370130d5ff730d9e3ff50810ff582bf8bd38e973270e46dfd2b71768de7e1d78

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
core_030038.html
Size 868B
Sample260828-tk3t5adf39
SHA256 370130d5ff730d9e3ff50810ff582bf8bd38e973270e46dfd2b71768de7e1d78
MD5 83562bbf9277e1c8d2e6953d152a5a02
SHA1 b444cdea9047df0674ca4748985c0ad62a290b70
SHA512 87a4db1c82fde2223bbb2efe2aa129e4b236ffcedea47c3dc030a068e042f0d2fed446da4511f291ac07ff163679b6a80b68226fcc97048bb291212d5df433a0
TLSH
T11B115EBCECB1E0D88FC001C0147AC46E280296A1E801C8AF84C282E062D1BCD0E89E7B
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324068770265767"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{2CF7E1E5-FBDD-4561-A103-9387C63E639E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 1028	4964	msedge.exe	84
PID 4964 wrote to memory of 3988	4964	msedge.exe	85
PID 4964 wrote to memory of 1576	4964	msedge.exe	86
PID 4964 wrote to memory of 1576	4964	msedge.exe	86
PID 4964 wrote to memory of 1576	4964	msedge.exe	86
PID 4964 wrote to memory of 4112	4964	msedge.exe	87
PID 4964 wrote to memory of 4112	4964	msedge.exe	87
PID 4964 wrote to memory of 1888	4964	msedge.exe	89
PID 4964 wrote to memory of 4348	4964	msedge.exe	90
PID 4964 wrote to memory of 1888	4964	msedge.exe	89
PID 4964 wrote to memory of 1888	4964	msedge.exe	89
PID 4964 wrote to memory of 4348	4964	msedge.exe	90
PID 4964 wrote to memory of 4348	4964	msedge.exe	90
PID 4964 wrote to memory of 1316	4964	msedge.exe	91
PID 4964 wrote to memory of 1316	4964	msedge.exe	91
PID 4964 wrote to memory of 4204	4964	msedge.exe	92
PID 4964 wrote to memory of 1316	4964	msedge.exe	91
PID 4964 wrote to memory of 4204	4964	msedge.exe	92
PID 4964 wrote to memory of 4204	4964	msedge.exe	92
PID 4964 wrote to memory of 4016	4964	msedge.exe	97
PID 4964 wrote to memory of 2488	4964	msedge.exe	98
PID 4964 wrote to memory of 4016	4964	msedge.exe	97
PID 4964 wrote to memory of 2488	4964	msedge.exe	98
PID 4964 wrote to memory of 3840	4964	msedge.exe	100
PID 4964 wrote to memory of 2908	4964	msedge.exe	109
PID 4964 wrote to memory of 2244	4964	msedge.exe	110
PID 4964 wrote to memory of 4288	4964	msedge.exe	111
PID 4964 wrote to memory of 1128	4964	msedge.exe	113
PID 4964 wrote to memory of 1128	4964	msedge.exe	113
PID 4964 wrote to memory of 1996	4964	msedge.exe	114
PID 4964 wrote to memory of 1996	4964	msedge.exe	114
PID 4964 wrote to memory of 5048	4964	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\core_030038.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x25c,0x7ffb719fc188,0x7ffb719fc194,0x7ffb719fc1a0
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,16034098071441111864,2274962418543815880,524288 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,7291338988681011605,17675340250624503883,262144 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,8424533787014212061,14907538138014789177,524288 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,958720277837055991,18338069200599936846,2097152 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,2074799700997378529,11673694014023976702,2097152 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,12325342324599266633,12790789443776587365,2097152 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,4691129403204898724,16989449131768774373,2097152 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,2542790628292064359,2145687257405946041,524288 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,2079586238014479587,9771101721371486268,524288 