16f483d0790a33ae9f846c7dcfd4bbdbfeb7cad9e8354c24e3783ae5342e0eac

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
courier-system/OLD/upload.html
Size 356B
Sample260722-phbkms1thv
SHA256 16f483d0790a33ae9f846c7dcfd4bbdbfeb7cad9e8354c24e3783ae5342e0eac
MD5 a594bab54fee8ae0c016516d54018200
SHA1 4a5cf73e2b63370d8c8440a02aa70da3a4e3f39d
SHA512 11189cf0dfc488e70181edaeb089cdeababf7a499fab28b60b148442a72696c9c1ccd4dae404ea9c336b7195e2395f25b2d5d1daca0e0aa7e144f38b454b2099
TLSH
T195E0D8A565C96C48427272B8A8C16650A86253425740262570D4D0B3FAB254C85C77C9
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1104	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291963798167753"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{BD38CCFD-32A1-4BBA-923F-9B58BE2753F2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 2264	4640	msedge.exe	84
PID 4640 wrote to memory of 556	4640	msedge.exe	85
PID 4640 wrote to memory of 1104	4640	msedge.exe	86
PID 4640 wrote to memory of 556	4640	msedge.exe	85
PID 4640 wrote to memory of 556	4640	msedge.exe	85
PID 4640 wrote to memory of 4412	4640	msedge.exe	87
PID 4640 wrote to memory of 4412	4640	msedge.exe	87
PID 4640 wrote to memory of 2964	4640	msedge.exe	88
PID 4640 wrote to memory of 1272	4640	msedge.exe	89
PID 4640 wrote to memory of 2964	4640	msedge.exe	88
PID 4640 wrote to memory of 2964	4640	msedge.exe	88
PID 4640 wrote to memory of 1272	4640	msedge.exe	89
PID 4640 wrote to memory of 1272	4640	msedge.exe	89
PID 4640 wrote to memory of 3360	4640	msedge.exe	90
PID 4640 wrote to memory of 4120	4640	msedge.exe	91
PID 4640 wrote to memory of 3360	4640	msedge.exe	90
PID 4640 wrote to memory of 3360	4640	msedge.exe	90
PID 4640 wrote to memory of 4120	4640	msedge.exe	91
PID 4640 wrote to memory of 4120	4640	msedge.exe	91
PID 4640 wrote to memory of 3496	4640	msedge.exe	96
PID 4640 wrote to memory of 2640	4640	msedge.exe	97
PID 4640 wrote to memory of 3496	4640	msedge.exe	96
PID 4640 wrote to memory of 2640	4640	msedge.exe	97
PID 4640 wrote to memory of 3532	4640	msedge.exe	99
PID 4640 wrote to memory of 3316	4640	msedge.exe	117
PID 4640 wrote to memory of 2380	4640	msedge.exe	118
PID 4640 wrote to memory of 4068	4640	msedge.exe	119
PID 4640 wrote to memory of 3100	4640	msedge.exe	121
PID 4640 wrote to memory of 3100	4640	msedge.exe	121
PID 4640 wrote to memory of 3800	4640	msedge.exe	122
PID 4640 wrote to memory of 3800	4640	msedge.exe	122
PID 4640 wrote to memory of 2396	4640	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\courier-system\OLD\upload.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffad220c188,0x7ffad220c194,0x7ffad220c1a0
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,12276531098186542033,4674273613708852847,262144 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,17088513878696118452,2089345591673143917,524288 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,4397353032059715588,17003071004726171847,524288 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,11714562580886326987,8762210472656531207,2097152 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,2137637666835535584,7891029330153734215,2097152 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,15743224243705058745,13925932731799034094,2097152 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,579579341122836848,11616064798472003136,2097152 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,14722077911555987568,5817628761598788001,524288 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,16474403288237767532,5366300093272511526,524288 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,16049153659998384675,16249453002808848080,524288 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,16049153659998384675,16249453002808848080,524288 