d92065054760445a1c7ffb8df944e4bf13206c66ec3bf63e9c92747f62f88125

Analysis

user interaction
yes
max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
alisa 2025 crp.htm
Size 21KB
Sample260827-vm5beaydnd
SHA256 d92065054760445a1c7ffb8df944e4bf13206c66ec3bf63e9c92747f62f88125
MD5 9b690e2ef78f3e1c7554b838436d5e14
SHA1 090a77b06ee02f3bc634d3284b620080f82c8129
SHA512 296732e7c9e36ebc9ed3bf593eaed853a178e04f7ec761ab096e1823907127a32e300313499088e516c77fa6d48f3fd9beee95627061cc7e9deec0e5c8242e92
SSDEEP 384:B3cDKcuP/FnX16OW3OGRz3apKZJri2bZcFMKYbWJmjoRICF4rPj1iz6sDACv1:RcDVuPtF6OW3OGRz3aoZJrisnjWrir1+
TLSH
T1CAA2FC5133E03848139B0BA3B31B74C6F95694DBA68480CEF61CFD01EF46B66DBA2674
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4828	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323240615959525"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{AA031C60-729B-414F-AA5F-1F4668431FAA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 1668	1484	msedge.exe	85
PID 1484 wrote to memory of 4828	1484	msedge.exe	86
PID 1484 wrote to memory of 3916	1484	msedge.exe	87
PID 1484 wrote to memory of 3916	1484	msedge.exe	87
PID 1484 wrote to memory of 3916	1484	msedge.exe	87
PID 1484 wrote to memory of 4732	1484	msedge.exe	88
PID 1484 wrote to memory of 4732	1484	msedge.exe	88
PID 1484 wrote to memory of 1172	1484	msedge.exe	90
PID 1484 wrote to memory of 912	1484	msedge.exe	91
PID 1484 wrote to memory of 1172	1484	msedge.exe	90
PID 1484 wrote to memory of 1172	1484	msedge.exe	90
PID 1484 wrote to memory of 912	1484	msedge.exe	91
PID 1484 wrote to memory of 912	1484	msedge.exe	91
PID 1484 wrote to memory of 2552	1484	msedge.exe	92
PID 1484 wrote to memory of 204	1484	msedge.exe	93
PID 1484 wrote to memory of 2552	1484	msedge.exe	92
PID 1484 wrote to memory of 2552	1484	msedge.exe	92
PID 1484 wrote to memory of 204	1484	msedge.exe	93
PID 1484 wrote to memory of 204	1484	msedge.exe	93
PID 1484 wrote to memory of 1056	1484	msedge.exe	97
PID 1484 wrote to memory of 1056	1484	msedge.exe	97
PID 1484 wrote to memory of 1056	1484	msedge.exe	97
PID 1484 wrote to memory of 3316	1484	msedge.exe	98
PID 1484 wrote to memory of 3316	1484	msedge.exe	98
PID 1484 wrote to memory of 1496	1484	msedge.exe	99
PID 1484 wrote to memory of 1496	1484	msedge.exe	99
PID 1484 wrote to memory of 3392	1484	msedge.exe	102
PID 1484 wrote to memory of 5052	1484	msedge.exe	111
PID 1484 wrote to memory of 2504	1484	msedge.exe	112
PID 1484 wrote to memory of 4936	1484	msedge.exe	113
PID 1484 wrote to memory of 5064	1484	msedge.exe	115
PID 1484 wrote to memory of 5064	1484	msedge.exe	115
PID 1484 wrote to memory of 3152	1484	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\alisa 2025 crp.htm
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffc705dc188,0x7ffc705dc194,0x7ffc705dc1a0
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,6647514594156483918,5880837319761399417,524288 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,11342118036114025491,8934936302962008953,262144 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,8252293640602840981,2591508732536454443,524288 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,4705596299665505386,8727886301090220428,2097152 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,7798392010642125294,3317726017642482116,2097152 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,14853872950098637714,5555811269593341354,2097152 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,510336933390553710,13720185603957754061,2097152 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3712,i,8062904446220234657,1600468575201387223,2097152 