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,11500880115202309130,11979523795770696633,524288 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,11500880115202309130,11979523795770696633,524288 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,17858120548837203095,11964636475541014905,524288 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,16213566123825839409,3429803894245853066,524288 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,18259642272394292349,13207369364219669010,524288 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1228,i,5717606010923203839,14889787410208229110,524288 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,15110040629697392836,9247738893891577403,524288 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6136,i,15475753973437864685,10242017397042767865,262144 --field-trial-handle=2388,i,22968460382810928,5158230572929979854,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

28ffb8e5-afc5-4264-87df-8aee68eedf3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\28ffb8e5-afc5-4264-87df-8aee68eedf3e.tmp
Size 21KB
SHA256 258e0c2a34edc8b139d9747e54b89dde2d14dbc9de7d8f8236207858ec7ac652
MD5 a5d7de2c1e4521c4314b7762adae11d5
SHA1 06a4f853acb1c178200b178358fe077848b87587
SHA512 2470e3c0d85d154442b9afe5aba236931ee25a2c4bb95c7f2bb4f7074789b83bc9b27ca5355014586c68cd3550d5b0fbe02df8460f7021eac1423ea6b2e847ad
SSDEEP 384:O+iFiZcIVsN68TUNTUlIl6n1ERb7Ldc4VRNPOwG9O360X1puLmQkoQ:OVFQVPwg01EQuHPOwG9u6syLmQkv
TLSH
T1B7A26E735D688D7BADF79A45FA4B32078EB84177D5C4AA80E2CDAA0C01DB5DC130BD19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 da53334eff218e83dd174073e3a2c3ee71145b7e6a596c064bbb7a7524d32634
MD5 5733fc513d433c8ca373305910eed02f
SHA1 b620209530c3092cfcdf346ad3e1f8a868523958
SHA512 da0668240d68ad50958c205d0c45305210890309d422e72cb5183373eb30c470b039fabafe6ecbe833c91768cee97865fd0f27ff74415bfe00058890047b3138
TLSH
T1FF712A370FF70062DB65B7B1ACE0C1033475C6C7F527AE66ACE4AABD1E187418D98009
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587dd6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587dd6.TMP
Size 3KB
SHA256 f9c96b30d9eb1e42f7cbd47bc066d1c6932bd08b84982d4eacf5f13842d865b3
MD5 14b986aea3e0a8cfc5d39a347f65fba0
SHA1 da1bef8d8a1ffa2071ca66cf2ce3a4325fbac500
SHA512 fefc0ae21b19dae3a3cc14736edffe6da26413351683d7d469d3b2bc376454af692fc8c2ac99ba64edc1103c6e27499fa160a69de97d62fb604380e0eaf22886
TLSH
T1C8711B370FF700A2DB61B7B1ACE0C1433475C6C7F517AE669CE46A7D1D287418D98008
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 686e081d7714a72365a1f46a1a7bfb705f1471df2511c5bf29c7b7d1e324fda3
MD5 079fc880e4d504f09eda3e9c93e5b4d1
SHA1 0773b2551c34bce856184de6343d2cd18c36f93f
SHA512 75906a02bbd8a2cc1510ce0f3440dbea1eeb75e3fb11d4ae0ce8c61bcfabc6d26b0910ebf31843e54c87569735ae4749d16c4ac5c877e5ba176d429cd2c3021a
TLSH
T129115BB3C7D5856E890116F06A24AE2BDE1D0A0542287D1585D4EF6793E3065E10555B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 65443adfd12d11e1088a927d4a6af9c5719f874c45a3f00a8e827b84d4c4be3c
MD5 4257fb20439214dab184b2fa6eced1ae
SHA1 d23be8334b748ef5f779433ebb94e3aa007ec145
SHA512 3e709a2a6a0950f465dabcdb1e40392fcc6f887fb1b187efbcb57c5cf24b54dd92f40155a4a11f88503b90f4ff82ec120da7a9e7ecf54c653b5018746708ee79
SSDEEP 192:sxZURXyM/jK1Ml8Mkm/flsHtR+IdpdvYHW6+WNGYIkfWuIgrJ:sxZUpMm/flsNRvuHbGw9
TLSH
T10B42E8126A34A97BCCDBD209FA55BF53D6F4057292900D44A9FCDA1C05E7AEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8cfe051d98eb78a48c85e5e4d7937b50d64cac35625f91706940fe6febfb7bb2
