hxxps://github[.]com/llmspace/cows-call-intelligence/blob/741729f9018fa3cda13b68017dcf7c8d7a68b5b1/data/rag_exports/freshdesk_kb[.]txt

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/llmspace/cows-call-intelligence/blob/741729f9018fa3cda13b68017dcf7c8d7a68b5b1/data/rag_exports/freshdesk_kb.txt
Sample260909-zaangsap2w

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
82	raw.githubusercontent.com
83	raw.githubusercontent.com
84	raw.githubusercontent.com
87	raw.githubusercontent.com
88	raw.githubusercontent.com
89	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2788	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334594308226335"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{35987D7E-6388-4674-8AB6-C84F6523BAFF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3648	4600	msedge.exe	88
PID 4600 wrote to memory of 2788	4600	msedge.exe	89
PID 4600 wrote to memory of 3432	4600	msedge.exe	90
PID 4600 wrote to memory of 3432	4600	msedge.exe	90
PID 4600 wrote to memory of 3432	4600	msedge.exe	90
PID 4600 wrote to memory of 3976	4600	msedge.exe	92
PID 4600 wrote to memory of 3976	4600	msedge.exe	92
PID 4600 wrote to memory of 1372	4600	msedge.exe	93
PID 4600 wrote to memory of 1372	4600	msedge.exe	93
PID 4600 wrote to memory of 3328	4600	msedge.exe	94
PID 4600 wrote to memory of 1372	4600	msedge.exe	93
PID 4600 wrote to memory of 3328	4600	msedge.exe	94
PID 4600 wrote to memory of 3328	4600	msedge.exe	94
PID 4600 wrote to memory of 3308	4600	msedge.exe	95
PID 4600 wrote to memory of 3372	4600	msedge.exe	96
PID 4600 wrote to memory of 3308	4600	msedge.exe	95
PID 4600 wrote to memory of 3308	4600	msedge.exe	95
PID 4600 wrote to memory of 3372	4600	msedge.exe	96
PID 4600 wrote to memory of 3372	4600	msedge.exe	96
PID 4600 wrote to memory of 4788	4600	msedge.exe	99
PID 4600 wrote to memory of 416	4600	msedge.exe	100
PID 4600 wrote to memory of 4788	4600	msedge.exe	99
PID 4600 wrote to memory of 416	4600	msedge.exe	100
PID 4600 wrote to memory of 4860	4600	msedge.exe	102
PID 4600 wrote to memory of 3480	4600	msedge.exe	106
PID 4600 wrote to memory of 3480	4600	msedge.exe	106
PID 4600 wrote to memory of 3480	4600	msedge.exe	106
PID 4600 wrote to memory of 3644	4600	msedge.exe	117
PID 4600 wrote to memory of 3380	4600	msedge.exe	118
PID 4600 wrote to memory of 4792	4600	msedge.exe	119
PID 4600 wrote to memory of 2900	4600	msedge.exe	121
PID 4600 wrote to memory of 2900	4600	msedge.exe	121
PID 4600 wrote to memory of 4396	4600	msedge.exe	122
PID 4600 wrote to memory of 4396	4600	msedge.exe	122
PID 4600 wrote to memory of 1116	4600	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/llmspace/cows-call-intelligence/blob/741729f9018fa3cda13b68017dcf7c8d7a68b5b1/data/rag_exports/freshdesk_kb.txt
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffbf87ec188,0x7ffbf87ec194,0x7ffbf87ec1a0