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,6584738315087364558,11519649534094135889,524288 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,12909126927952066030,1025791720864929273,524288 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,12962714227824017428,1059571348989260360,524288 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,12962714227824017428,1059571348989260360,524288 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,14103801168911845344,1040785616044195718,524288 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,3798768900428549885,14212036454680245140,524288 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,14451560567659825233,17099374246110445405,524288 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,7751915488933463114,4726275322529488530,524288 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,6515798510262076509,14417301190294107117,262144 --field-trial-handle=2340,i,1298302591789096305,10736000522982572593,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 aaa5de850e54c7be0e4cd9c1504c711ea8971c0d8b9eb4a5452fdaa17307eeec
MD5 3c33e92dfc61c2249c10b59963e05f20
SHA1 42ddb51d1c28c5e5a8fcfee60cbf7c6eaa661318
SHA512 c5e0523a7a8940b5371057529077cf91e677c0e7d194111374e666108ee4b6a7ace795f41022072a6700c18bbfe1ddaa81b3fb9c87b7d24ab697784fd05ae49b
TLSH
T14A613B7402427282E7E21530D3CA160137B208BDBBDBDD1933B0B87DB536F5A851953B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5902e4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5902e4.TMP
Size 3KB
SHA256 35b5a525884ec94ff4b92e5b881780987439203d6baa1ae27a29e39455771562
MD5 451a7825894a599278d8e0ac851b4c47
SHA1 3fd70f0cc41093efcb17c351c976af173def55cf
SHA512 90355abb8b1bd1e68a7d8f01e675fe16a2073778ea35e91cd4000f2a5fd9af15504131b28dda8e05d842d322186ccb5cab415bb32f8a0a47768a64e7a709b02a
TLSH
T1E5613C7402527281E3E31530D3CA160537B208BDBBDBDE1923B0787D7536F5A851943B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ad380dc87a561cba8a1e85eecce247c04666a7f7606e497892061f4d7e98eccd
MD5 be48fd23a07ec56e889b4f24a1b7ae37
SHA1 935d6069c85ec3d375c8bb663680cf963dc32928
SHA512 a3782dab4733f5a4e05ae8eeb372b01e60560e66fee5176e4f0bf0f6fb4e5acdd9b283f481721d5ec84a2b4d52c5f6c24e4a27e080697c4fe295dc741c979287
TLSH
T10381AAB6C3C847AE881116F59B25AE2BCD1D160B422C3D568DEABF0F63F2471D10269F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 3ce519b357958c754cf7365c234c83f125bc8cfaac76a82b7dd6dc2428627d24
MD5 29f11469ddb0f79145bcecf6ddbe81a6
SHA1 5c45b532b47dca714cbb196cdc593a2ef6c219a4
SHA512 31df01a2615f80fb31de9066dc0d09bce139feb95e0e7179a5b2ea0c24c9ab6de2d25377220ffde3ae8d569c0557fd743160aee8f7ff988937b7380eb250c697
SSDEEP 192:sxZ+REkO/fdsrVBIdpd6HW6+WNGYwKenPIgrJ:sxZ+tO/fdsrVqkHbGD9
TLSH
T1BB22A7526E38A93B8CCAD219FB15BF03D6FA503261951E48E6FC961C05E7ADD230B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 19d092926988d1440ba19e5c8a4aa187f52a5b2ce70235dab586d9f3602efd7c
MD5 9ded172e61e14a59acb645b1fa69c1cc
SHA1 ebd6b10e3435508d27ca81ee03e6de6810097102
SHA512 3ae87698f5984bfb9d0006ee8772c5f4c021788cf71839b4f534ad2cca9a3f2de8ccc4e02fecc97d8af3834efcd88053f03f6c0fb559ca350bd447f983e7a76d
SSDEEP 192:sxZ+REkO/fdsKVBIdpd6HW6+WNGYwKenPIg5aJ:sxZ+tO/fdsKVqkHbGDg
TLSH
T15122A8526E38A97B8CCAD219FB15BF03D6FA503261951E48E6FC961C05E7ADD230B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a8f905bc43740e73c43f683718b8606cc1223e0d0b12b6ca00a048407bcef982
MD5 0f37ce549dfd20395f347daaf3d34c4c
SHA1 10172c5caad8336e0f0551c9302ff41f958e57ba
SHA512 6c2c3e2484fdecde1022a7305dd88ac98a06cf7d6838cdae9ce52b9f7abcc2bae5e629a7b949e870fbf5ea206a6672206a3a0b093373c1987965c3eed6c79b0e
SSDEEP 192:sxZ+REkO/fdsKiBIdpd6HW6+WNGYwRsnPIg5wJ:sxZ+tO/fdsKiqkHbGE6
