a8d5afc3d1d71c4035774c2155da89ecdc725145a36b218de82d44170c7baf28

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
helpdesk.html
Size 254B
Sample260916-pp85gsvs2p
SHA256 a8d5afc3d1d71c4035774c2155da89ecdc725145a36b218de82d44170c7baf28
MD5 f55f9649d58345d3fbbe4baf0d32f1bd
SHA1 f2981e44eeaca1674bb961026dac92f7043c00f7
SHA512 3dd820ea96a8b606cbc643ff61752e383dde015738867b01015ac67480a5a6398acb2469f2de3b2ebc749f13838bcb009e5bb0d744e31da1fe868f5b357bb474
TLSH
T199D0974F9CA2C00081B000064DE3FB2438C77AE75280C88876CCE022AF4479ACE074D8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
860	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340354919393174"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{D7E82477-A0A3-4524-9695-F748D95E9747}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 4480	2208	msedge.exe	84
PID 2208 wrote to memory of 860	2208	msedge.exe	86
PID 2208 wrote to memory of 1564	2208	msedge.exe	87
PID 2208 wrote to memory of 1896	2208	msedge.exe	88
PID 2208 wrote to memory of 1564	2208	msedge.exe	87
PID 2208 wrote to memory of 1564	2208	msedge.exe	87
PID 2208 wrote to memory of 1896	2208	msedge.exe	88
PID 2208 wrote to memory of 4332	2208	msedge.exe	89
PID 2208 wrote to memory of 4492	2208	msedge.exe	90
PID 2208 wrote to memory of 4332	2208	msedge.exe	89
PID 2208 wrote to memory of 4332	2208	msedge.exe	89
PID 2208 wrote to memory of 4492	2208	msedge.exe	90
PID 2208 wrote to memory of 4492	2208	msedge.exe	90
PID 2208 wrote to memory of 1656	2208	msedge.exe	92
PID 2208 wrote to memory of 3860	2208	msedge.exe	93
PID 2208 wrote to memory of 1656	2208	msedge.exe	92
PID 2208 wrote to memory of 1656	2208	msedge.exe	92
PID 2208 wrote to memory of 3860	2208	msedge.exe	93
PID 2208 wrote to memory of 3860	2208	msedge.exe	93
PID 2208 wrote to memory of 2180	2208	msedge.exe	94
PID 2208 wrote to memory of 2180	2208	msedge.exe	94
PID 2208 wrote to memory of 2180	2208	msedge.exe	94
PID 2208 wrote to memory of 1120	2208	msedge.exe	99
PID 2208 wrote to memory of 1120	2208	msedge.exe	99
PID 2208 wrote to memory of 416	2208	msedge.exe	98
PID 2208 wrote to memory of 416	2208	msedge.exe	98
PID 2208 wrote to memory of 4284	2208	msedge.exe	102
PID 2208 wrote to memory of 5116	2208	msedge.exe	107
PID 2208 wrote to memory of 4624	2208	msedge.exe	108
PID 2208 wrote to memory of 1440	2208	msedge.exe	109
PID 2208 wrote to memory of 4692	2208	msedge.exe	111
PID 2208 wrote to memory of 4692	2208	msedge.exe	111
PID 2208 wrote to memory of 4652	2208	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\helpdesk.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7fff704bc188,0x7fff704bc194,0x7fff704bc1a0
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,4292974217132682216,1073811278088416396,524288 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - System Time Discovery
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,15385229465084798493,1709591283812818808,262144 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,15706646265197836648,16038389160006286439,524288 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,4284502415545956593,7398740640340009227,2097152 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,15769963049378208613,6768513203638922796,2097152 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,13539008324796242286,7376964437165681762,2097152 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,13083659045182512004,7136807800708877389,2097152 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3712,i,14323295393337103523,9251226698338327906,2097152 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,9920697314106171569,15668844550551595883,524288 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,14632117603073118911,4559472858439022550,524288 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,18368930397070930745,14586487334993370277,524288 