hxxps://goldfish-app-9tdja[.]ondigitalocean[.]app/

Resubmissions

31/08/2026, 23:46

260831-3sshssaf6410

31/08/2026, 23:27

260831-3fvgmas1bs10

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://goldfish-app-9tdja.ondigitalocean.app/
Sample260831-3sshssaf64

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1512	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326936359310726"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{D8BDE241-10FE-4F98-ABDF-346A5EE2B8E7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 4116	3752	msedge.exe	85
PID 3752 wrote to memory of 1512	3752	msedge.exe	87
PID 3752 wrote to memory of 1624	3752	msedge.exe	88
PID 3752 wrote to memory of 1624	3752	msedge.exe	88
PID 3752 wrote to memory of 1624	3752	msedge.exe	88
PID 3752 wrote to memory of 2212	3752	msedge.exe	89
PID 3752 wrote to memory of 2212	3752	msedge.exe	89
PID 3752 wrote to memory of 1700	3752	msedge.exe	90
PID 3752 wrote to memory of 4444	3752	msedge.exe	91
PID 3752 wrote to memory of 1700	3752	msedge.exe	90
PID 3752 wrote to memory of 1700	3752	msedge.exe	90
PID 3752 wrote to memory of 4444	3752	msedge.exe	91
PID 3752 wrote to memory of 4444	3752	msedge.exe	91
PID 3752 wrote to memory of 872	3752	msedge.exe	92
PID 3752 wrote to memory of 872	3752	msedge.exe	92
PID 3752 wrote to memory of 872	3752	msedge.exe	92
PID 3752 wrote to memory of 2300	3752	msedge.exe	93
PID 3752 wrote to memory of 2300	3752	msedge.exe	93
PID 3752 wrote to memory of 2300	3752	msedge.exe	93
PID 3752 wrote to memory of 3216	3752	msedge.exe	98
PID 3752 wrote to memory of 3216	3752	msedge.exe	98
PID 3752 wrote to memory of 948	3752	msedge.exe	99
PID 3752 wrote to memory of 948	3752	msedge.exe	99
PID 3752 wrote to memory of 3268	3752	msedge.exe	101
PID 3752 wrote to memory of 4528	3752	msedge.exe	103
PID 3752 wrote to memory of 4528	3752	msedge.exe	103
PID 3752 wrote to memory of 3380	3752	msedge.exe	119
PID 3752 wrote to memory of 2304	3752	msedge.exe	120
PID 3752 wrote to memory of 4712	3752	msedge.exe	121
PID 3752 wrote to memory of 820	3752	msedge.exe	123
PID 3752 wrote to memory of 820	3752	msedge.exe	123
PID 3752 wrote to memory of 4940	3752	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://goldfish-app-9tdja.ondigitalocean.app/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b8,0x7ffc04f7c188,0x7ffc04f7c194,0x7ffc04f7c1a0
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,9007889231929054930,4057119776644073014,524288 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,9299297053886985251,7210796876936444594,262144 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,16677148145703680278,1124040300215787722,524288 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,3611478026891919278,7136260515517627884,2097152 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,5501978857463110416,8111745617151552822,2097152 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,9190328305200471798,14998033214959532511,2097152 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,12471171557109449855,6686216591616301482,2097152 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:2
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,1325586682159114542,213568274727147145,524288 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,8520465519613601839,8225694492993353434,524288 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9034498774846839629,7324791144871589223,524288 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9034498774846839629,7324791144871589223,524288 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,4680812511870199351,481720321515593797,524288 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,1277378493703660202,16641600765976948693,524288 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,1138888603776964200,17609473534766407973,524288 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,8195781255541612074,15080035953494834727,524288 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,316505968083454555,4173288623090077875,524288 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5776,i,16209616903405434334,15930489308097419320,262144 --field-trial-handle=2280,i,653009835816032366,6381601409194355752,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 bdd684ee3733add09957780a97497cc86f87c89174acc2e4045fd4cd68afeae9