TLSH
T11522A7526E38A97B8CC6E219FB15BF03D6FA503251951E48A6FC961C05E7ADD130B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c7897ca71ce5e7926a376698e467d4260bbe47cc49b3839634a120b973a4333e
MD5 a5739de94d441acb8c50e6c35b57e7e2
SHA1 76b144d1cc86770394d46edcafc516e15658c37d
SHA512 3b8ae71236d5565bc803c753e096ebf7d4ef72b33856f8eee322cd9fdcf3d0fd0e648ada23e26807cfad87401d9cc8111199c8be42d1f98c3c64697c50f31cfe
SSDEEP 768:6GmjYDmWvmKyE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBPLlrZ+DhrofaWhaW:6GmjYDmWvmKyEu1jakPLZQDaXL
TLSH
T163C2FA3B244CCF7E4FC01A9DDD5A6F973EA802C76A588D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7e552b5-5c3d-40cd-88c1-8d4df982ee44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c7e552b5-5c3d-40cd-88c1-8d4df982ee44.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b01a1d1b2941ead4fe97be997c4be7bf1d2e9f191bb180d1cc5208947133f583
MD5 23a56b44865a28f5a95364327314af6e
SHA1 31ea689927f6f50049f37036b4e70eb8faf92af6
SHA512 0f925843baf24b6bedc463015ff6ae2ff280cf014b72faffd99e98ce534fa605472dedc7dc44fb28524541ab8375e4e4204a7538056b2b13a6ef820a89007221
SSDEEP 384:LZcIhsNWKBAoCJf+W86nX6uF3Sv9qmhhHILneI:Thrx3X6g3SBW
TLSH
T15E827C7168796C6659E6E695F84732138EFC9063DAC47B40D2FCAB2D048A579131FC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 8e797cc50edd348f5c28e3ba988726ea9e7e2f811286943eaf3cae5e5597885b
MD5 50af0dc229c83d4e8990278d17a323cf
SHA1 e28f53d826d498aca4b4a77f961b67a334c60c99
SHA512 672c7294b2ea1eace8143a79a9937fc00134f76627df6bdf8a7e9574d0dc1614e9eef49dc1d1d06bc24a5d7bab1d3739cf921b2b80b5ee294640752e73ee8aea
SSDEEP 384:EiFiZcIUsNW8TUNTUlIlzBAoCJf+W86nX68F3Sv9qmhhHILneI:fFQU3wgyx3X663SBW
TLSH
T1F6A26D7358689D7B6DE6AB95F94B32138EF85067CA85BB50D3EC9B1D008B5AC130FC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a111e9a596430533d61f02085807a82d7901d2cfdf5a87cb244fbba504c7103f
MD5 64c576b0ca10382f799508d5d839affd
SHA1 2a8fb8a20ee2c3361b7f57bde96793f9e10a06be
SHA512 1a1292a02f2cd63ac9918a8b0cd169058607c3e87cbede3d7915b0d2154371a7ff3875b03da0683f6674735e7771513a83ac35f2d8f3a9005e36fa90c92f5f3d
SSDEEP 192:EONz6hZ0QmiUySxpc/+jV8jzorxoE5wOZ1tU6:EONz6onpu+W8672TU6
TLSH
T14502C83569786C778EF26E45F48727135FE8212BEA956F84E6F81B1C00C769C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8d224ddfa0174432700b5df5a80fd11c7bc36468dcd3d5eb225dcb00ab58ecd2
MD5 f0b44dbf95d25b7da0dd490f8e2665ad
SHA1 9dd27e07ee0a84f890ddb3c9f19d4d04a53750c2
SHA512 b433a8f9a065316a62c04b4aa76fad72ed5a8d8ea81fd380f4676ecea923503fd03d94f64917c19618f20ba10ab868ef35656dffee0be15a90c2ffbc6537769a
SSDEEP 384:2ZcIhsNWzBAoCJf+W86nX6uF3Sv9qmhhHILneI:khKx3X6g3SBW
TLSH
T1E6827CB168796C6659E6E695F84732138EFC9027DBC46F40D2FCAB2D048A579131FC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a1b28802f3f3b07802d941c23a8db5bb8ffe1e6fdba8c6f09a9b7607267a7b98
MD5 58ec8cae78c55e50a001673ce92eef7b
SHA1 0ee3fbbce1e152b6e66797821fb512b05958445d
SHA512 99521161fc533319b57a030ff8d1416976e7b22cee5eb2ebcd67b9d05285c0bec3e6ebe553c814e4a661c5c7b35dd43339fadc1e3621db310d98bf29a9aa9eac
SSDEEP 192:wON36hZeQmiUyrxrc/+jV8jzorxonX6N5cOq+qzU6:wON36mwru+W86nX6493U6
TLSH
T1E312D836696CBC675DD26691F48B32134EE95127EE857F84D6EC1B2C00DF6AC230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 addff6b6a6f8ff4779fb2dc96ef98b36803e74db21944c7724e14ccfaca67027
MD5 6832e9cd4b43d2668a4226c3b1d5ad15
SHA1 7fb9ad5e17fbf0946e840b5db6135a1d4ede2099
SHA512 e9d8741aefa356c13de330c14189f6640cdae7e91b61239ebe9a6094bf760a43007936d228a1870e1af4971fea4381b1337646ab02e25f84c9d72224c5c2141d
TLSH
T1A9413B58A6E91148B377BF56ABF6A96E487BBD772E06956E00010D4F0633E00C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download