b9f8c899bcb2f73bb9f4fc7b924fe1b2c556a2dde3cff8ddf13adde3d4e797d8

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qe53.html
Size 75B
Sample260807-wthxeshc83
SHA256 b9f8c899bcb2f73bb9f4fc7b924fe1b2c556a2dde3cff8ddf13adde3d4e797d8
MD5 d92a199c1174198b4f1a9a461cb3eab9
SHA1 b7320c999cd2d4d3d9d5234b1876488d7aa852c1
SHA512 e26865c16af35ed9b992982ccf116a1cc34509e3be2dfa4a17958ec683b9fcc01c953548338277391a27b6ea2e909c53c3ffa39b645c1bd8bc3003579cb54ecf
TLSH
T113A002CCFD52F32A46414A700AF3338250EE950038EA28955A45843830CB3528598309
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4044	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305999679850671"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{EC2DF698-BEEF-4AA2-876B-7A625A0736B1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4432	4880	msedge.exe	88
PID 4880 wrote to memory of 4292	4880	msedge.exe	89
PID 4880 wrote to memory of 4044	4880	msedge.exe	90
PID 4880 wrote to memory of 4292	4880	msedge.exe	89
PID 4880 wrote to memory of 4292	4880	msedge.exe	89
PID 4880 wrote to memory of 1948	4880	msedge.exe	91
PID 4880 wrote to memory of 1948	4880	msedge.exe	91
PID 4880 wrote to memory of 2280	4880	msedge.exe	92
PID 4880 wrote to memory of 2280	4880	msedge.exe	92
PID 4880 wrote to memory of 1212	4880	msedge.exe	93
PID 4880 wrote to memory of 2280	4880	msedge.exe	92
PID 4880 wrote to memory of 1212	4880	msedge.exe	93
PID 4880 wrote to memory of 1212	4880	msedge.exe	93
PID 4880 wrote to memory of 3936	4880	msedge.exe	95
PID 4880 wrote to memory of 3308	4880	msedge.exe	96
PID 4880 wrote to memory of 3936	4880	msedge.exe	95
PID 4880 wrote to memory of 3936	4880	msedge.exe	95
PID 4880 wrote to memory of 3308	4880	msedge.exe	96
PID 4880 wrote to memory of 3308	4880	msedge.exe	96
PID 4880 wrote to memory of 2300	4880	msedge.exe	99
PID 4880 wrote to memory of 2028	4880	msedge.exe	100
PID 4880 wrote to memory of 2300	4880	msedge.exe	99
PID 4880 wrote to memory of 2028	4880	msedge.exe	100
PID 4880 wrote to memory of 2588	4880	msedge.exe	102
PID 4880 wrote to memory of 2964	4880	msedge.exe	114
PID 4880 wrote to memory of 3336	4880	msedge.exe	115
PID 4880 wrote to memory of 4920	4880	msedge.exe	116
PID 4880 wrote to memory of 2764	4880	msedge.exe	118
PID 4880 wrote to memory of 2764	4880	msedge.exe	118
PID 4880 wrote to memory of 2416	4880	msedge.exe	119
PID 4880 wrote to memory of 2416	4880	msedge.exe	119
PID 4880 wrote to memory of 1844	4880	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\qe53.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x260,0x7ffbf87ec188,0x7ffbf87ec194,0x7ffbf87ec1a0
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,15443594171453578286,322030445003967340,262144 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,7279009478499533847,4487420114484924453,524288 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,11217812424913478554,11393380476575182961,524288 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15265415902213672576,13945348234225213537,2097152 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,11826913220469450173,5176679962364811030,2097152 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4092,i,11134817215541408677,6060849198462220392,2097152 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4116,i,4334786472098989657,6669194333035697589,2097152 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,3208281542013664861,4236893558534048585,524288 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,14820441432063272000,8066204068115636590,524288 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,15958744544574669725,12433149544723673512,524288 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,15958744544574669725,12433149544723673512,524288 