1d68d801dc1220eb1ec29788b257282f939c7ec04f3027b056541895440cf2e4

Analysis

max time kernel
148s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PusatCs/1/dua.html
Size 2KB
Sample260910-qcf4lscp2t
SHA256 1d68d801dc1220eb1ec29788b257282f939c7ec04f3027b056541895440cf2e4
MD5 17ffebdba5cce1fd6bbaa4d82f77d553
SHA1 ec513da360657195c3a1e1515b4ae0b4fa7ac3df
SHA512 d1f83b9533dd0fc454c1bb79f5cea21aaf6d68004fa5e5c0db70bdd157b0ac02f1147b16e0a3f9d976e8924e45ba49f86baf9584b09d9a4b98a0f495ecc936cc
TLSH
T1335181A524F251BB608310727786B7167DEE914BD70BCA6CB2AD86326FE6C474483349
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335192183981452"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{FF0DBCC4-7F28-46C6-9DDC-0674DB6701ED}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1016	2040	msedge.exe	84
PID 2040 wrote to memory of 3988	2040	msedge.exe	85
PID 2040 wrote to memory of 4292	2040	msedge.exe	86
PID 2040 wrote to memory of 4292	2040	msedge.exe	86
PID 2040 wrote to memory of 4292	2040	msedge.exe	86
PID 2040 wrote to memory of 536	2040	msedge.exe	87
PID 2040 wrote to memory of 536	2040	msedge.exe	87
PID 2040 wrote to memory of 4172	2040	msedge.exe	88
PID 2040 wrote to memory of 2532	2040	msedge.exe	89
PID 2040 wrote to memory of 4172	2040	msedge.exe	88
PID 2040 wrote to memory of 4172	2040	msedge.exe	88
PID 2040 wrote to memory of 2532	2040	msedge.exe	89
PID 2040 wrote to memory of 2532	2040	msedge.exe	89
PID 2040 wrote to memory of 4976	2040	msedge.exe	90
PID 2040 wrote to memory of 4588	2040	msedge.exe	91
PID 2040 wrote to memory of 4976	2040	msedge.exe	90
PID 2040 wrote to memory of 4976	2040	msedge.exe	90
PID 2040 wrote to memory of 4588	2040	msedge.exe	91
PID 2040 wrote to memory of 4588	2040	msedge.exe	91
PID 2040 wrote to memory of 1540	2040	msedge.exe	96
PID 2040 wrote to memory of 1540	2040	msedge.exe	96
PID 2040 wrote to memory of 3436	2040	msedge.exe	97
PID 2040 wrote to memory of 3436	2040	msedge.exe	97
PID 2040 wrote to memory of 3952	2040	msedge.exe	99
PID 2040 wrote to memory of 2364	2040	msedge.exe	111
PID 2040 wrote to memory of 4392	2040	msedge.exe	112
PID 2040 wrote to memory of 3420	2040	msedge.exe	113
PID 2040 wrote to memory of 2808	2040	msedge.exe	122
PID 2040 wrote to memory of 2808	2040	msedge.exe	122
PID 2040 wrote to memory of 516	2040	msedge.exe	124
PID 2040 wrote to memory of 516	2040	msedge.exe	124
PID 2040 wrote to memory of 1920	2040	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\PusatCs\1\dua.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb5435c188,0x7ffb5435c194,0x7ffb5435c1a0
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,8888662188431967318,12425983307440699082,524288 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,4708759926282347625,12228256145759225075,262144 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,10961216952829298493,17298717911554910887,524288 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,1752910264655725535,893340428140189570,2097152 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,17361508218914406229,13634638535725408036,2097152 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,2135633012380466741,7325834349377646527,2097152 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,9090085148590097147,6624520678532842117,2097152 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,10157184290103596907,12930709297851280306,524288 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,2177968331118062080,14400931435427203767,524288 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,16438108616565044205,17677961480894145767,524288 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,16438108616565044205,17677961480894145767,524288 