6f415760aa3a226bc888d6900414953d2c03cf46a411b80704db4220ac9ee1f8

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qs-p-44/index.html
Size 96KB
Sample260810-aftacaxgmc
SHA256 6f415760aa3a226bc888d6900414953d2c03cf46a411b80704db4220ac9ee1f8
MD5 24f77c6bf9e2bbb219605b5a20138ecc
SHA1 d59d7d74e7b7041b74a2e3470eba3a20f878fdba
SHA512 dbd56b5db734216abd712df5dd0471426ab673b389ff43f6e4e2061c7583a4d43c6beea63c2539438222b88c8fd38bee237a40e7ee535743e4dd55095560b50f
SSDEEP 1536:mbFEQPOAMsGpfb4Xhee97ee8exXGbWahTcQGLfW:ub9aoW
TLSH
T1D3A3A602DA2924ACA1178975F1216608635CBA0AE6B3DDC0F3DD877A0FD74990D72BCE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4660	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307942000393484"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{3F9680AA-AC6A-4065-9D49-ABED23ED4D8C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4148	4108	msedge.exe	86
PID 4108 wrote to memory of 4660	4108	msedge.exe	87
PID 4108 wrote to memory of 4532	4108	msedge.exe	88
PID 4108 wrote to memory of 4532	4108	msedge.exe	88
PID 4108 wrote to memory of 4532	4108	msedge.exe	88
PID 4108 wrote to memory of 2420	4108	msedge.exe	89
PID 4108 wrote to memory of 2420	4108	msedge.exe	89
PID 4108 wrote to memory of 624	4108	msedge.exe	90
PID 4108 wrote to memory of 624	4108	msedge.exe	90
PID 4108 wrote to memory of 624	4108	msedge.exe	90
PID 4108 wrote to memory of 1144	4108	msedge.exe	91
PID 4108 wrote to memory of 1144	4108	msedge.exe	91
PID 4108 wrote to memory of 1144	4108	msedge.exe	91
PID 4108 wrote to memory of 1712	4108	msedge.exe	93
PID 4108 wrote to memory of 1712	4108	msedge.exe	93
PID 4108 wrote to memory of 1712	4108	msedge.exe	93
PID 4108 wrote to memory of 1676	4108	msedge.exe	94
PID 4108 wrote to memory of 1676	4108	msedge.exe	94
PID 4108 wrote to memory of 1676	4108	msedge.exe	94
PID 4108 wrote to memory of 1056	4108	msedge.exe	97
PID 4108 wrote to memory of 1056	4108	msedge.exe	97
PID 4108 wrote to memory of 1056	4108	msedge.exe	97
PID 4108 wrote to memory of 4784	4108	msedge.exe	98
PID 4108 wrote to memory of 4220	4108	msedge.exe	99
PID 4108 wrote to memory of 4784	4108	msedge.exe	98
PID 4108 wrote to memory of 4220	4108	msedge.exe	99
PID 4108 wrote to memory of 4156	4108	msedge.exe	102
PID 4108 wrote to memory of 2180	4108	msedge.exe	107
PID 4108 wrote to memory of 1736	4108	msedge.exe	108
PID 4108 wrote to memory of 4452	4108	msedge.exe	109
PID 4108 wrote to memory of 2636	4108	msedge.exe	110
PID 4108 wrote to memory of 2636	4108	msedge.exe	110
PID 4108 wrote to memory of 4504	4108	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\qs-p-44\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbfb32c188,0x7ffbfb32c194,0x7ffbfb32c1a0
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,7913850793922640451,17159110640136623111,524288 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,8058153197609001150,314418059877397010,262144 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,2665937262587446251,16973482152027014815,524288 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,13353833706025483379,3188364096199853515,2097152 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,17700034581857836703,13759386145655316233,2097152 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,18351370959605480993,2638345879568160824,2097152 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,5205684476367182731,15726091476077374803,2097152 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5136,i,11707282980690263864,5336463124500092665,2097152 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,12190135589713415575,7541744806129186569,524288 