hxxps://jrbrunoassoc-my[.]sharepoint[.]com/[:]u[:]/p/michelle_thiefes/IQCufNEfg07dQqe9kPSpuCQpAV47ex4hE6ilmMBriBcEZVY

Analysis

user interaction
yes
max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 13:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://jrbrunoassoc-my.sharepoint.com/:u:/p/michelle_thiefes/IQCufNEfg07dQqe9kPSpuCQpAV47ex4hE6ilmMBriBcEZVY
Sample260709-qhj3fsbs8q

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2368	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280765481056597"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{BF667C3B-A9D4-4626-9BCF-C32C6E68D83A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 3328	4132	msedge.exe	86
PID 4132 wrote to memory of 2368	4132	msedge.exe	87
PID 4132 wrote to memory of 3868	4132	msedge.exe	88
PID 4132 wrote to memory of 3868	4132	msedge.exe	88
PID 4132 wrote to memory of 3868	4132	msedge.exe	88
PID 4132 wrote to memory of 2916	4132	msedge.exe	89
PID 4132 wrote to memory of 2916	4132	msedge.exe	89
PID 4132 wrote to memory of 2572	4132	msedge.exe	90
PID 4132 wrote to memory of 2572	4132	msedge.exe	90
PID 4132 wrote to memory of 2572	4132	msedge.exe	90
PID 4132 wrote to memory of 2336	4132	msedge.exe	91
PID 4132 wrote to memory of 2336	4132	msedge.exe	91
PID 4132 wrote to memory of 2336	4132	msedge.exe	91
PID 4132 wrote to memory of 4848	4132	msedge.exe	93
PID 4132 wrote to memory of 4844	4132	msedge.exe	94
PID 4132 wrote to memory of 4848	4132	msedge.exe	93
PID 4132 wrote to memory of 4848	4132	msedge.exe	93
PID 4132 wrote to memory of 4844	4132	msedge.exe	94
PID 4132 wrote to memory of 4844	4132	msedge.exe	94
PID 4132 wrote to memory of 2416	4132	msedge.exe	98
PID 4132 wrote to memory of 4548	4132	msedge.exe	99
PID 4132 wrote to memory of 2416	4132	msedge.exe	98
PID 4132 wrote to memory of 4548	4132	msedge.exe	99
PID 4132 wrote to memory of 536	4132	msedge.exe	102
PID 4132 wrote to memory of 4356	4132	msedge.exe	108
PID 4132 wrote to memory of 2036	4132	msedge.exe	109
PID 4132 wrote to memory of 2148	4132	msedge.exe	110
PID 4132 wrote to memory of 4968	4132	msedge.exe	118
PID 4132 wrote to memory of 4968	4132	msedge.exe	118
PID 4132 wrote to memory of 4308	4132	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://jrbrunoassoc-my.sharepoint.com/:u:/p/michelle_thiefes/IQCufNEfg07dQqe9kPSpuCQpAV47ex4hE6ilmMBriBcEZVY
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffdba86c188,0x7ffdba86c194,0x7ffdba86c1a0
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,10250147949020805626,10879334737338431710,524288 --field-trial-handle=2284,i,17043470829478319288,15738267021828771220,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,1449178757683195417,530923237264810867,262144 --field-trial-handle=2284,i,17043470829478319288,15738267021828771220,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,16097787557534651614,9057620614695516368,524288 --field-trial-handle=2284,i,17043470829478319288,15738267021828771220,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,4080413202444648592,17001661563387254875,2097152 --field-trial-handle=2284,i,17043470829478319288,15738267021828771220,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,12627425163520692352,10984895990878108461,2097152 --field-trial-handle=2284,i,17043470829478319288,15738267021828771220,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,13517627776567462567,16811809052807476458,2097152 --field-trial-handle=2284,i,17043470829478319288,15738267021828771220,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,6494363581848327766,1906124161774526489,2097152 --field-trial-handle=2284,i,17043470829478319288,15738267021828771220,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,15996521091380632091,12732228869033734350,524288 --field-trial-handle=2284,i,17043470829478319288,15738267021828771220,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,1703454839536312725,1993106572993327709,524288 --field-trial-handle=2284,i,17043470829478319288,15738267021828771220,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,18227712297083427376,6167721945368216129,524288 --field-trial-handle=2284,i,17043470829478319288,15738267021828771220,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,18227712297083427376,6167721945368216129,524288 --field-trial-handle=2284,i,17043470829478319288,15738267021828771220,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,10773555903897580799,17074967707406413520,524288 --field-trial-handle=2284,i,17043470829478319288,15738267021828771220,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,4972180160323303361,980824119928225236,524288 --field-trial-handle=2284,i,17043470829478319288,15738267021828771220,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,17982652676069375039,1956070339127533644,524288 --field-trial-handle=2284,i,17043470829478319288,15738267021828771220,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,4203027138100466006,17129030638996825657,524288 --field-trial-handle=2284,i,17043470829478319288,15738267021828771220,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5284,i,6616122690920807457,16082153133834284552,262144 --field-trial-handle=2284,i,17043470829478319288,15738267021828771220,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fc30c815a047c801a9f93e3cdddd1546226e662eae26f2ecc2fdbdd36a683b35
MD5 b1608f15e17859a209aece52043aaddc
SHA1 7ff68c93b505d569f76300232c67504743ee7dde
SHA512 cd656be57667324e356180a5095e94208edf836ada833950925776e4b811733e389278dad903cc33fff0d03b66acb6ecd9283668a496f9703ad759d2f517f6ff
TLSH
T16B71713820434FB9EB61A17388CE109C773082F5F8125ECD5DA4E6B469E5329CED6759
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f855.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f855.TMP
Size 3KB
SHA256 b9e0ec3a80d1e237ed1a1eeee64a246ddd353474147180ffc9222ead17bb2091
MD5 8a95989bf89b350fccfba8e91dd93728
SHA1 5ff3efee601cc9829c706a89e4e1d0776c1d974b
SHA512 585be370d22509b17ea31199861505cdc263dd2a426922290e8dc8ed50f3267930d9881a3c51d69bb7cf5bf1ca908edb861c0a33994cc742c1759f9b4989d130
TLSH
