569d23bb9f7f8e12c0429e4267ee39a85fea4d7c2ee41b7d405f0ae66eb069b2

Analysis

max time kernel
148s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dark desire train/[Kimochi] RJ01134914 v1.01/credits.html
Size 1.9MB
Sample260809-3fa3zsch95
SHA256 569d23bb9f7f8e12c0429e4267ee39a85fea4d7c2ee41b7d405f0ae66eb069b2
MD5 525f99aea74965d6b490817f06ce2be6
SHA1 2f1b4686d54c0c4a3a332db7bdc1be00245bd383
SHA512 270f182b96509228a67b1fb3f46144d1505d118a19bd8fc0613e79492b90e25bd816da8f42861a4b35017698fea9c87b3833ce15eb6f65f24cdda16691f7077a
SSDEEP 24576:OmuB6mnLiL9IrMr2KNnc7nkUhPwQQQVuc:OD6mLAcKTW7EQp
TLSH
T14E95D72B7F45077306F2C2516A4AA4CAF31E903E3B571904346DE25C2B7B92983FF699
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1252	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307925519294512"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{EB2788A5-5FF2-445B-AA31-BD39A0117571}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 3848	4384	msedge.exe	90
PID 4384 wrote to memory of 1252	4384	msedge.exe	91
PID 4384 wrote to memory of 440	4384	msedge.exe	92
PID 4384 wrote to memory of 440	4384	msedge.exe	92
PID 4384 wrote to memory of 440	4384	msedge.exe	92
PID 4384 wrote to memory of 1360	4384	msedge.exe	93
PID 4384 wrote to memory of 1360	4384	msedge.exe	93
PID 4384 wrote to memory of 3932	4384	msedge.exe	95
PID 4384 wrote to memory of 3724	4384	msedge.exe	96
PID 4384 wrote to memory of 3932	4384	msedge.exe	95
PID 4384 wrote to memory of 3932	4384	msedge.exe	95
PID 4384 wrote to memory of 3724	4384	msedge.exe	96
PID 4384 wrote to memory of 3724	4384	msedge.exe	96
PID 4384 wrote to memory of 3952	4384	msedge.exe	97
PID 4384 wrote to memory of 4080	4384	msedge.exe	98
PID 4384 wrote to memory of 3952	4384	msedge.exe	97
PID 4384 wrote to memory of 3952	4384	msedge.exe	97
PID 4384 wrote to memory of 4080	4384	msedge.exe	98
PID 4384 wrote to memory of 4080	4384	msedge.exe	98
PID 4384 wrote to memory of 4288	4384	msedge.exe	106
PID 4384 wrote to memory of 3956	4384	msedge.exe	107
PID 4384 wrote to memory of 4288	4384	msedge.exe	106
PID 4384 wrote to memory of 3956	4384	msedge.exe	107
PID 4384 wrote to memory of 4112	4384	msedge.exe	109
PID 4384 wrote to memory of 4936	4384	msedge.exe	114
PID 4384 wrote to memory of 2076	4384	msedge.exe	115
PID 4384 wrote to memory of 2096	4384	msedge.exe	116
PID 4384 wrote to memory of 5828	4384	msedge.exe	122
PID 4384 wrote to memory of 5828	4384	msedge.exe	122
PID 4384 wrote to memory of 4372	4384	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\credits.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffcf421c188,0x7ffcf421c194,0x7ffcf421c1a0
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,10697626865949568444,9549873035700262255,524288 --field-trial-handle=2292,i,334065685182362559,13509504287436465498,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,3610497959092380561,16295065317130233230,262144 --field-trial-handle=2292,i,334065685182362559,13509504287436465498,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,7730166543100325922,5879521939274978060,524288 --field-trial-handle=2292,i,334065685182362559,13509504287436465498,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,16678338448219669894,16721831783705683829,2097152 --field-trial-handle=2292,i,334065685182362559,13509504287436465498,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,15647672785014020934,12766772748020936349,2097152 --field-trial-handle=2292,i,334065685182362559,13509504287436465498,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,11609861748482856155,12034685761866988950,2097152 --field-trial-handle=2292,i,334065685182362559,13509504287436465498,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,11779369491479030634,2144330373098381623,2097152 --field-trial-handle=2292,i,334065685182362559,13509504287436465498,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,4520665441941886388,5677364932756666167,524288 --field-trial-handle=2292,i,334065685182362559,13509504287436465498,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,16414292586427947834,5643306943236876865,524288 --field-trial-handle=2292,i,334065685182362559,13509504287436465498,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,14082188878396339465,10731395645490570575,524288 --field-trial-handle=2292,i,334065685182362559,13509504287436465498,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,14082188878396339465,10731395645490570575,524288 --field-trial-handle=2292,i,334065685182362559,13509504287436465498,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,16204832086052132620,146284503301615614,524288 --field-trial-handle=2292,i,334065685182362559,13509504287436465498,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,17588035298584185309,6758267093564212675,524288 --field-trial-handle=2292,i,334065685182362559,13509504287436465498,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,16522882265319126517,17272671579672166487,524288 --field-trial-handle=2292,i,334065685182362559,13509504287436465498,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,10211189996631219307,13485363510692341597,524288 --field-trial-handle=2292,i,334065685182362559,13509504287436465498,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=784,i,12828067542427037070,16973657505273777094,262144 --field-trial-handle=2292,i,334065685182362559,13509504287436465498,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 73d7a7d108771a9c6771f553024687705bc651c758f16e23e921c70d8461eb54
MD5 9ce9e29f40fbee5cede91a18c3ba749e
SHA1 c117605bc7181a89766e82f7af6ea35f209d46cf
SHA512 ed365f15397ffffe2a2511afbc8fb9ff4d0e6a9191934756a917e93bd90d8de4370295c13ca6775f9693320b3835ab572b5eb82dce63f2fe747aa9137ac9c768
TLSH
T1CF81A6380E6F00B5F3B11FF2B3D14B44347E82EBF993BD9A62816A70790A761B2C9405
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599a04.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599a04.TMP
Size 3KB
SHA256 49057c1fcc1405026226c8121f6f94eeecead1db8718c0c68fa0316347259dcc
MD5 17fcfb19c99907a33fe3bfdb35016c98
SHA1 b1100023bae62576f1f61ebf973da6c2ebbb5758
SHA512 d393b96c2bb224097a97da48514ee1df835d32e4fa60dbc9e9d923f8f44c9c850eb95c85bc95b533cb36af40da83fa22ace97b6aedecf334d58e8c553951acdb
TLSH
T17381A8380E6F00B5F3711FF1B3D14B44347E82EBF993BD9652816A70790A761B2C9404
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 455aa394c849f1e462e1cbe12dd11e0fd58a77d60d5ca44e0e2a08a5535d0ea8
MD5 13f935efb35dbc0616782bb09e9c5a42
SHA1 0bb7f896c8e20f22501866ba91a10d7ed2db6a46
SHA512 76ff61bc9dd0d2a6a632b995419edfa0f8a4a2ac3c0ea4f8be6b265ad91a6f8adc7279453a9c749db0eb623af3ce7bc0c8d4ec0270fcd6d0f9d14cce5d2bfe85
TLSH
T13B115BB7C7D585AE891556F05A28AE2BCE1D060642187C1585D4FF2B93E3065E10155B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bb72ab5e4cfaa6306c708ae400d71777e48c8741b99e7178d812804e063364b3
MD5 8bcd157888f5aaa313b52d178761f4e9
SHA1 1434b8b48b79610e28c7cfad930669b0a147ee11
SHA512 0fe43526cd35a4b031d707c2d90aabea2e2cd4d90106a77794874577cc3972a0e60165f76fed7ef4f73da754a469149f7db34ec6b7fbd7e82dfd9c930963cc93
SSDEEP 192:sxZRpRoyM/jK1Ml8MkA/fqszEb9IdpduHW6+WNGYzQEjzIgrJ:sxZRpqMA/fqszESgHbGm9
TLSH
T15E42E7016B34A977CCDBD209BA45BF53D6F50472D2900E58AAFCDA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 94946d315f702d32f9cc112cf83011e88df6f2d68aee41f7178ba4482c0348a4
MD5 57d89e488bc86b807657469c8744b8d5
SHA1 b3312bc3a323571d085de555000f458fdec53cf3
SHA512 383c659d4e5ca043942fd4d52bb0082e47b7ac0374578b9870dedd967fe290b1af9fba7397a9da2e75a2ea07c8e939ac58e7b9b24c1cbdc5e03c21834e4300ce
SSDEEP 192:sxZRpRoyM/jK1Ml8UQGkA/fqsxob9IdpHuHW6+WNGYzlHjzIg57J:sxZRpqqtA/fqsxoSOHbGQf
TLSH
T1DA52D7516A349977CCDBE209BA45BF53D6F50472D2900E48AAFCDA1C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9153d7fb5d7aa13ada910841f2ab813d7a78961aabe25414e5ce28c48f053b40
MD5 9a897ac743404b61ed56034d2df48f23
SHA1 9f8d9ec6e819a211796a66bd60ed33cf14e4f652