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,3128897774661516864,16717000483481947419,524288 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,5419312202348265607,1575581710691291171,524288 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,5419312202348265607,1575581710691291171,524288 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,8722007151262450502,753657364041771568,524288 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,6111274091166214987,14369666374803645071,524288 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,17565049696655296496,10336220952842962633,524288 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,18213201994482439588,12753159372832212936,524288 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4252,i,10981232771591407405,10378590170684630460,262144 --field-trial-handle=2444,i,5972263167717762105,161553932457204397,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8f94a6507a9b3c03cfc60f7f996b581009015334065652b61fd72513d78eeeb4
MD5 17b84119a972e33133ed07ceaf2ed1d9
SHA1 78d2941ec88001d4e98e9a18b5ef8c13a16088bf
SHA512 d613677db82d02e50ef4e0c17b1994c7b047bcd3f1c5251207d448418b067b84b1fc670a5fbadd367472cd9dd4351c95c19287a8b42e74f93daa134b689559f2
TLSH
T14C6181781B720796E366127FE0F0860CBB73C2EEF92B1E3E439028B9650DB940154D07
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59064f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59064f.TMP
Size 3KB
SHA256 72c6ba070b8a4deaf6576d6a58d50027b1941cbeccc02d7ec6422ae9ea73a835
MD5 8e64ab877143c04365a981ac0b719ffb
SHA1 293a19a7e12add3dc989a40be9c8b9a871574ce3
SHA512 7ee72e0d531339d74f7d5103cac9e1f38e9843cb64773308ca2fc4af44d901f61dbfd9c0a1d73d0639b732fff3d26b6fb539513d9f931452ca5c44b468677f04
TLSH
T12461927C1B720796E366117BE0F0860CBB73C2EEF82B1E3E4390697A650DB944194D07
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8ee8a76a214324327b571ee018f4145fa2f047b68b77a52ce164f0a2bac50810
MD5 46d25faa65163c6604467ba0f9116ea1
SHA1 d1a9c3031492d814de0eb464ac29c54a1ce6956e
SHA512 a01d1856ba8fcfe984c21bb5c359115b73c6869f739f110c6cd1cfd8635343863a48a2de74aa99eb588aeb1b8a436681c4e42d9fa00e4878f325e99900680777
TLSH
T1A55179B6C3D887BE882152F05B256E2ADD1D051B422C3C16C9F8BF5FA3E2471D24269F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 44ba69f0494b9d409c84f393e257da44180f9b5ca894780e6a8b1b5c3a446caa
MD5 62d13197edee7d59a0d90e0f09424360
SHA1 2c8becafaeb2a9ac6136233c1c8aa6599fe8c972
SHA512 3453f3c3dc3b16c32f6018221b66b052c75acac1be2e2008c9627fe9e58c926c1dd68f2a9c1f9a6b713e703e05564ad206965bdbdc21a89dc331250af99309e7
SSDEEP 192:sxZYRBkK/fFs6viAuJzMIdpdYHW6+WNGY9IKbFiIg5hJ:sxZY8K/fFssiAuJBKHbGl9
TLSH
T10122B7126E38A87B8CCBD20DBB59BF13E6F9503191941E58EAFC961C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8ec78ff2829591e1479f26ed0f7d89493b57a5fe7d6ff800eb3e92bbfed9f891
MD5 7f230ea9e68c10b89c20b9f129ffee24
SHA1 f130b761bf39b560b65de6c16ff229d41403a47c
SHA512 972afa8a0d7cc8f6ec774e9756f0ed7c6e0408f48ac3041bb4359215ca15f79095a2296d5dec03aa4a9e47de599e2bfabd9db1d5ffe4b1923ab157baca7c0fdd
SSDEEP 192:sxZYRBkK/fFsiviAuJzMIdpdYHW6+WNGY9IKbFiIgrJ:sxZY8K/fFskiAuJBKHbGl9
TLSH
T1BF22B7126E38A87B8CCBD20DBB55BF13E6F9503291951E58EAFC961C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3ad0779f48b3b1a0d558db732da97eae529ad63bfba458bc40f6124116636b45
MD5 c54a7049be4bb7aca64dc4df71a867ac
SHA1 fdcedee3575b9fbc946dc777951a91b7590fe358
SHA512 b4cfe5e3bc343507a3438035052f1d2d131ae78d7928cbfcbc5bc9691b6e13d83bbb93a655ac1fe036da4988e7108a0c9ead546ba3e250cd4a317a053322083f
SSDEEP 192:sxZYRBkK/fFs6viAuIkzMIdpdYHW6+WNGY9IvxFFiIg5bJ:sxZY8K/fFssiAurBKHbGQz