T153715F3820474FB9EB22A17388DE209D7B3082F5F4135ECD5CA4E67565E1329CEC6759
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a9daed939365b4d186c72c75be92ac64108f40ac1802264c8537fcdefa355ff0
MD5 b86a800003a3c469b8e302db8a7aade7
SHA1 4d7b71f4d74869aad7125223d40fdedbc3d7708a
SHA512 edaa0bace57ab5c97b7af1db4293ded84610bd503afa8c3812c0cd0399eb5ca57b1c69307b602ab937acef37d9dc62a714c7c4738c2544a7f7752d99e3882de5
TLSH
T17741BCF3C3E4862ED91152F1AB157E27CE6D05554B683C26CAE4EE8B93E34B6F10160B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 19a486afb8aee407b90908006593f7bcb9e0ba5d13c01009d184ec28fd13f100
MD5 c8891bd5e3fe7b12395db999803dcacd
SHA1 b784ed4091202d5b6df946e3822ee8f0c8181fd8
SHA512 26e946169f7ec5fdd22b32cbd96d9700a9dfe526a39110cedafa75a3076382cf3d70a05d6ce0c4dfb75cb06f906560ae769d273a8aceb61ddfd1742a0ea3814c
TLSH
T100419CF3C3D4862ED91152F1AA157E27CE6D05564B683C268AD4EF8B93E34B6F20160B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 592a890cf9020e2f8b76e9b22850503d87371b6f987a59db50e7f3ff29c2245b
MD5 db7794c7623b675235c780ae7e916f75
SHA1 d620be6b6c81a023aacb89b8d1b4462b0711881a
SHA512 4fbbd38b3c9e4fd5ea024fa9411d863033880bb363d413b5ff021045c170bc337e310fef4aa8a8c34215055cd0e1b9b061482b7cd90cb7b3a4fbe080cce4149e
SSDEEP 192:sxZiRJyM/jK1Ml8Mkd/fDsSVvzh4Idp/UHW6+WNunl/YzTwnNIgrJ:sxZi3Md/fDsULzMHbg/d9
TLSH
T1F552E9526A349977CCCBD209FA457F93D6F50572A2940D48AAFCDA0C01E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 168bd0800c593e1311301edfe8016b5c7c44574b58908f47417420dd29d7ebf8
MD5 f550255f8d9c67ca6f34809252777f68
SHA1 4573ea1de36f304ea90d1d1b42d915648280e6b1
SHA512 cac812531fcf89d4e8bbf31f3e6ff28f9c35be07f2f40cd0c8516e814107c80fd34691f403dceae2c77b13103be706440dbff745db4af560d934aeb4553222ee
SSDEEP 192:sxZiRJyM/jK1Ml8UQKkd/fDsAVveh4Idp1UHW6+WNunl/YzsX7qlNIg5WJ:sxZi3qZd/fDsGWz+Hbg/63g
TLSH
T12A52E9526A349977CCDBD209FA457F93D6F5447392901E48AAFCDA0C01E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6ee9e6e53bed22623a8861355a0d45cc81ab9a06c840e034dcf29c63d0dd8e52
MD5 8fcddc5204a443eca85c98458206e3fb
SHA1 03b9a659323bdd9ec4af097f257d7905f70646ff
SHA512 9f3e973729113bff52f3eb6c9a1a4ac5c0b388cc699bbb508336637437d705b362174ed91f53a0d7c8be78d4c1cdfa710ebdc6c1af02446b5b72599636aa4124
SSDEEP 768:d0W7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjaroItipjYq:d0W7kf0Wvqidau1jaa5LA3jRvEq
TLSH
T1C8D20A3B684CCB7E4F840E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 172eb625d65d671badf9ac95b2c9ef0149f585e048b4d29d9fed1e9369eb535a
MD5 7f0a5809324430de6b2e6b4448af1192
SHA1 1ff52a1f9a88b62f7855251f02e2792943a52336
SHA512 d93af7eac7937510f6f2cf72b410479552c852b044d7ba7402a409fe04fa0df40fd99f6c3f26ab12208ff49ab5a1b251a8d13f77b38cb481fcb31458a8e0b368
SSDEEP 96:KIbCKcfJiKiQamvGKYIE7kh1DZpVW9yogdVK4kgE:sSJFn7kh1DZpg9yJdfkgE
TLSH
T18B911392733B0601387D6908A6699A379E8331937419A46F7BB801B11F26F225FFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf781d37-c1ee-47c8-ba8f-1b3c5fc9f309.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cf781d37-c1ee-47c8-ba8f-1b3c5fc9f309.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a12366716c1d83a6b59dcbb5026b2e3ebc1f03a85ee9eca6aa33f450c799a74b