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,10725608483824380787,7067435574546039141,524288 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,10231876637633732569,1130930293664047593,524288 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,10507373914064568815,12163771480703225253,524288 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,1906610608932269301,8472712011236322375,524288 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,5476354611450237581,663595877715878688,524288 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3252,i,9496737349509414,11327048435051231320,262144 --field-trial-handle=2316,i,17111495537318578420,3631059648325000535,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c9fa3c18e255f85e8b1a7fdfc74fa2693a3f1e26909487863b8d552c5530507c
MD5 af0b2a26cdf6b78520445ff191758f34
SHA1 a12ff3929f64b2a4a255026494be5975d5beccb1
SHA512 39d6dc8c8e2e5ce009e31ca046830145066b15af0a8d8a478293391e1b26d1c1fb3f98e237da2099f80383c1b9cbdb6dbe5a3dc9ebb49e08afa9c7a6b646f9e6
TLSH
T11151B3380D118865D760CAF1A2F0E28F7B70FAF2F873DEEA545354326A1273183D6298
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592987.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592987.TMP
Size 2KB
SHA256 80c3790069c23479c38535b55551bec6c60b7e4baf91742e2713c998ca9d52a1
MD5 b1a001dc01f8b70f4d900f4148f896bd
SHA1 c62c4a13c23f5ed36031ea3356e698a280c028fd
SHA512 83fbcb2718fe5d662f645026caa9be3bb77579f2fec3e8f34d7bd362159f954fa8c1ba7501b3a710e15e6006a0bbe40e166edc37d3c2db41ea9bcf80b378257f
TLSH
T1F451B3380D018865E760CAF1A2F0E24F7B70FAF6F873DEEA545354326A1273183D6298
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 57837edf36346a61ff5f69a0eb03ec2262a3db7f4f1894a1d99aae1c48fa15e5
MD5 e2fa6310eb0789545284e3474f2cbc8d
SHA1 8cb65e3e9d76c05e6d9e496743f4e76bc74a0761
SHA512 744c7a1c3c843aea75a79d09135c3336714ca2132c595f3b387e8fd684a01a16563d3dcb38149a219c0b213356e66ffd655d662a4e3a1b5d07e6028ad58513fa
TLSH
T1B4418BB6C3D8877E981156F05A257E2ACD1D055A42283C16C9F8EF5FA3E24B1D10169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4a4e394ff7d0a738c6732809f0d03878fae9018e61bbd9051e5fe9a14182f233
MD5 16c80d8e629cea78c49542be43123999
SHA1 02a424bd19f8bf4d7987bef8bb4c24fe0fc1c8c9
SHA512 17ef1b86c214348d2645ae9662a2d94440f6fcd672a17604f860af543c327789be2b34316b7d9edafc5e757e3f2a4afab340cc67aa6d133b3f024e876fe048c2
SSDEEP 192:sxZNRJPyM/jK1Ml8MW+/fcs334IdpdxHW6+WNGY9IKq7SIgrJ:sxZNru+/fcs35PHbGY9
TLSH
T1B742F911AA346977CCDBD209F955BF53D6F5447292A00D44A9FCCA1C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 318bcbd28a1568495accf1655ebc874a7093734a74ebe6f66e8c8f81dd4fa433
MD5 b4d70b0eb921a4790d44546a61da1635
SHA1 7197a992b0bba93f61ca77deda62ec16365f7827
SHA512 38e9136aad95bc1e0a7b39154aaa1deb3266712d4daa33a402bea2ead204d5ea7f5eb1eacfd8fdb2031d781b283f3c19fc3339208baf3d059ba87b01dd9dd4a3
SSDEEP 192:sxZNRJPyM/jK1Ml8UQtW+/fcsC34IdpHxHW6+WNGY9Iip7SIg54J:sxZNrq0+/fcsC5RHbG/a
TLSH
T11452E816AA346977CCDBD209F941BF93D6F5547296600E44A9FCDA1C00E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2317d903496e4c090b7fb679f55d27ca7d89db52b0404ca9c171cd93caa1283c
MD5 171bf3b8855eb811500b35cc9cba77ad
SHA1 66af92c7a601cab1e24f05e5dd6255b9aef5117a
SHA512 5056d3c9ba57e67354fd3d6261a0cf963a8c9b3b921260149e1fc934f424abee860dd2034aeb45bb3a01990e3c8125ad50860a5bfd886802a035ee2e3f7d2cb0
SSDEEP 768:hicv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNQroVg63:hicv21wWvu+Z+u1jaeFLeRN7Vn
TLSH
T1ACD20A2B280CCB7E4F841E9CED2A6F8A6DD801CB56988D5447FA894C03C77EB511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 84cd3358142a1fda4e4885a35b70d44650851d77c72f0699cb8165badd222b93