TLSH
T13122B9126E38A8778CCBE20DBB55BF13E6F9503291951E58EAFC961C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ddc7b3e15d54a6bbd01c03d33d677ed4a8ecb179fe68555f3b9519731fda5be5
MD5 186c52f2d7137ed85b4228d5d4dd2cae
SHA1 d90dc02eb559b5b0df95c589abecd6eabc93c500
SHA512 cd2535a7fe4039127da64b3e93b0a77ea1b53e4d03692bea4a29e501f3fa1e2f58b1c0bf7c72cecb55dbdb133d34c7954e27b6a7adee6022f2ec70cb086d30e5
SSDEEP 768:9ryvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW74ro7bqa:9ryvIZwWvu+Q+u1jamFLeR7D7H
TLSH
T18FC2E93B240CCB7E5F801A9DDD5A6F9B3EA802C7A7588D4047FD994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9868a02dd62e120679fba98213b44a6011d3ffc173f0f7a382319e7bbf30e923
MD5 3270fbed15a30cdd2c27926918878e48
SHA1 c5d04a3f1e565f6a00bd20d45af725121e1acaaa
SHA512 0f79ab8440f2daa04fafa0007c980161f99e43c48ab61958d6b43489629cb86726cfca3c9fdf2ec742fa5ba7f0c9ac959e88d33911160af543be92174c3a0034
SSDEEP 384:bZcIhsNB0UziIn+ue+CxO9+RJu6HlytEDq1pCUs:DhKVi5OoRJuoy6DqDs
TLSH
T1EA929E31A9781C775AF7A545F88A36139EF88123E6D42FD0A5DC7F2D01DB2A8130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8cfa25527e6b5fddab486988742ce4bb317adc39b306f29e73ac00a72f336ce5
MD5 0be99b87ed00ad8ba683ffda32b4daa1
SHA1 de4b246905564b2ff5dbb1a0f18ce4578ed37689
SHA512 a412cc52e42b46b11170e3214672ea17c6c08c9590e07823f2b496803c0c0cf6b74cd8ea7051d1f552dbaba22c60dbc03a6eb64e601b89554c5f539d5d833905
SSDEEP 384:kZcIYzsNBNUziIn+ue+CxO9+RYu6HlytEDq1pCUs:Ck1Vi5OoRYuoy6DqDs
TLSH
T196929E31A9741C375AF7A545F98A36139EF89123E6C42FD0E9DC6F2D01DB6AC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d7846220a331a9ff3704639ace53c6eaa3093ecee60dfc2f6d1b98a145834995
MD5 ea9c3ad3ab7a14bba233a0ed77c2b281
SHA1 20ae699767ec28b66c849318beb9b4e48b890777
SHA512 a79b0b6c5276cbfe89662a2056de602081a8b106f8ba8a5861d9d46839226fea742ef47ef6b2a7f6004fc4f522b6d59011e012505a32cb53ffb87d83ecf1179d
SSDEEP 192:JONk6v+YLNQmiUydOZh+CGQO9UouspLU6:JONk6vz/pZh+CxO9P1U6
TLSH
T15702F835BD782C7B9EF2AE09F94737176FA4217BE5912F90D9D82A1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 59106042fb1cd3f91ca3931cd3af9b8ff809d34741e43917ea2183399bb30fe7
MD5 ef275cd687a2bc530bb437f85f795385
SHA1 3910009698c20b44fe4287dd9e83d7623a373bca
SHA512 dace4939a10715f7f02566a65e82f796dc549111ddeae415e78d8b6b9d78c6b879849d6bd550bd83c13b78fc015b34d69c78a254a92d313fb565d060ced0a028
SSDEEP 384:LZcIhsNBNUziIn+ue+CxO9+RJu6HlytEDq1pCUs:Th1Vi5OoRJuoy6DqDs
TLSH
T1F292AE31A9741C775AF7A545F88A36139EF89123E6C42FD0E5DC7F2D01DB6A8130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 72753edeabf1bcbf38fe72877bd7fb78e6c3e90735ed2ccddb404943681f38fe
MD5 6ca7762dfb2aca375ff459db1524cdf6
SHA1 9db41d2fe895ae2a4c80b0da1bb951bd53b07293
SHA512 4b23735eefb1ce9a3250d36ec0f6247430b6c80ede73d57551d70e7e28b7a5faced46a33953d6b6e45bf60e9324255d4bddfcd6bc56a8902c2eb4a85b8863d08
SSDEEP 192:jONU6v+YL6QmiUySORh+CGQO9UNRYCHWqiU6:jONU6vz6YRh+CxO9+R5uU6
TLSH
T13C122A32BD785C775EE2A945F48732139EB85167EA853F90D5DC3E1C01EF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2197f5b9-a9f6-4e92-a786-8139f19ac0ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2197f5b9-a9f6-4e92-a786-8139f19ac0ed.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1e6aa864e5b4374e4a56242d0c8bd2b0a12fe07ca75708283ade6631fd54d891
MD5 f34570bb370e7bd672171c387b52f640
SHA1 1096e493e4ef5c70e7c982e13a3b2af83d02a015
SHA512 b580dfe561c412bbde831628f48a801e550351afe4e3dbb5f409db3caeac4d957feae7b73af011fa5c28d8a4a4db677b3310cac52e402317937be08f601dde58
TLSH
T1F7412F5CAAE91148B3B76F5A9BF6686D447F78332F0AD45D10110E4F0A23F01D962B37
MD5 SHA1 SHA512 TLSH

Submit Download