MD5 214763e8712ff68191b6dc7cd6af3cf7
SHA1 f6946f6cfa99e58fc1ef086f0d65a8dd23f15f1e
SHA512 cc44590f139ec100ad0ea54521e33aafeb4fdb9bb02b03abafd0e9e95d2152f363d6745d24bf4c8e4ec09b8516865fa1324dde6f4915e169a6918e2a040a3f34
TLSH
T10F51703D1A110862EBC00573F0FB8A54B17985DDFA13AE73C6B36D791B0A325C00D389
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e5ad2e74565de9eb73c8f49684be2f719c50dbebcce3ef8056d4e7a51173cb37
MD5 308789a6f732d58bd5bd7919be4d5093
SHA1 a4f1a18fe8cb59cb0a87aa79b7bc657a5dd6c233
SHA512 a5ff0092082e3d1064dd53ecc2c5f014fdf96296fb7441b3799d3989999ea9416362ac8570f3c1c30fcd82912420188764c58ddaf9f0708ce41d6bffce384420
TLSH
T189515F3D1A520862EB900473F0FB8A54B17985DDFA13AE73C6B36D795B0A325C10D389
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c445.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c445.TMP
Size 2KB
SHA256 b66fe03b23590f1cde63a674cd9aa55957101e899e1a1d6ef5120611b9102bc9
MD5 6aa045f274161783785b55e60c786290
SHA1 0346a9c4f00de7af70f5ab924c46db2fbf4bf901
SHA512 9f8c860614c1820c8eca5a7747a0144064a626451168c72bbcb19cb414f1fafb5b35db7dfdbbde128e0f4e52b72a9c3f72d0f3db62b22d8ceeaa0f7b24a25092
TLSH
T1CB516E3D1A510C62EB900433F0FB8A64B17985EDFA13AE73C6B35D7A5B1A321C10D389
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 25386f6c679767e7955de9c41412c2b5895b53033fdbdc6e6dfe3be22aea39a9
MD5 68fc50f8d537176a831ebb98db4effce
SHA1 5a3b36ad6ae0ee58f7d1b1e247b2b7f2b311acad
SHA512 86ea685a9405aff1e606075737b560d478809780b017f1927d066a56cd55322c3aa4ad447c18f53ed88224d983bddd37d75b1a4bcd56dfee25a59423face9546
SSDEEP 96:DTKOUZTKnTK6BOTKzZTK3TKqTKrTKxNzXTKETKxQTKFTKs9TKgTKQTKL/zTK1xwQ:DTbUZTmTL0TIZTkTHTITQLThT4QTeT1P
TLSH
T1BEB1BDB186E8552E8A4203F45725BA17CE1D8A2F4219391A8DD6EF8FD3934B1E24168F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6d2543852ed53e4b69374a2fb0f908b924f15f29062a5f05e832720ab85aea7c
MD5 f0d6ff348645966901a324822ace0046
SHA1 9e18984c31cea750d1468f5d75bb174080e715de
SHA512 3fa74fd74958a2155d3aa243dfc804153c948c4471a142c4664ac6cd09a5a9ba757b9cbf989733106c69c73b05dfabdbf2fb38c6d0f820e5b45e5b6302f509d7
SSDEEP 192:sxZCRZ9o/fCsrep6IdpVuuHW6+WNV99u/Y9IlNfIIgrJ:sxZCpo/fCsreFVJHbVa/o9
TLSH
T13E22B6126E38A57B8CC6D209FB65BF53D6F94432A1D11E48E6FC961C04E6ADD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 09a65008c191a160401e9b056bd37de3b8cb7c32e5c9c525cc039d19034add5b
MD5 ea2fd865e3d29a6105220139f4cfa752
SHA1 9a7dac695cf9c773732cf5a2acf1daeaf96ba4e5
SHA512 ff15517c5017bfb20480d1c92085ed4c31dc73bda618d0afc9b768a7e39bb0287455b962790877c6abdec514e15ba7902a9f85e76387dc5e28961a3378e6f080
SSDEEP 192:sxZCRZ9o/fCseVp6IdpVuuHW6+WNV9CgtY9I8rfIIg5KJ:sxZCpo/fCseVFVJHbVHtbw
TLSH
T1F232B7526E3869778CC6D209FB55BF53E6F9543291D11E48A6FC861C04EBADD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d93192483e9c72aa06eeaaeeab9a54369e55226b609f8c9f477d9deb6cb0544c
MD5 95c34d530022ae7b6562fa4dbd723bf0
SHA1 18eafee3cf0bccb8c1fd82d1f3d6ddb012a73c85
SHA512 4da10b3864904ac086b4a8337a6addcb39ce111eb88640b8ac512bb0b20f7448975780beb322cb92cc6e7ebc610aa7f36f8d1fef00788e41469c38a97a865566
SSDEEP 192:sxZCRZ9o/fCseep6IdpVuuHW6+WNV9NqdY9I9NfIIg5oJ:sxZCpo/fCseeFVJHbVSdAy
TLSH
T1EB22C7126E38657B8CC6D21DFB69BF53D6F9443291911E58A6FC861C04EBADD230B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 436010e9b06a87e14329278a2a64f65acce2e0efdffa4244f2a4ddd04aad7d91
MD5 d8c4ecb568ad9180875ccb02e6a6b21b
SHA1 e4b191eef66aefeddf398275d4d78fe0d32a8bbc
