bce6816a5aee651bff792ae370b32d9113dff4638b279f3cd58f5e7451bd85199b986caa244537a484d927b004bdd8808d2cf4f959a54d9a07c
SSDEEP 384:EtNn/s3n9SfsNKCNZreQ0Ea+edyjq/O8Scjmwc:Ej+9UWEQPa30e71jQ
TLSH
T101928E376C685C6799D26559F8473617DFE890B34AC62F80D6EC9F0D00DAAAC1307D3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dfd50974934d574d2d8be27dcce6490738eb9299435304adf2e7dc2aad6840a5
MD5 6e53ccf45e050328b80897e64548c60f
SHA1 bd014b74a6a7cd896f1d5c6fdd45be80474070bd
SHA512 624059700d7ecb67ed09e883aa12016a98668390c1878f04fd776ee7df6d1217cc3a90334f3b56b6d2d8826ecdb8d2da8afe140eaa29d0e832336d0e81dbef32
SSDEEP 192:vONu6Db6QmiUy8SFHBa+jN+FdCtRg/pU6:vONu6udsHBa+ed7RU6
TLSH
T19C02D83568786CBB9AE26E49F88737275FD4203BD9962B54DADC5F0C00D7A5C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5df97704-6d77-4710-b0ec-d7cf79cbc8bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5df97704-6d77-4710-b0ec-d7cf79cbc8bb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 112cad370631996397322321fdae070d22ab253dc49f5661425b0b2abf713007
MD5 1e9350c0bb6dac9ce71b3a31050505f9
SHA1 2edf3369b78c05ea040d3b0f4550e1569edba54c
SHA512 d92d87fce922534ca2bee9a590e3cfa2dc4525dc978bf31d5b8f3876d8537064dba14317db2d7c0a21471a2e6524814e8364cdf1210947c26211e70d7c946748
TLSH
T113411C5CA6FD1148B3B76E4AABF7B86D487AB9372F0AD45D10110E4E0666B00CC72B37
MD5 SHA1 SHA512 TLSH

Submit Download