MD5 af805dc5a1aff4d955cb557cb9702c2a
SHA1 30e4c2ba5d13877d545a31f6a5468dbb8b4cc58f
SHA512 c39ee1721b7665ebe12f1bed0a767aa66fe3ca0c4586f0c9bd50cc8ac433aa4fe8694eabfa40766d2d0c2ddc80e15abb914d2e3ce8aa66170c2a9b082026433e
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDygha+IOKb5azq/WbKni/kbTgYbyqomJCKZ:mTdBJVn2
TLSH
T128B1E33633371252397D6948A2A587374E8132637814E5AF7BBD00A24EB7E216DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f48e77f9-5f9c-4834-884a-bdfd522ce64c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f48e77f9-5f9c-4834-884a-bdfd522ce64c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 19bc968863c085e832f3c11fc25408d5ef6fbdb689ff52a0281bee4ef6ce6e46
MD5 3a4be7e0f5d9873a93c49e49b297df37
SHA1 7136394c5e9502d6568969701f7616e114a5cd5b
SHA512 ce7f310583dc2195667a3df7790968cf3f5555f70ece8148072a3dee508389ab1fb43595b24abef26c0f445fbebbb791d004ba8400da90fc2ce2e253d2623220
SSDEEP 384:iiFiZcIrsNh8TUNTUlIl4a/yziSjMYe+CLOzttusa+VYXoT:pFQrkwgVSjArTOzttuhgA4
TLSH
T100A26B736D648C7B9DF79B84F94B36178EB840A7D9D9AA90D2C9AE1C00DB2DC1307C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 87cf048c47076b2f83f9458a8755e4009a7872980462b62148a59af0f193647b
MD5 a870abd3eed32a7b18afe1fa0e66252c
SHA1 205cecb967f87ac63ec57ca91ba92c00798c06f8
SHA512 ac44cd384d3a8541377f07a527b661a6288c10028905e966b0372d5ba5d88dd662ce23ed9096a47849b69fad08983eda7a7f1829d62f0761e01528ac12d95039
SSDEEP 192:JONl6v+YLNQmiUyJgZh+CGWOFmRMuslrU6:JONl6vz/3Zh+CLORlU6
TLSH
T17902FA357D782C6B9FF2AE44F58737175FA8117BEA952F80D9D42A1C01D764C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9cc4f9b4bc32cacc99903df9a616439cf06ad86c2d9f2425b46f01c4ea1e21dc
MD5 ca18ac5f65af6cff1032e80fe4bb407f
SHA1 698a75619c6ba01e9d311f484fd1658bd454de0a
SHA512 c024081499b8b8f34420c0c73acdbea75715c868f0dfc74f45c12bacc268f7cd2a69f33bcedbf180ed598e7e60ed860c42c23fe5982bb54ee63b13f5b9402512
SSDEEP 192:XONi6v+YLiQmiUywgoh+CGWOFmRetpCHHqZU6:XONi6vzCIoh+CLOztuuU6
TLSH
T18C122B31BD785C7B5EE2A944F48736179EA85177EA857F80D5CC3E1C02DF65C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8e3b361e687ae823a8672d2631386d47d2fef87647a898cd745d29d60de448f1
MD5 3eb0e28ed6538c2428e9e419daf771f8
SHA1 4b4ee4c0ae747acda9924e4cdbde3d6d6d555b80
SHA512 3ff4a6434f7b6ffc88ed2222926db6a136b2ddf7916f2b7c94ace3aeeb54872b4d3977640b0a649ca26b0030a85cfb1ea1a9a1d6d04486f80137c1e73d140376
SSDEEP 384:RZcIhsN/4a/yziSjMYe+CLOztuusa+VYXoT:5hKSjArTOztuuhgA4
TLSH
T1BE828D726D785C7A59E39685F98736178EB8806BE6C82E80C1D9BF1C01DB7AC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 71aa428c62a4c156965fe89fb5c1d9f324c5d195be13de7d393e39a37827557f
MD5 2a8ae0ae37d3bdbf3b6e8c24f84d22ae
SHA1 7c862de2b30d3dc70f2a111329dac65e3644713a
SHA512 86554c3e29d90f20d3349d8c7e6af1449efeada17fa043078f6d080714b36891a8c37cc3a056d1c94efe66793b6b8088a58830765ac8797a3379657c8d87b4f6
SSDEEP 192:ufLsN/JRQTt/d0+YLeGlFQmiU10vH4e+CGWOFmRetycJiHqZU8:IsN/JRa/yziSjMYe+CLOztuuU8
TLSH
T1C3322C31BC786C7B4EE3A644F44736139FB8516BDA853F80D5DD6E1C01DB6AC230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

348241f7-8292-44d8-86f3-e9276e8b1702.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\348241f7-8292-44d8-86f3-e9276e8b1702.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 15bffc4f296590dc1c3d482d4b7897db32443f9fe584c3d9287b1cfea7ddc6f1
MD5 9c1e36335a7c5de788e0a925cf5b4b5d
SHA1 47d5c78d6e2b4c1259ea5a30949cddc8263391e7
SHA512 2d77066c899093b1c17c41599e5f1f38bb9e57661b75f63951154588aa6a0124b0dccc7075c508d242dec451f2833d4e23cff192415c482f97e735f4a052e76a
TLSH
T110411458AAF90158B3B76E5A9BF268AD447F7C772F07D49E10110E8E0763A00D4B1737
MD5 SHA1 SHA512 TLSH

Submit Download