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,18430359735173834754,14972233287852695253,524288 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,17498191347120803560,759746778718496721,524288 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4088,i,1779145177978567178,2991867098817457598,524288 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,16080934774545944892,14433116076001175336,524288 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,17644291202289733958,115408148264544201,524288 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5272,i,16836883718786716827,4976251514352164070,262144 --field-trial-handle=2284,i,2803820302569874818,10331077837358087048,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 555c433092cbb5c633f74de3056b5544d902ee707bc8dc179e9d228f5da68918
MD5 9b387a4be33ab0bd6981e8544d242dd2
SHA1 a5e2fba8740db61442449a8190fcc6e3c00bcf72
SHA512 3b98ca16e13a3ea74018be95da45225847f8a15eea09f6203628ee3019fdf51cdddce99f0a013c03177e1a4d4edb422b3b398a8cc87a5841f814c4adc6a9e9c1
TLSH
T19271E93D040E4469D3AA03F364F213167D71BBEBF5D32E957190AAF028053D68E0F1A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588e22.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588e22.TMP
Size 3KB
SHA256 ad03a1bae93c1be7557d77fd678c5bb21a678071bcce6c0d5f1cd0c57b9396e2
MD5 68b44727f64a7e5dde51d33518250cdd
SHA1 72c51053ba69d44f5afcc966950c345fdf7b197d
SHA512 4bf2fed4a2a44d0b599926781a7c364a0b8ec77e5ca90338c349a5f443ef1fda011a3aadf301d1270a14b092ba5fe417363eb9b6ec19e1bcfcdf88ab6802bd93
TLSH
T19C71C73D040E4469D3AA03F364F113167D71BBDBF5D32EA571949AF028013D68E0F1A8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 101fa352dbc2a0407299c052b0c537dc6ccc00a3648234b9da6929955800a8f7
MD5 54c21bb008fa87ca69fe780ef7ee5cd7
SHA1 23ca05aa837139f4fd5922db5b1a08e75c43752e
SHA512 525a4788698c62efcd7a0ce5351f35a95d2c9c6a2c1617a306a1ef6004b6f92bfa6343d8d163f034ee1f803b13f351e4e1c2d034d4de8f22fe3c4c90a22327db
TLSH
T1AE115BB3C7D5856E890156F0AA28AE2BCE2D0505421C7D55C9D4EF2B97E3065D00255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 90f1199f0667145dce32bc9952e30402eec677a138b365de56cf586000155f76
MD5 0a5aa19372eb39ce354d464e665b6530
SHA1 46473603087517f66714e6a3d9eadb63d2a0481f
SHA512 2f84f5d60f93067d1fda28c8b8a736bcaf77e0e4d9c5479dcdfe01181fd2ab2cc934b8fd0ccd8ff1e1d8e4a4434b56a4ebf5e6d5c28f27eb9776bdc3edf033be
SSDEEP 192:sxZjRakw/festLxJIdpd3yHW6+WNGYzQ2ikIgrJ:sxZjjw/festLo9yHbGU9
TLSH
T1C622A6526E28A87B8CC7D21DBB15BF53E6F9503291941E58E6FC961C04E7ADD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9878ae1596f5f8b7504023a5d8b32e2db98c79661e98d56969c784ebf18a6175
MD5 021185d6257a8e3c7eca3582a0ec0cfe
SHA1 5ce20d20f43f9401e946c2babf8befb646268c34
SHA512 f4657eeed0e7b4d87c5b75e76f35ad3e1894437d68f9a0e07a2aac806af4a7495ebfb8188a975a7a1c945fc97c76f05ffbc454f73e897a0a9ac8394e14f57844
SSDEEP 192:sxZjRakw/fes9LxJIdpd3yHW6+WNGYzQ2ikIg5nJ:sxZjjw/fes9Lo9yHbGUz
TLSH
T1D122B7526E28A87B8CC7D21DBB15BF43E6F9503291951E58E6FC961C04E7ADD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 64379f3648ac32f7fec66a5e63a8852aa5a611fcd6d1d6ffd9495176005944b9
MD5 a1149d0ac0e3539e19b3baca3abb0b09
SHA1 6987ee72902bf47b536c37273457bb35d7662ff4
SHA512 ddeadc2f8eff950f8105fff009b722c2b17569dcb4344f76934bbbacd5b81ca611e1d631a63681a89e0a9d7387aefbd9e0a24052546698afeb005fefd4390a55
SSDEEP 192:sxZjRakw/fes9cxJIdpd3yHW6+WNGYziSikIg51J:sxZjjw/fes9co9yHbGul
TLSH
T1E822C8526E28A97B8CC7E21DBB15BF43E6F5503291950E58E6FC961C05E7ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 867263032b319e6842cb2efa65939e82a51dced36eb97385d90cfe885083f5ea
MD5 462932dfd6e0b75dee1b18bcda6906d0
SHA1 578b8de336b2e1ddd97e37edfe3b716325a56b02
