29b31e024477170e1f76ab145eb7a9bcd919389f5438db8a171bc9f55154878b

Analysis

geolocation tags

asiadelhiinindia
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-de
resource tags

arch:x64arch:x86image:win10v2004-20260911-delocale:de-deos:windows10-2004-x64systemwindows
submitted
25/09/2026, 19:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/app/index.html
Size 27KB
Sample260925-yft4msysdv
SHA256 29b31e024477170e1f76ab145eb7a9bcd919389f5438db8a171bc9f55154878b
MD5 5ad4f3206b65b951bc79e710f4eeb3f8
SHA1 2a5b2ffb50e02adca04949199a10ec101eafe866
SHA512 ad6c0b47c7b407305859ccb45bff14d734ab4aedf08bbde9361cb1a32cb9b8a617b2c90723d669fc7c8f8a297e7c861d9d2abc4cbaad16807bd7d761d34cad24
SSDEEP 384:vN7Y6FCs5XRJ/seq06IfLglbyMaAt1vnEF+ggevsu5SwU:z5XX/seq06IfLglbyMai5nw0u0wU
TLSH
T132C2A611DA36202DB137462A75E2BA5D3034C117E5639A7EFA5C9674CBCB18B1F23B8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2308	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{3C1D2FF1-21C9-40DF-AD2E-8BBFE0842A2D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2716	2012	msedge.exe	88
PID 2012 wrote to memory of 2440	2012	msedge.exe	90
PID 2012 wrote to memory of 2308	2012	msedge.exe	91
PID 2012 wrote to memory of 2440	2012	msedge.exe	90
PID 2012 wrote to memory of 2440	2012	msedge.exe	90
PID 2012 wrote to memory of 2768	2012	msedge.exe	92
PID 2012 wrote to memory of 2768	2012	msedge.exe	92
PID 2012 wrote to memory of 4752	2012	msedge.exe	93
PID 2012 wrote to memory of 4752	2012	msedge.exe	93
PID 2012 wrote to memory of 4752	2012	msedge.exe	93
PID 2012 wrote to memory of 1196	2012	msedge.exe	94
PID 2012 wrote to memory of 1196	2012	msedge.exe	94
PID 2012 wrote to memory of 1196	2012	msedge.exe	94
PID 2012 wrote to memory of 836	2012	msedge.exe	96
PID 2012 wrote to memory of 1656	2012	msedge.exe	97
PID 2012 wrote to memory of 836	2012	msedge.exe	96
PID 2012 wrote to memory of 836	2012	msedge.exe	96
PID 2012 wrote to memory of 1656	2012	msedge.exe	97
PID 2012 wrote to memory of 1656	2012	msedge.exe	97
PID 2012 wrote to memory of 1412	2012	msedge.exe	101
PID 2012 wrote to memory of 4924	2012	msedge.exe	102
PID 2012 wrote to memory of 1412	2012	msedge.exe	101
PID 2012 wrote to memory of 4924	2012	msedge.exe	102
PID 2012 wrote to memory of 4968	2012	msedge.exe	104
PID 2012 wrote to memory of 1668	2012	msedge.exe	119
PID 2012 wrote to memory of 2216	2012	msedge.exe	120
PID 2012 wrote to memory of 1636	2012	msedge.exe	121
PID 2012 wrote to memory of 1528	2012	msedge.exe	122
PID 2012 wrote to memory of 1528	2012	msedge.exe	122
PID 2012 wrote to memory of 2076	2012	msedge.exe	125
PID 2012 wrote to memory of 2076	2012	msedge.exe	125
PID 2012 wrote to memory of 4956	2012	msedge.exe	127
PID 2012 wrote to memory of 4956	2012	msedge.exe	127
PID 2012 wrote to memory of 4248	2012	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff8976ec188,0x7ff8976ec194,0x7ff8976ec1a0
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,12306585399493385178,10853611809849674595,262144 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,2919291985940462215,501442918871905444,524288 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,17493923904125807455,6456580654318033349,524288 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,10606589703940783371,9633859014990212884,2097152 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,1452029354334850969,10414059217175767806,2097152 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,6576240817304103321,6563246048287717784,2097152 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,15135222328623471019,10704593482032047586,2097152 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,15438239381674894013,12033896041926459679,524288 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,2766605105163226350,14649747640506787472,524288 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,9803240281201573144,17193135511366164386,524288 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,9803240281201573144,17193135511366164386,524288 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,15955277321766386275,8358082661640750543,524288 