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,7079988814545483448,17769277331264475351,524288 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,5422996123567755705,3671711206898585312,262144 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,6470071316218269750,2759392608428912969,524288 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,15528582601710625109,16950737879343292064,2097152 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,12569260380363467426,6696818368038347468,2097152 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,16257337175099984332,5954423976671811694,2097152 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,10183513754784737711,10120043096408878593,2097152 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,7498872435034572569,10507381967464556408,524288 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,1299196732531771836,10410248924921300578,524288 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,2547185529657411823,8852934061640230780,524288 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,2547185529657411823,8852934061640230780,524288 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6292,i,5737523115627038082,9517988287337675192,2097152 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,17247463972028595358,13382828506110203231,524288 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,2191256548310346208,4299529469360932355,524288 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,11182266139336262508,932284975564145693,524288 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,3776579020527115291,8640089331730947813,524288 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,17630139700046521401,15080225956798708183,524288 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5356,i,18085200443168216732,18235756635102599303,262144 --field-trial-handle=2112,i,10051335982848442420,7537795761035504679,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 67049dfae6e65ae21fde7f0fffc24ce13c5d8e70c8656bbf59f00798526f0c93
MD5 2a7f20908d347784d82987cd4305f7ac
SHA1 15d520af830fdca54e4c2553f554095d9d9960f2
SHA512 677e6852933d2ad4a96a7772ecbcba30cc2c2afb36b07c7d480793fe8b387512163c02ab766a49e2eae865636dfc40fb43365da81ae4387614f95e4f323c3623
SSDEEP 96:Lbv8askVF8RlcV2UzHqJY+toNg6MFC3UrJQVmSUw:/kXkwg4WlydFWUrJQVms
TLSH
T175C1D43B844E3C55FF9A0BB324E19E13F9716ED6F5931E5531ACEAB30401381481A0ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58971b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58971b.TMP
Size 3KB
SHA256 5318a992d7a549b7d9f5d7a3fa9a12b889dda0adeef7cae1dbf3ab6745087bde
MD5 d975748c498ee1ba46f9755cff8a3bdd
SHA1 aedc5217ec02264a7040d820eb3715ef617e11f7
SHA512 006e794272a29ba27bbd9ee6721beb034376a80daf3658642cfccd204eba8eb00a7c5dfb551028d4409548259b22b189904cf2a4526aca4bd6639fd52fda086a
TLSH
T1B671C83D044E4469D3AA03F3A4F11716BD71BBDBF5D32E9571949AF028053D68E4F1A8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8a578d447ac1ed6f18296de5706735546b80bffc98e4dd177eba0612c84a5a14
MD5 f174222c4a42a47769e10a5b1afe22ea
SHA1 5b39790f160d326079290a8e7e11c7be4c8a8596
SHA512 931a4dacb63b659ddcc3f0f81dba8ee9f2d770233e6897f1862e442ec35a9995da046db3f1ba9ed758a9ffc90326601997204b85942e5a910b366c4dc7bc4781
TLSH