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,3267187964168098718,10138786420846783547,524288 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,12343129318288742434,2202960324436102370,524288 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,1176079345912793766,13018209943949753257,524288 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,11601240404985925984,12421054556102992057,524288 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,11427732283693141503,1930265433677927880,524288 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6172,i,1635458785270918230,7489113291058031699,262144 --field-trial-handle=2040,i,11946590194476726853,16131168325365187224,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

68de0614-6c52-4376-b884-a868ee389492.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\68de0614-6c52-4376-b884-a868ee389492.tmp
Size 12KB
SHA256 1d67c07b67dc292c7867bc107cc3b8535a7c52fe22676b1643213c6b71f2f427
MD5 d22dc7c011c352b7deb646f1751a74c3
SHA1 1dea6f45793c0163b6abab0619c4aedeb4836f30
SHA512 b4fd004ed242f104a633a59cfd54c2981f3a48a0c6c774a10cd49e4572d3a7b51248c0c88ac310d318218e8cb61cdc7984be8fc363928e46b02e2b11eb86a61c
SSDEEP 192:sxZnRuyM/jK1Ml8Mkl/fdsHEvVnIdpd1HW6+WNGYvrxj7HIgrJ:sxZnEMl/fdsHEG3HbG6z9
TLSH
T14942D8166A349977CCCBD209FA557F53D6F91472E2901E44A9FCCA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 46de6344e2015fb08d055fa2dafa39c4c5742d250fecc13663463b339e0558ed
MD5 f9224b446513d0ec4a55c743c6187406
SHA1 c777e6d63cb0f3071b0d447879888fd4c3e2c0be
SHA512 35dbb4218ea2d2c45e433767ce265a73e12d2e425af6b0c84264e61485a367c9a169c518196684fc309ad4ba6608e207171c00ce6dda75e0e7e82d1db1ab3776
TLSH
T13761A5750A9312B1EF14C63294DD025D3777C6F7FA1B6E8990809633761231EF3259AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5877bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5877bb.TMP
Size 3KB
SHA256 2f714d577b74223cba7d789921b1609b8dc9ea8057f8feba96ecd29500b757e8
MD5 c01f53fd02277d13bb733e5aa982ca73
SHA1 537f7bb4aec6e480f60a3acd4a42061b5d484cfb
SHA512 80dad3ab479e0bd040f6ceed70b8999626b593814c6e1d10b034aac638dc9b40cacf9f0f00f2a391d09df8d3e8345f6566854b0496b2e4baed2091e83caa8e34
TLSH
T15E61A5750A9312B1EF14C63294DD025D3777C6F7FA1B6E8990805A33761231EF3259AD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 e5286284227b6463a0223b28e4bc952f01961e984430f0c7b6541b6b781e649a
MD5 7fb1a45fa54e90a8a4a2dce8bd8a4e21
SHA1 d00ce3f87b2252947b6e9bbd4702ec9ec73a8f8e
SHA512 c00d7a56546f313d4ee1aeec13e47c15fbdc7dff8164f536a813b51c6734f48220a4b0909e3234b9a75afd84d0623b4b8eccf5b93321e756fd2f580cdb6ad93b
TLSH
T1B1117DF7C3E5856E890116F06A24AE2BDE2D0505831C7C5585D4FF1793F3475D10256F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 85e67774128c53c51e409af1ec226e14adbc286a8ebaaba2432a5c5e782e59f2
MD5 b9311e8f70786e88ab2e174d51d60ced
SHA1 4562ea2c537cee8e57f8960ba7ed3f80d67f5eeb
SHA512 05f2762390337e5f1ab1c235818c40ecc9abf49aa6f0bb279c85e3616b50b730757765de063ec83d25f331059e23355c89cba16450a05fb27f55f201f6726012
SSDEEP 192:sxZnRuyM/jK1Ml8UQKkl/fdsy6vVnIdpH1HW6+WNGYv5gj7HIg5/J:sxZnEqZl/fdsy6GVHbGDz3
TLSH
T14852E8166A349977DCDBD20DFA517F53D6F91472E2900E44AAFCCA0C05E6ADC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 327c82f50551b527654fc1359b1d804bf8c25bd46331f9da2e6345d6f4d8d3c2
MD5 870518712e01bdabf8db27390708ae0c
SHA1 5239e4f85f7396961be0f46137a47cf0002169c8
SHA512 3f15fe66d9553aad1d1fab8d0bb45053c890fd0db422b582e0b0fe3a6403c38fba1154e5173af1b4cf13680e73a72c895554affa9bde0faf75e08e4d77398224
SSDEEP 768:iQseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp/royd:iQseJ3xWvhfynu1jaVcL88psY
TLSH
T1B9D20B2B280CCB7E4F844E5DEC266F966EE801CB67984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7f6d94d56dd4ae76242a791d5bdf6335d5d6bceefa014281d5beb35356090707