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,18368930397070930745,14586487334993370277,524288 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,12920405494045886910,12593580845489193650,524288 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,5458352488045432828,18342774536299563507,524288 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,11544480133340695928,6161269229452902475,524288 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1048,i,2983972790114297076,14004495504498011556,524288 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,7384931397730098472,12716141472616554649,262144 --field-trial-handle=2480,i,12212589480809982702,3744586872344194503,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 91dda147afae786465ada161c6d78c231738795d9f6537cd80304112b20ad95c
MD5 790c11205ae4b7411674b0c11af64bc3
SHA1 91541bf8a93f8225446a57a6d7df186f87a73836
SHA512 072f62afafbb2fa0c56ce587694196bbebd921c1d263c765f812f24c13abb7008ee2668977b0e2d9cc03446bc7498a7c171b9d212dbc76fe7ed304d039664c30
TLSH
T18E615FC162B0486DFB69E37286FA1067B5349C728EE3ED72E454F8F95C0632071648BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593aae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593aae.TMP
Size 3KB
SHA256 2e41aa5326273edf625fe5d6b35a7e3e9081e2082c61b52340fb133b26f889c8
MD5 d58393d71568e7c79cf6e0cea08e2ef1
SHA1 572a10f248943b7d868c8c12849c68214400c17d
SHA512 1846e1b3a7dcdc178450f9ce00e8ef807bda760d22591cb80a27196443ad71884d1244906d117350681cd06a89fadcbbca6d726158f52532037dba03451dcebb
TLSH
T1CF6150C152B0486DFB68E37286FA10A7B5348C728EE3ED72E454F8F95C0632071648BE
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 ee7fcdc4f55d24a30777e4ee019104aaaee27068593cb3f2bb28d17a5d5e8b03
MD5 dfc7446e84f72d0df638e6a4e4aaa079
SHA1 799a85ba525e1ab044e704d5d1a555fdfc46d24b
SHA512 0ecc2506ec076b3e11396b6ec8fd1965218ffc84a5a787a0ba0915473a79a40bed3d7e206bc74da7b6336a84cb3a2c34bb83bd1999ea33f2ce6a33b4061b0c76
TLSH
T10B117DB3C3D5956ECD0116F05A28AE2BCE2D0506421C7C1A85D4EF2BD3E3075D10256F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 1f2d8d269368c5e62fcacc6c3e86e1b86f525b1c0c727605cc7717bd58e57019
MD5 3a9c10a65905144d505f31535695fcb6
SHA1 22873bb0b7fa5dbcb249558337bb37ec7ff25dad
SHA512 7ae601765c952f4c37181b25c1cd25df2ccba1f0248a751b3a53d305745635e62ae45fc229b7ae938e9135ec428b33c1c426967fefac19679f18c0adbd3e8fdf
SSDEEP 192:sxZoRJWB/fmsOOsIdpd/HW6+WNGYrb8cIgrJ:sxZo6B/fmsOO1FHbGO9
TLSH
T19512B7566E28B53B8CCBD20DBB25BF53E6F9503255D41E48AAFC861C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 082ccc0386d04643942435c8ed54dd13c26608dab0770fd60e715f2f6542f989
MD5 66ef29ccc6fa70abb19a7c392ea3cd94
SHA1 588b46911191a86520bfe218e3d940d3faf2a647
SHA512 109b809c3d9c096fcdf141522a6f7863ea1892bbd69d800bfbc0dacb6382c6be23c41d4b1711abb67dd3fcff1f4093e79f2652473d11fa383836b924cd681868
SSDEEP 192:sxZoRJWB/fms4OsIdpd/HW6+WNGYrb8cIg5qJ:sxZo6B/fms4O1FHbGOY
TLSH
T15C22C7566E28B57B8CCBD20DBB25BF53E6F9503255D41E48AAFC861C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9bcd13162539c65bb230877a8894cea7773bd596cc17fce0cf6e5670d5fb277f
MD5 4c6ee5792be7d41642f3d73983069f4c
SHA1 1d12b5934f148d321b0b2660aaa33fcc763c8786
SHA512 00343b5a5aadbe16442d25bebd33ba3262de8e9fb2ea1e52120ac356705189eea7e9875b205552730aec22097c618a2b1123597308b4f1216e00660e04ce7aba
SSDEEP 192:sxZoRJWB/fms4XsIdpH/HW6+WNGYrXyk8cIg5AJ:sxZo6B/fms4X1fHbG0ycC
TLSH
T1DA22D9566E28B93B8CCBE20DBB25BF53E6F9503255941E48A6FC861C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2333a45056ce75f792dd1149aff13b81ac0a6da9bbec5d2bb6de55a6df27c239
MD5 4d3d3d7f31af87a233419c7bf08aa546
SHA1 530d1c7eacdabd46df2328538c9005bc81cceec6
SHA512 f9643d198935a3440c6376fc1fea8bef8da158bb687e8d06ba90cd36a6cf33aae4ec3e0361313d5946772175744ac7636d4367ddfba5c9e0e359cd33d72acfac