T1CB415AF747F2966D9B1259F0AA18EE2BCE2C0111832C786985E0BE57D3E3872E10175F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3fbab26ffab7edd5a22327e597f4a2700b0160c9e08b9e4dfd880abec3aa2c04
MD5 28f98feab9ae50c756e96c9f37faa7ab
SHA1 21f056941983608a0920a7a961543e446e8b0d81
SHA512 f57cb2283b86f31a89900dd4bbd6af738203676781a59e6a2dfad2868009ed8349894258f71420731686e297ebc91368f387e7724774977a38db393d15d364fa
SSDEEP 192:sxZpRyWD/f1sTWyIdp9mTKLHW6+WN3E108/YzZs25vIgrJ:sxZpHD/f1sTarHbm/Rq9
TLSH
T14D22D952AE74697B8CCBD319BB15BB53E2FA103292D14D48AAFCC61C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3651cc2828b7e9d8db0b4c12a3a18bd57d11b4b2f6e5aa473faa8c3c4588201f
MD5 5c243fb6d7dadc2b681600b00cc7cfc3
SHA1 031158aa4f89bfaaf2cdc6229001f1d1200e16a4
SHA512 2ceb57223cad1694e30b42060a0f5d408e073caebf0982d98d28f91924333299f91aee1fd57afaf96bf8ed6b8439281f474cc3950b777e3e3a56020df8c94256
SSDEEP 192:sxZpRyWD/f1sUJyIdpvmTKLHW6+WN3E108Nl0i/YzAs95vIg5sAJ:sxZpHD/f1sUVtHbm5/+Tv
TLSH
T17532E952A974697B9CCBD319BB15BF53E2F6103296D40E48AAFCC61C04E77CE620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9e1cea006fc2698dc8a39e9acc8544f78cb94e07c72a6ee4977096d028eb29fb
MD5 bf50113178d9c045a4d4d7a78becdead
SHA1 cc55e39d70c0569067b97fa5f1caf7d71b84aaa7
SHA512 e9085118f4d0341639f50692a55eed28b3ae44b4aa00ce6728469710501b9f863e602ce87704b2b286e84ecb69b09e3f5c5c8ffc62194497c992005ab446c456
SSDEEP 192:sxZpRyWD/f1sAJyIdp9mTKLHW6+WN3E108/YzZs25vIg5sqJ:sxZpHD/f1sAVrHbm/RqZ
TLSH
T18B32D952AD74697B9CCBD319BB15BF53E2FA103292D50E48AAFC861C04E77DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 63d2f8c08905b0a6b0f4ac76132725a62a602d5321e4ec67c21de4286a91003f
MD5 07dad4a14acd2a7a53be7949ca04950b
SHA1 1baadd0940e81710fd7be7d654d9419ac327611e
SHA512 4a1caeac64086fbe8ce120c31e25187d62ffe858acf2c40d76d787909043ff35c302f688592b00f54226259d9cf8767d01e566a3c6a4b4abe5d796d5dd228377
SSDEEP 192:sxZpRyWD/f1sUJyIdp9mTKLHW6+WN3E108/YzRsS5vIg5sAJ:sxZpHD/f1sUVrHbm/ZOv
TLSH
T1E432D952A974697B9CCBD319BB15BF53E6FA103292D50E48AAFCC61C04E77CD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 aaf42c236c4efefe886b402b5a9bec1f5dcb8b83fb771a0e620a4e85fd124f4e
MD5 359cd82e2a9fcc9d17c7950fd038792b
SHA1 f7bc63c9a413e7d4aa579718fc2909776198fe19
SHA512 cdcbeb5ba9a96ea383c9eebfcc495bf335374e6547a40e7444393b7b55c66a3c6dba4ab480557e02bc78f930fbfff5a4530b457b4ebd72041fe950a4e77385db
SSDEEP 768:HHk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBYroyNY0:HHk7u70WvqiEau1jai5LA3Bjt0
TLSH
T142C2E93B740CCB7E4F801E9DAC566F977E9802C7A6988D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 60d8ab20d2fe2b4dc0dd64a2636dc96bb14c6df68c43c86441106795746f6d16
MD5 f025f9aa655ffaa692abe60800b493e2
SHA1 e2139f5679e7979d0eea72188eb4244db8631a42
SHA512 78075ea0faf591759e4d0b22eb3b56a4bb633aa1cdb6ca493a0a3befcf8f1c33ca0c48bd925e736da7cbeeec146bd3bb6bf32605893f11c76aa91adf2066f54a
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTfTINKIsgPyBOI3KHqg/y1zINK8U:KIbCKcfTWKIsSCOEKHqauzaK8U
TLSH
T1C191D51970760A51383EB988D6A9863F1F8232937454E96F7FA81062DF6BE014DFD8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592a81.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592a81.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ac0d65d79cf5581492870471f3f252ed227811a3008cbdae6160e6dc42493f75