SHA512 a50eab1aa7d6a50ca237bc7121d24d68d719ed589f25f3aac8d03415920cc719c2e60a9608d10243e877df950f9f5c81b08ac72a074bbd421f13aadc83f37722
SSDEEP 768:nlyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7GroLbqp:nlyvIZwWvu+Q+u1jamFLeR79Lg
TLSH
T1AAC2E92B240CCB7E5F801E9DDD5A6F9B3EA802C7A7588D4047FD994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2b49a5dd101121e750ea43251e2314607900770fda1953120cc8d39796641c75
MD5 5292a120216aa109c83ca4576b60ec0d
SHA1 4f8ec1fafd3959785b863eaad7523d8cc1adedd1
SHA512 8ecce1f163dff4c994c1d10fa5fdaf19573959d016e5107a7d52334117ca163a0e24f3f8f8410f128e778f6540e5d231d54b8d4b3bb08ddb5a47dcde21a0714a
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDi5yoKLbSuVWKmEo:mTJ+5T
TLSH
T1B9916045F0BA12813C7E684C929185BB5B4230A37418E9BF7FB940A25FABE115EFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595e53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595e53.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1b5632559d877a284d7137c0fe0613b1d21bfa17a78407b8b25a59dbfd768263
MD5 1b393b9bb835471dba62546c44ef2bfe
SHA1 954457c5c7d9885ab2696bf51d1349774d522eaf
SHA512 d70e7433a6734bb571fbf4b702967f052dcb55a6a83f66a0ba000a82e1d1fb9c0a22265b598d0f5157c811482421dbe6a6dc3cde5b4b6c93a906b5f86896cde5
SSDEEP 384:rZcIhsNXJFudzimyKe+C9d6NXeAI0X1puLAuo+:zhwutKNF+IsyLrV
TLSH
T1F8827D329DB46C7B66E2E545F14736075EB8C473E6C97E80A1ECAF1D01EE6A8130F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f7b89dccc78cb643a4ec94d9d8c2aa098336a958b0225aa1fb6bb649baf10e33
MD5 23e4fab5acda69b20d348dbfe7d7ebbb
SHA1 3c66cc9b33ca55e96cdb41d2ee5153f66ca78a1b
SHA512 73f65cffdaa36bd0c144821a749d4346f6403dff7fed7bc9b3f475ae02d54eb2fc9754f3c53af6365ad7f4d3b097b4ab045c0694b988c719131e32a9661906d2
SSDEEP 384:HFiFiZcIBsNp8TUNTUlIlQFudzimBKe+C9d6NXelI0X1puLAuo+:sFQBwwgAut5NFHIsyLrV
TLSH
T134C21AF24DE7587AD6AD9743E77E2D074DBCC063B5856940B3985A0CCC9A1BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4a20bf186165636a373cd4183da6386d7bc1e85ca68298f04783fdce32f3dfbc
MD5 5a34106620d1ccfdace2ff1d000ef49c
SHA1 4833976ed35c4a90b7a877e529e1e5ebfd018561
SHA512 7a3a596a6154d309e04f711ca33a8f15d75af75d4fe9c19c2d4500596402e98ca2cbae4ceed6bcbac8ba16628485b95e07d1d21574e943d65438f0846f80e62d
SSDEEP 192:JONWS6v+YLNQmiUypQZh+CGX+FdeNNmusMpU6:JONT6vz/DZh+C9d6NIAU6
TLSH
T14B02E935AD782C6B9FF2AE05F48737135FE42177EA962B90DAD82E1C01D765C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 26331c4193b205dbcb4c090499cd9ba1b6a4644c2387e6313239fd8e7f8f89d3
MD5 b44eb3c65b65f5e907a189d92d09c8de
SHA1 90180cd627d324ce91efa6243a3e99ddbde96f08
SHA512 1035a7fd7c1113cfb537dc4f57c8db074a57415959e17f4b1d7466ca3dca7f29d059a711793c21eca4e4e61ed729919a2ecf604eb7f108388f64247453e5d53c
SSDEEP 192:CONi6v+YL/QmiUyiQWh+CGX+FdeNNkGQNsCH1qgeU6:CONi6vzFaWh+C9d6NXelIU6
TLSH
T1F9121C35AC786C6B5FE2A941F08736135EA89177EA8A3F90E5DC2F1C01EF65C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e52bee6fc65fc23ddcb7f99d4c360a583440bddbad9cf1afb7ac2ea1c0efa147
MD5 01e44800f9907564a12eca83d62cb0a0
SHA1 a928414472ecdd9299f27a27bbb80bd7253c3741
SHA512 fe718983833e63c0415c4ca5e1cf57ddd9c03515996b63ba7aab78cefc63449acf8c74133e275bbb50df5091a92ae8d427e71c02b24a441492977e117827b639
SSDEEP 384:XZcIhsNXQFudzimyKe+C9d6NXeAI0X1puLAuo+:fhPutKNF+IsyLrV
TLSH
T139827D329DB46C7B66E2E545F14736075EB8C433E6C97E80A1ECAF1D01EE698130F916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6fec0897-57a5-47a1-9569-9b8df5b6b94b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6fec0897-57a5-47a1-9569-9b8df5b6b94b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 480cddd4d41ace5437461558eb49ec0e1dc7472402085b6f4241c3ae024de6ae
MD5 a4397263b274816eecd7bfb563cd29d5
SHA1 7ba02fc052c307451298216e5d3a55599933d59a
SHA512 e8d730bbad4fb6e8e292023779151a62952fabee2a972e8421d534bdb29f9061826273b191f5f0412a38ad30c8d67362cf47430c8e782fb3e6943065c09eae37
TLSH
T19641F858AAEA1148B3B36F5A9BF6A96D487FBD372E06D45D00120E4E0623A40C871737
MD5 SHA1 SHA512 TLSH

Submit Download