SSDEEP 192:sxZoRJWB/fms4XsIdpd/HW6+WNGYrWX8cIg5AJ:sxZo6B/fms4X1FHbG1hC
TLSH
T19222D9556E28B93B8CCBE20DBB25BF53E6F9503255941E48A6FC861C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8d68e374631cb8843155baed4c2d0c9ab740339b9223ffc90a23129569127eb7
MD5 63335117c2b43e5fc19a6797671c4db3
SHA1 88efa9e446209547a4455c388dd71a5383d23684
SHA512 5ad3022fdefd6620b1f8b2fc18c83faeafd55c04c877c24bb43086b6f4b8aab9649f1b2924f09de99e650f315bbfbd561414346713bb30fe6f14dc8368e291b2
SSDEEP 768:E5y4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbzroRR3:E5y4J/DWvbtBhu1jajiLm0bA/3
TLSH
T183C2FA3B784CCA7E4FC00A9DDD5E6F973E9802C79A948D4047FA994C02C77EA91264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59d6de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59d6de.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 253003e261b04b32ceb11b917a529fc78212232918571536e23f73c3dcfbd192
MD5 e1eda4de42266c90c9de979d726c3ef4
SHA1 6104a24248b7a63b8388291467114a64f22420e8
SHA512 cc9d8cf6c7135a10cf98896b29f52e9630066581c5e0223391060924598f959fda0983ab7f8d4705875e24f9a089b984f7362cdb40e758c9e173d1f7a9e998ab
SSDEEP 384:qZcIssNZVHR2qJZTpcuHX58EA8xJjX/Usa+VYcd7U7ok:Ise2qJjBaq/UhgHqn
TLSH
T105827D366978BC7A58F79285F58736139FF8906797C86B50C6EC5F1D00DE2A9030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e35b7b1d957eec19fcb9b09901f942b63839042ec638103d828fc72d7f0c425
MD5 7402c9c151ed850106f6cd19a18bff4e
SHA1 7f26f3bced26b1ec360930522ea4a33e0cf7f4b7
SHA512 4db9a766251dc88010728e5ce1638430ccc2205ce797773f042dd50609777855eb9bfec214ce1c2d7ac41a89856265b3c8cc3283b6c6206a6b8fcb406e6a8ada
SSDEEP 192:1ONT6wlDgQmiUyfJW4X58gZYjzorxJiDlL5U6:1ONT6kgqW4X58EA8xJi1U6
TLSH
T1CD020938F9787C7B9EF3AE09F58A26139FE5116BEA552F40C6E81B1D00D765C1306923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 f41e7cf5c2b956c1b9765c7f0882d5bf887ff65a752cddee24b6791bb5707b35
MD5 282d641fd68cf04b063dfd46a39aeabf
SHA1 fbeef1ce427954eb6f4f11e8ae16dfdfed5007bf
SHA512 1f894454a5dc0ab2da40ec9243de6e7ffe519752ac346cf3fdebcb3f72c875cc4b7f7a98a511a7a80a12317907c0492c2c5f16d018bc5f9118ac3ce067424a13
SSDEEP 384:TiFiZcIsWsN78TUNTUlIlYHR2qJZ0pcuHX58EA8xJjXsUsa+VYcd7U7ok:+FQVmwgo2qJ8BaqsUhgHqn
TLSH
T120A25D3369A8AD7BADF79685F9463613CFF44067D6C9AA50D3D85F1D00DA1A8030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5d0f8948835480c6f936bf5470d3fe3d3b287c56f1426060aa1a28de55f71a4f
MD5 0e0efbd2b57228c0385718829c077677
SHA1 21f6ff60f8e07511fc3fa6df35e21847d5648a88
SHA512 370a21c1f4f8813ebca0fe8de74f7d36a416433bdbe125556702b67496fd6b9c2bd341ca1c17f925d424cd2c6151f9888682a7b92b7c1c11428a6107eee18e97
SSDEEP 384:RZcIssNZYHR2qJZ0pcuHX58EA8xJjX/Usa+VYcd7U7ok:5sB2qJ8Baq/UhgHqn
TLSH
T15F827D316978BC7A58F7A285F58636139FF48067A7C86B50C6EC5F1D00DA6A9030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 580ce3d3d4d132d579c3b4bee64492dfb96c4cc5844bba0aa1ae08a46bbb08ca
MD5 bd42cf06a2fba1385eb5ef77c7b1c11d
SHA1 5ecb5b35d1b63ea8f4f8ef6999409718e22d5da4
SHA512 b288ca97f3bacefc5fe5bbba8fb4a9db844a6f1805a5dc0775c9892ac99bc5ff4fb7b3141e30b956beee04fdc0c5a6a6f24a4845c92f0a78973f6cfb16b3805f
SSDEEP 192:1ONk6wlDYQmiUynJmW4X58gZYjzorxJjXSver/IU6:1ONk6k4wn4X58EA8xJjX1UU6
TLSH
T1AA120735B968BC2B5DE3A445B08735139FA54127EB896F90C6EC1B2D01DF26C534ED23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

693db2c7-db96-4144-9076-4ef6129a5873.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\693db2c7-db96-4144-9076-4ef6129a5873.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 10ce49d3c69d63989a80c37a5b31f271aed1a033ef070fd479be62e67f29230b
MD5 c4a48e9be596fded588b862e7df59c59
SHA1 6be1a81563722922710a65428e0f9b13dc616cfb
SHA512 aa8192027ada4c8e400bd7d3115cd614e72e3dfe7d42a823382861da3a2e69506fabf02ae0eeaefc483c65bd51df4e168c14651c15c34ffb2a17494c9004d225
TLSH
T17F410758B6FE1148B3B76F569FF2A86D487AB8772E0AD55D00110E4E0B22B40CCB2733
MD5 SHA1 SHA512 TLSH

Submit Download