SHA512 c37ebcc7f13da0bb89d7ce93b4d0100a9fa35d167167dc250598a31c2ce5ce3321e157220bbb46e3141c5b103474fdb193303757e9125901f03b661d031dff10
SSDEEP 768:QbW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjnroI7iMgYQ:QbW7kf0Wvqidau1jaa5LA3j0Q9Q
TLSH
T1D7D20B3B684CCB7E4F840E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8f1834abe4616bf44ce211a7d5734ba74c9254f9a799a8fa8733ab3e54fdfb5a
MD5 a6894e3fb7582df419bc4a2709219049
SHA1 7f942b8175f979f44f9f6e18a67c74a95e78fcde
SHA512 70b0ce3192ce3b68f7bd13549fcaeebe36a1b2be9ef725c680f0981236a5f420dad36a0190d9a556df187f8ea6163427d95b808f65058cc1930e75dbfd038acb
SSDEEP 96:KIbCKc061e6UccuKMf10auKsb0IuQCa34qv+XeKEcXg4KxW1:sCFpD6
TLSH
T160913201717F060138BE280C96A5DA269E4271673524A8FF7BB910630FA7E514EFEDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97cc328c-265d-44ce-ac36-1b5262c337c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\97cc328c-265d-44ce-ac36-1b5262c337c7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 35b5051254bd9d7af1442ad02503507f5974f0a9a7101718ad89c6f05a6b6fa0
MD5 ec08d8d3d13c63fb5e0915570c7fe583
SHA1 8a728d5aecd8b944452eac1967714c47b15595d7
SHA512 621cdf1f32cdb3f7dffd5728b07c5de7aeeee99c9f1206f4b553a3ad94b6938599e06d77eedc8151912dbc2b8e0e440d5be08e092a640cbf635a4bc5bf62d41d
SSDEEP 192:uSLsNW2QBLGT6BbkVQmiU1/BxB4aGBPKXo+FdGJaV6FC1SJrfdNAqWU8:1sNW28aTcbGpuIdEaACEJrfgU8
TLSH
T12D322A359874AC3B5DA2B141F48737139EB4413BAAC53F94E6EDAB1C01DF79C131681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 850cd9bd2a5a1056172f42ca4b101c71ffbff4c6e4ce9ab956d5ea7a35d8940d
MD5 72aa5d1cad66904e6e3a89076db9e548
SHA1 9752d3af3b6ec7e05072e6ea6868fd1c019c5a34
SHA512 6a373b518611b65ba9c11dea3fd75658228944e932efd7f52f3ffc198f160d9624b6d77e833a0156cfc875c7a5fda2ec5500eaeb66b1c723441533335e79e619
SSDEEP 384:eiFiZcI9zsNW8TUNTUlIlD8aTcbGpuIdEaACEJrog6HlytEDq1c:1FQFrwgicDyhogoy6Dqu
TLSH
T14CA26E328864993BAEF6BA45F84A36139EF44067DAC5AA94F3DDDF1C01DB2D8130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dbddfd79b06a66f22aee678b19cecced80d1fb799627c1e53b30aa1dcbbdbebd
MD5 a21792482c9c078f6d2aaebe09aeff81
SHA1 1c836ee59d4ac189f9a86fb77b24e2c8c4bbe24f
SHA512 81b9615625117b759f23b60fcb6f4de48e317cd56c80b110b8a0abc9c53fbde92a0e62c1055bf40a5203b96b635e218c74b4d814992e69f999981fd95fc5c250
SSDEEP 192:MON664BAQmiUys1BRW5GBPKXo+FdGJaraDjhLU6:MON66eA3lWTdEaQFLU6
TLSH
T17802EA35AC786C7B9EB2AE45F48737175FE8117BA5C52F44EAE85B1C009764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d535fff966976bb1077395222f822f1dabd95dcfe8af6b7b993a9ae7e3936456
MD5 ec1ccbc7bdc4579dd288ac641960dd80
SHA1 2ade4da83f9dd846b08c93e7e829d165e32e789d
SHA512 33faf9d666c53f453ee0930048c50ac4aa889197d1814ef9156c1bc6e2f52058f4f774999bb08f8481c771f59b9aafede346928e27df68aaa62669d63dad9a76
SSDEEP 192:JONP64BVQmiUycBRK5GBPKXo+FdGJaV6FC1SJrGWwAqWU6:JONP6ezDKTdEaACEJrkgU6
TLSH
T12E123A359864AC3B5EA2B541F48736039EE4413BEAC57F94F6EC6B1C01EF69C1316816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 296348fc48e96955b7a8bc6fb6e8f594a3e489a217ae05c0ca91a9d850883b8d
MD5 595c13d1a3f3ec086da5fd6b168caba1
SHA1 66a134255f82d0222e50d969d495aff206fc5ff4
SHA512 21ecf5f37716c4499b3149a3ada8cdcf0133cd6b390f4d975c6044237c223ba75e6faa3cab4551971aaa6cb069953e8f6267a6b1dee99aba56f6760416181b7c
SSDEEP 384:RZcIhsNWD8aTcbGpuIdEaACEJrfg6HlytEDq1c:5h+cDyhfgoy6Dqu
TLSH
T196928E3098745D3759E7B141F4863A039EF8802BA7C56F98E6EDEB2C01DB7A5131B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f251819-6936-451a-995b-c2de29e55195.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4f251819-6936-451a-995b-c2de29e55195.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9b6bda19a18837dc2281475fd0a440c05eddd672b40c97c4eca5bdac29b44743
MD5 39a80b65ebf5f3dc9d734b7fde7287a7
SHA1 4859a00a411a3f753599bed18124c66de2768543
SHA512 0aeb004406234e134913261ab1fe4e9c1eeffa35f74afb8e6546cce8b821576f4933563b1cf7054f0816825aca49c84a4124852a7b36d193c9851335eca34d75
TLSH
T1A041F85CB6F91104F3B76F5A9BF6A86D887EB9772E0AD45E10110E4F0A62B00C971737
MD5 SHA1 SHA512 TLSH

Submit Download