MD5 b78123ffb683e8bd2880d374fc9c2b69
SHA1 73970298e5d02e0ecf3e7383f3bf831eb88573fb
SHA512 efad78ffd48470655c2bc9fd45947e8af6cde94ddf6c0fd0b8ac09f648602d4e1558bdfcad4acc633bcec33582902ffc3727d75b30a05c5cf3618e449845e8ae
SSDEEP 384:stNn/s3n9SfsNMF6Wbl9QSOdWGimBqqOObjI9G6w7ZC:sj+9UMWYZoGi+qq29MU
TLSH
T18B928D326C3A9E375D925195F0873A079FF8427B97C42F48E6EDAB0C06DB2AC5313405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e1cd2c300d03b576b32325c9f0bdb85ef742809796435b68dd365077b117fe69
MD5 d454044aab46d396d4eae4e6beb5c927
SHA1 38dbc8c7e9a27a58255ca0e6b3da3c89ec5839f5
SHA512 ff1ac59d863ba9ee7ab92744b097030ae3ab1a9b5aba3285fbe7f3f35a6015062113bfdeb554afcb91f00db0ef9d93d43dab24e30912e5d0787f83903a14bfe7
SSDEEP 384:RtNn/s3n9SfsNMM6Wbl9QSOdWGimBqqOObjI9G6w7ZC:Rj+9U5WYZoGi+qq29MU
TLSH
T12B928D326C3A9E375DA25196F0873A479FF8517B97C42F48E6EDAB0C06DB2AC5313406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 10d55c563e4ca8303f2255307657d2d3981477e57ed6a72c09d5c8e6f2a5d43f
MD5 5a5145b4468363fbd88b9665f1ecb8d3
SHA1 25764f3dfa78eaa2511f7f40d86e0acb87ee342d
SHA512 c94a4b7ea13d170c8ab21b02d2f388b7b1246778a0d0804427f2ecc1ee52f270e8c5bc1c33331110258099990b2556d6096fce063f99347e86fb137161317a56
SSDEEP 384:SiF1tNn/s3n9SNzsNE8TUNTUlIlM6Wbl9nFSOdWGimBxqOObjI9G6w7ZC:ZF1j+9Khwg3WdZoGi+xq29MU
TLSH
T1CFC219F248D7893ADD6E5747B37E2D029EBCC167B6842A44B3D99A0CCD961BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b52d6e4473b9ec4fc2a299a27484e60d8daae45caf37a9e65ea727a0196f3a75
MD5 fea6dbfe5968a48443928372776d3f7d
SHA1 4431eb73c3a487bde1cf6cdfd127bf3ba73c8282
SHA512 33ead26b51dc66324a71cd67a032f7ae590402704bdad59b3db6d1e031b930014e2e699bb4a139bb31c840374ccfa6e71c19443c5a158a66376d8449b2a39bdc
SSDEEP 192:MON364BAQmiUyL1GW5GBPKmx+FdG+Po5Z4aDGZ6U6:MON36eAwsWldWFA6U6
TLSH
T1E402D735AC796C7B9EB2AE45F4863B175F98113BE6C12B44EAE85B0C019735C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6c445c8c4e184e94ad04e176880e0fe68631ca53fb07838ab89fa55a5348f1a7
MD5 1819b1e43b1d7f4da2ca1b11c15b9a17
SHA1 f0007b923e63a63fec66334d3c8b04243fc55e67
SHA512 fc69a26e545f500da82df55ccab49a117cc36891dc939ed4a1911db6161d137dc593363ea36531ff2aa02fdd4ba570be366c700cc98955bc1bbf7952740e0dd1
SSDEEP 192:BONt64BNQmiUy1yGO5GBPKmx+FdG+Po5Z7pEimM+fWwQrq8U6:BONt6eL6nOldWGimBLqU6
TLSH
T18012FA356C79AC6B5E926545F48736435EA8512BEBC57F44E7EC670C01EF3AC2307806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38ee0df5-5ce7-4482-b9a6-71b1b31b18fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\38ee0df5-5ce7-4482-b9a6-71b1b31b18fb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1f48e465959d6a6f4b22697f8d15d583a0ec1cdda6d124b9f98a170ce0fb53c8
MD5 e7f488484a1291fa9058df3d803d3546
SHA1 65d7b8940cccde592aec63ff97289244d1c6c3ca
SHA512 c6dcaa5e50c7bc6915e0551c88620f296212f73083b733dc08c1820f783eff2db01e363ebb867dabea1169fb87cfa72ba083c508a9735fe6f752569a5b7c1a65
TLSH
T1DE413B69B6FA1118F3776F1AABF6A96D087FB8772F06D05D00010E4E0A62A44CDB1737
MD5 SHA1 SHA512 TLSH

Submit Download