MD5 c292ddf633b6033b3935aae09a852ff1
SHA1 b425ae801bfff6576b1512beb07f0bfe543444e7
SHA512 66c0e9f1d1e67f61db530904f9cf796d1b2c1618b21b3fb48c3274e153bb22a226f0078fc16e7182da659f48f56f3938a84ef92be54b0fab8950093be095b6e9
SSDEEP 192:sxZURXyM/jK1Ml8UQNkm/fls5tb+IdpHvYHW6+WNGYIpfOHyWuIg5MJ:sxZUpqmm/flszbvgHbGXfVG
TLSH
T14D52E7126A34A977CCDBD20DF945BF53D6F4557292900E44A9FCDA1C01E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 563dc43acd07c3903ec7c5416720cae0d73201f1dec4d349fde388351fd214e9
MD5 dc6bc0f3f2569137510e59968e5099ce
SHA1 3eb0c23ba5f49751cb9482863dfb77ccee431267
SHA512 940bdbc90b9b5a251e5bcdc8be19e87127e8e78addf2c30afebc83ca0cd881832056e58f78074f47a7545b10b16b485e39b99f947f0fb2a40d807e76e776c12e
SSDEEP 768:gisqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9/rohF7:gisqxXlWvJD6Tu1ja54LAs9shp
TLSH
T1DFD20B3B694CC77E4F840E9DEC266FD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f72eda3-bb7f-419c-80cf-367b5c9fa2fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2f72eda3-bb7f-419c-80cf-367b5c9fa2fe.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7911147dd246847ba37e57fa91a0c10a8ebfaa44fba9e3802a713725529d202a
MD5 8b7a9f3474ef9a2de147ed44b0eebff7
SHA1 b87a6d79a9b9acf04ea95afb39f9b03c91bd7136
SHA512 fef93841ff0de71e7162ab78a2e961c13d34e4c7d8479fbf23ea01460224c7c604d677075be94cdb450a709d3416fd9a77d31420f05db8e2af1d826905e6a126
SSDEEP 384:SZcIhsNion1ERb7Ldc4VRNPOwG9Ou60X1puLmQkoQ:ghm1EQuHPOwG996syLmQkv
TLSH
T1ED827D726D384C3769F3E545F54B36078FB89137A6C86B80E1DDAB0C02DA69D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8b14aeccea630cf909f49a727872ccb2ddf3580ee1ca1598f4724c60ccae4626
MD5 350e404dacb3247c5914429f3529756e
SHA1 03b3516bc38074e94529bcdfeb565735d8fc109d
SHA512 015522c1f41ee4077ac38fc9c996af4f0c3b647f10350b43b424610e02c17a5bff8a4970ec4cfa35224edda00ac64434071786aefeea9971dbd9ca08d14c8b32
SSDEEP 192:tONY6JkRtQmiUykCW+RNPOmlhPXh3YRmoU6:tONY6UryW+RNPOwv4U6
TLSH
T11302D735AD381C7B9EE3AE09B98B27175FA4207BB9956F80DAD81F1C01D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f82107b1c27232a3ae64965c107c8ecac42b26eef6ceb92e630b24ff17ac7d9f
MD5 72ad574c43b0d96a9aed86a802cf19ab
SHA1 8786cc40ec3efb2abd32809a9ad6abd8a39d336b
SHA512 6478ed56c56a1d3390cf6c792cc49fc6cfcb19f9475b1660c10eeef72eed70f45c0f57398513e4f48640b8e9ab126743a64c263e40efcbeeefa6ee3992935984
SSDEEP 192:YONb6JkRJQmiUy7XCI+RNPOmlhPoB9SFNVcNq/HU6:YONb6UnkyI+RNPOwG9OA6U6
TLSH
T1A8120A36AC385C775EE36945F58732574EB55127EA896F80D5DC2E0C02EFA9C230AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 73b837c5faf6ad8c9e76b035474ce36c92702a6d31ddc9daad7f41a805bdaf2f
MD5 5107a29811ba30c9da03feaab8b1743e
SHA1 ef043bc3d72c2de15fc2306557394e6d8f781357
SHA512 976bdfba9bc5d264564a5ab3703f144f2ee00ee4580df7707d8f2e43dd8476aef1427d60012e659c7ea3ecff308297e2efd6fbf85266dbabc806637c06b4cd45
SSDEEP 384:qZcIhsNi6n1ERb7Ldc4VRNPOwG9Ou60X1puLmQkoQ:Ihk1EQuHPOwG996syLmQkv
TLSH
T147827D716D385C3769F3A545F64B36078FB8913796C86F80D1DDAB0C02DA69D230BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c9f4f820482671cb11170ccea9cb08bd86aa43f81b986f5581671b73589147c1
MD5 3e7b01ceacfcaf0346b756e3c524904f
SHA1 185fcfaca617c027784c40c4dad91701a58d48bf
SHA512 b24788fcef6d92dd841235cb5be07b2c77b248409d3168fa73a54b629f745eee78010076fbc02d9101ffa70112c24a07356e214fad6aca9b2b2c8455264280b4
TLSH
T137413959AAE91148B3B76F5AAFB7B46D887ABD362E06D09D10110D8F0623A00DD71737
MD5 SHA1 SHA512 TLSH

Submit Download