SHA512 6af4d9fd8b8c0cd0315c25b9fc75a57b3f6c3f6e0746ad68f8181a4bea18f53db76656d9d7ad1d373655df92649860e070c4bbdebd093152ab2328f1c64c7628
SSDEEP 768:cWk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBrroyoYp:cWk7u70WvqiEau1jai5LA3BYmp
TLSH
T1C8C2E93B740CCB7E4F801E9DEC566F977E9802C7A6948D4087FA994C02C77EA61264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6bfd15ebf8a967793548074214560cab8e951aff0d226c6c0fed0f0f309c519c
MD5 530ba2f90490fc7d3bae1ff89f8b5fc0
SHA1 373101b183fe201ddfd75fb596cc3a85cca2a203
SHA512 1115b3d4daa2c01c7b65f0ec7e4b698d5ece63deb9eae6bbb4ff739cefba000cf46e03fa1db7627917687dc01481558b882c134d33702e6062860b212f8dda12
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTfTINKIsgPylXItKYUIryxII3Kj:KIbCKcfTWKIsS+X6KYUGyIwKj
TLSH
T176918445707A0E503C7EB94891A585276F4231A63618B46FFFA804A60EABE214FFDCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 54052e7480e8a4595b0bbf9593248efc46bd45bf936295fb6ce8cfcfffb5b48e
MD5 f78f8209dc3b90c86ecf06a855c18746
SHA1 c06fe06a31cd10e4d35a8b7c2a223f887f858125
SHA512 359947bc508452d3397bbcb7e3e427446a481022c1d1234e0d5f9ebe437e304c68915f023f68709664e0b28b8066ce2de0f0a29b66ca2ad29ac5b32667048886
SSDEEP 384:8ZcIhsNIeMD1/CbzziVQQd0mEMV9Kwf5Urz7Wc:qhr0qFkMWwS7Wc
TLSH
T14B928E715C74AC7A6AE6E145F48637074FF89137E3C42B98E6EDBB2C05AA258130741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 bd70b3c026e62e8ba951f85ab2a278fa757a4a194cd35eccdcadb71b6115da86
MD5 7c6b53883677e69ba870eaecb3a30ae2
SHA1 447b423c142b622e84ef746f888347bd87bc53f8
SHA512 1e07f857812217a706108c27d7888a1c0acb2bb3574e3e2d93bee183947c69d25c62535856299faf906350f563c462d1c8d6620a3142414587a536b548f28355
SSDEEP 384:5FiZcIgzsN48TUNTUlIl1MD1/CbzziVQQd0mEMVmWwf5Urz7Wc:5FQ8dwgs0qFkMhwS7Wc
TLSH
T104A28D724C64D93AAEE6EA45F94A33038FF89177D6C46694F7DDAA2C01AB19C1307806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ad433a66597fd4349bccdc66699c78fcfaea7627a79073738bee2fe7b026a02e
MD5 63a8f093cff68efccff104714bda4f84
SHA1 cde4a3b92684d9c06d8b7e94e53c2ffc5f0ee4f1
SHA512 69cbca02c21f9fb44289a8ae440e06f66ba85acd393a441f452c1b06e919c656aa52859ad7fd3cbf00317153b3bfcf8a16f02d16ccdd602e326657be25c97335
SSDEEP 192:MONf64BAQmiUyC1HW5GBPKcl+FdGuom1baDB5U6:MONf6eAl9Wzd0mSfU6
TLSH
T1C102FB34AC756C7B9EB2BE45F58737175FD8103BA6D45B54EAE82B1C00E724C234682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1db145cb2db6d8bbb630befd48500011850459cd3484d9bbfe23e5b3edea1200
MD5 2a6e0fe7e809342ac1713d4d29106b62
SHA1 0307dd5b981e97b5aa1f44a6d79947f29d8f586e
SHA512 3d88c95afac53af506e559364577ecc642ad5593a34aef0eadfce695ab09692bbb720312cf340be8e45886561f2d1fbcd13e12c9d4a32c092e2080f2c47a527c
SSDEEP 192:QONZ64BPQmiUyQFHQ5GBPKcl+FdGuom1YKEMVIWwzqPU6:QONZ6eR5NQzd0mEMVuwU6
TLSH
T16B121B31AC74AC6B5ED2B545F48737135EE5412BEA886F94E7EC3B1C01EF69C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 fd378bec3fe4215647a4d36c49dc87fe106fc4c250f89306dc4be3459590e358
MD5 32f3a06f6df5015bd8d8d1624eafc86d
SHA1 ee8d26d2427c2370e8003920a7c210a69b008268
SHA512 24cef5bc06c3f648efb3e20b4bc25e7d1523127d11ee77a4ed28a3d7894dba665be154f7d1745b7f06ad7b679e6970679d8a7da252106e3a6f3923fe11112a63
SSDEEP 384:XZcIhsNI1MD1/CbzziVQQd0mEMV9Kwf5Urz7Wc:fhe0qFkMWwS7Wc
TLSH
T1FB928E715C74AC7A6AE6E145F48637075FF8D137A3C42B98EAEDBB2C01AA25C130741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6086e0df2716ae8df737cc4926a09c550fb33068daa7c7fe42a5a6bf2723eaf7
MD5 32762483c1bbde3dc83a7572f27e4d2b
SHA1 dc6d9d0dff12fd4bee9c688f729b86f534991dd8
SHA512 f0cfe2fb2cdb3ad1b90eb33099244db80f6a2d5fa8b86c42b7902f989ff3028ff9553ed7ecbb0a1a56a7fa0f6cb1dff3eabd24dcf6de38c1848f9b08f5def112
TLSH
T142412658B6F91148B3B76E4AABF6A96D487EB8372F0BD45D10110F4F4A22B40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download