MD5 80871f78145446dc109b8a53ea64c5fa
SHA1 b2d715ece095b31827b2ee2af40992d97f6e604c
SHA512 2095b649a23da99d2323e2222650eefd8f5dbcb9e28a832864e30f901de38eae2920562238bb800be34757ac44ceb8bae251785025fd040f233200212ba34888
SSDEEP 48:KYHIhKggkXySdIxK+cMjycG3iW4sAKIvKHKc/yq:KYH+KggmBd+K+ciVG3iW4sAKAKHKuF
TLSH
T1F3917602747A12013C7E284CA29299369E8275E37468B5AF7FB840912F67E121FFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33443d63-e5b3-4572-840c-8990074e4761.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\33443d63-e5b3-4572-840c-8990074e4761.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 c2d4c8e854ce1e42f672211d98fbfcc471ac17fe92077c05c7ff81c1485b758c
MD5 7049fbdf2826b39a5259e178193be87b
SHA1 be26f2c0d3a1ca16785e8eddd33b9285e34623a6
SHA512 10994536c6c1b5ae0105ff3115e9dd9ed53eb0e76ebc486415649572173941dc2823b9caba1aaf613ab8c812c793704fd32450b149f750e421aa285c475df5ae
SSDEEP 192:uyTSNWMsnMcPPQLz3XX9VofsNT2QyM76vOQmiU1lPW4MTobWCIK++WyiC8z1cqud:RtNn/s3n9SfsNT2W7UKX5zFIKPlWE4JI
TLSH
T18B626C726C249D7BADE7A185F44A37035EF4416BD6C06F80E9ED7F5C04DA2AC1307A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 6fd87eb750ea51a86fb6ff48461adb8c86e3a47b70f1422b63991086dc51b734
MD5 93f2f14d837743f83f4cfe9532f331e3
SHA1 59e52f22ce10bf15c44f85ec3727ce0977bf93c7
SHA512 37251bac791d11176f22c8b7ff6acd36a561044ca6b75d1e64659de72845936e14fe413c726be81dfa0f2ca7d94fa255c91a111691024f10cbd8b00a558d8b9d
SSDEEP 384:XiF1tNn/s3n9SkzsNt8TUNTUlIlJW7UKX5zFIKPlGE4JI:SF1j+9nkwgOvpFxlGE4JI
TLSH
T169824A736C54CD7FADE6AA85F54A33035EF441ABC680AB90E6DD6E1C00DB1AC1307D29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b8b7ee809cf52a4ade7e0b99f86940fcd83f914ba12500e517f132d5be483e29
MD5 2e92a97e1d17317d12c013c1b44e04d2
SHA1 7387b50d579e71447c6cd083046c12b131eb2528
SHA512 47c6e5889f6466f25d76a98d58982aef438512cae687ed7adfc9de21e26754110b7900bfad372eb0104070dc8ccec01ed67e4a82d6ea70dd623a5c1dc2e7c63c
SSDEEP 192:lONG6vMtPQmiUyOQThTobWCIKp847RLU/u:lONG6UtRqTiFIKRBU/u
TLSH
T180021976BC685C7BAAA7BD45F48E23171FE4116BA6905B40EAE82F1C00D765C2303936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 1867d691cb98920548418d6e445f269c8500fc4889c5a11aacd6f741a2457b48
MD5 093b8f8fbe492bd96810883fd4dd10cb
SHA1 f345bd9a0cbbc4e5a910474ec0cfd51cc136cbef
SHA512 ffcf885505cd024d45e87dfe75be382b594ea865aeae7397b7a4fb5f41b37f3bd88eef7cd43ed63a37382faed07f30de1014dbc34ff4371a7e86f43eecd1cb05
SSDEEP 192:ucTSNWMsnMcPPQLz3XX9VofsNTJQyM76vOQmiU1lPW4MTobWCIK++WyiC8z1cqud:TtNn/s3n9SfsNTJW7UKX5zFIKPlWE4JI
TLSH
T17C625B726C249D2BADE7B185F44A37035EF4416BD6C06F80E9ED7F5C04DA2AC1307A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 0735050762c85827d4ddb00967fcfbc00be915ffef2fe09ed9f2a73143fe6f7e
MD5 edaf3184c4e78b217047e53172fad6a0
SHA1 e184779e6973bb286449b166b2dbbc23d02afa3b
SHA512 f09e066ad58e877ba3582cb1abb9dda105a698d866525942e8ad8bc81de85f255b1f173ec6568d8cd2882f4ecfbdedd23bfe23339e90763006bd9b6b31328546
SSDEEP 192:LONu6vMtPQmiUy0Q7hTobWCIK++WyiM80Icqu4U/u:LONu6UtRG7iFIKPlUE4U/u
TLSH
T1F1121B76BC649C6B6D93B551F48A32131EB4926BEA849B50EADC3F1C00DF55C2307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23c24e93-4492-4926-933c-7c991664f375.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\23c24e93-4492-4926-933c-7c991664f375.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dc6d833fba06fdff184d913238f4cdd1f9c63ced9c37895ea7df8f3deb25d99f
MD5 f72567f716134da41b2ac3d938a04bf6
SHA1 a585bcf0c21080ba5ab7c3b051fd822cbe4d4be9
SHA512 a6845516265a14aee39d4a31c9488f7256fbc927f2ac3375fc4f0be0c8ca716601897902101def044e3b89218e0eaf242d65405bbc1e5bf970d63715b56511fd
TLSH
T12A412A58B6EE1114B3B77F5A9BF6A86D887B78772E06905D10110D4F0636F00C9B273B
MD5 SHA1 SHA512 TLSH

Submit Download