MD5 17695e3495261fe142fb755882d369ef
SHA1 8085b6eadb722a7e27f933e99e4b50c8c1271e6c
SHA512 0ffa82fbeb511844a24865d2acaf14ff78cfed932e6633ff1b1f39bbf27788f3b9d387ab055eb0662264ff69e2803c3b969d96c38049557da850f341705d272d
SSDEEP 384:SZcIhsNHLqu0b5u2Qd0mEMUIsa+VYwG6oW:gh5cbkMUIhgt5N
TLSH
T197828D725C745C7B5DA6F342F98637035EF88167A6C86A44E6ECAB1C01EE39C1307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7b88ce8b702e906e0edc57d9e2a4922d1b4f0ea17cb70ecba386f69dfda3a593
MD5 47e911de041b0182a9023130f88eac9d
SHA1 dd12b005c76ca935d29e3ff103b8deab5b8369a1
SHA512 6e115b45eb6596b458b65d6f651829bb2728e60c2d1ae64e2c8b680ac88cd464173e302e87be81e7d78c8966dd32f337a312c4d781ddc2da6b214ed6970ff181
SSDEEP 384:AiFiZcIpIsNZ8TUNTUlIlgqu0b5vIezI22Qd0mEMRIsa+VYwG6oW:bFQykwgtVIezI2bkMRIhgt5N
TLSH
T113C24BF248E7887AD9AE9743E77D2E025EBCC167B584A544B7C85A0CCC9A1BFD306C05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2fa091307fcce853d0073827c9cb457fc31080eaf77be64955f606b02d8b93f3
MD5 b654a595395444c9f3e1ec31496a1084
SHA1 4b958c4abb07b642363f538e683c54aae7b24ca9
SHA512 71e9db0abb30013317e593b36d0ac55e9b174afd4dea2c05b9d20141f3044864223db11589aa0c33ccebd773c4dfb0b56fab0d4d85d6787db53bae5cc7f67e45
SSDEEP 192:MONf64BAQmiUyH16W5GBPKcl+FdGuom1baDO5U6:MONf6eAUMWzd0mSSU6
TLSH
T19B02E934AC796C7B9EB2BE45F5863B175FD8113BA6D45B44EAE81B1C00E724C234682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1ec39b2f04867d3126708457e5f8598b04d7a149d88e637a26925d5ad49cb180
MD5 c1a59b908de8960ab79248687f49b089
SHA1 c3cc93cf69821f6078f4014a54e0271ceb5a7b66
SHA512 b25a6163447f051e9d56a26a25209bb0a038a3f42d09fdba0e726bf01e6d6fbd4db12fbe314da562acf60e6ad175c4ce140af16f499abb4e949932ebe73ef833
SSDEEP 384:kZcIhsNHgqu0b5u2Qd0mEMUIsa+VYwG6oW:ChmcbkMUIhgt5N
TLSH
T11B828D725C745C7B5DA6F342F98637035EF8816BA7C86A44A6ECAB1C01EE39C1307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 31982d12d8a63d87f33ec8d7fb15dda6d7aae640c5ad240e2c4050fff37e207b
MD5 3c76f78e5ae6eaeff25080b15db7496a
SHA1 f7aa945d3540c369f93539a0539fc4a0b01b8497
SHA512 47b880c1843ef383b0fa1b160ad8819f09f0f948e0b4cc1124f0c3a77160158736ec92e29941be8d2839d6cf750101097ba0403e97ee47d467031d33041f8308
SSDEEP 192:RON664BtQmiUyu6i5GBPKcl+FdGuom1YKEMdWwwq2U6:RON66eryizd0mEMBIU6
TLSH
T16C120B319C74AC2B5E92B545F48737135EA5412BEAC86F45F6DC2B1C01EF6AC230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e004b6f8-f7e7-48e0-928d-f459c32dc974.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e004b6f8-f7e7-48e0-928d-f459c32dc974.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d8f61c008914d9223f066158b0bdab554e637ca3580bbe1de57e2f69baa01734
MD5 bec3263b3f8fcb43a2eccf1bbb0195eb
SHA1 a179a24059ed74422a37adf1bb11a735f406ae51
SHA512 668140bf8cc5bb8335665b0770c0ab9abdd94e80c3451d8ae5f69505666a7efb97c539485b50e95e0b32d8a41b546fd5f81b1fb53ec5881be763f8bc1be6934d
TLSH
T10B412858BAF91158B3B76E4AABF6A86D443A78372E0BD55E00110D8F0A73B00C86173B
MD5 SHA1 SHA512 TLSH

Submit Download