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,11895246357267762195,18034215178586552165,524288 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,5098504535288287649,16232755593401622588,524288 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2912,i,12153154655064105114,13891472146222865509,524288 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,9553604379510739289,9683130612496141760,524288 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,7056779593176618022,16368830325195917944,524288 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6420,i,11517579085475548238,17591555216604477113,262144 --field-trial-handle=2256,i,16122061247054159870,5196811641132363512,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 12ff8cb2e02ef8deecad4af226b47df54535f292e90a8dc14f0ca7f84073e8cc
MD5 8798d2020ac595d4422b24df86aebd9c
SHA1 1c4bf845cc662f0436dfcbf8093370f369309c17
SHA512 7d4b31e18f4a9371029324c5226eecd73c2aa27af8656b00513a4451acf74f49a7ac80dc6f784b58baa46b1fb8dd8e041df14c9634bfdd1c97f53e7c986a50b3
TLSH
T1C1E020FE45CFC22D52107487857CB74C8181370B92CC6A072704894CB443080A7D5561
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b8f51dd6a39c3a2a03b0a6a106179a2fc82cb2106a50c63a2098c0185a73497d
MD5 83eb757999191f7c5751fa7cb011d90f
SHA1 2aa5650159798968e0eee48fe0742d4eca865202
SHA512 a99625e44419c1ab2c86e294709c172c4376be980cf90cd81bbdb56801d8037f32423915ae14b7ba9760daef060de1f19eb659e05e5b672a26e7f7d5371a6e2b
TLSH
T1CB612B7705A40041EF9888B986F512873679F9B866E63DF2D2E4FC75CB83795490E7C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594a7c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594a7c.TMP
Size 3KB
SHA256 3fddf42df3d5cb789519ef137285a477b735113fae545a4526f27a7aa6b98823
MD5 ff8e33224e0a446447519040b88e475d
SHA1 43e28876be5756ff6e15543af222cfac1ab662a3
SHA512 75625f66be4928dcd85528549c3ddc9ef7d650799f6eccb2c8bbd3bb55fb70f59377c5d15213893a3cc334711b159ee60847a70dbd866e87cdb0afe573df5fd9
TLSH
T1E9612B7705A40041DF9888B98AF512873679F9B866E63DF2D2E8FC75CB83795490E7C0
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 829B
SHA256 b547804fef19a035d54ae70b97c9061e062492da0c8a6d146ee295356eed764c
MD5 4d1411e20c066813ba1e2b689c0fc366
SHA1 305a3e6e476dda19c5b1ead97f7d0a464d65494e
SHA512 bca10206300159aab04ce2e407348abf3e876558819c23e75320cf65d49bd0249129554a5162242b1dd7ca3647f02de81012b704b3ea09e5a6ec33425cec66e4
TLSH
T1A8018EBB83E4567E8A0152F05A24AE1BCE2D0557431C3C5689E4AE1F93F2574E1009DF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 5c3e1cffc28faa8d9d5370f70a4ddf1417bc71a71717ba629cfd7f277d30d11d
MD5 5bf8dcd1f720681b288a79952c5d1698
SHA1 4687991477df5c2e814b8903ae5bd1f52e770efe
SHA512 a1b5e52352ee174bf038fd26aa96f41f5d535ae816a0e4b8057c74ce2248b4f60ad41cb9769c835ba889461641708237c7f05fb52eac86a8da8632d7665c84a7
SSDEEP 192:sxZvLWP/f8sDoIupdWHW6+WNGY3Ryr6EIgrJ:sxZvqP/f8sDgMHbGN9
TLSH
T14112B7166E28A57B8CCBE21DBB257F53E6F9503261D41E58AAFC861C04E66CD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bcea387dcb644f1fa941d90c3d1031fffa638a92f7162fc2b3f88988352cb351
MD5 ebbcbdd032de3c6230e25781610e92a4
SHA1 f26371dc90c0ecc4005d5fc94defbff10d8ab81f
SHA512 e59e727a1d1524436a6cd6c4345d2d6b8fce7c93ba87ebbde79327a8798ffbc9ff7a57a4e4b500ee72a75ef1f04ec6b3c53a70baefc824f54e28f0bfa5b3d3a5
SSDEEP 192:sxZvLWP/f8sMoIupHWHW6+WNGY38yr6EIg5vJ:sxZvqP/f8sMg2HbGGT
TLSH
T1D522C81A6E28A97B8CCBE21DBB157F53E6F9503260901E58AAFCC61C05E76CD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 2be8c91b5dba1e136aeb8607a6f2f38c74a21e75e74f26ee68732a234c3076f3
MD5 4178e8b19fa301f3643663107352dc05
SHA1 283c485329f8ed0da8d5443457dc6ab590ed5b70
SHA512 d8b7e285ddfc61134c27dad66dcc99f29d946212fccef65decf0f72824a0ecf9941a6cba8c915f1fdb2eb4e104792ee65b098297d929ba81dbdca5bd2c2173fb
SSDEEP 192:sxZvLWP/f8sQoIupdWHW6+WNGY3Ryr6EIg5FJ:sxZvqP/f8sQgMHbGNd
TLSH
T1FC12C8166E28A57B8CCBE31DBB257F53E6F9503261D41E58EAFC861C04E66CD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 0826a829d22fe103b1cc607bf201b365b2b7b4790b46542b59602bf72085b567
MD5 1741ac41ab10cd92b83ab1b330c4d916
SHA1 54fed34394193f214a6edb70cdeea43d856d38a2
SHA512 c9f8ccb7682f48926deaf485f49f15c334604951a8bb9d84bfffa2886ef84af8c2c5a8e20a80cf09591142feeac86c09421f9a9bca2fea3b4d7188a6a6345a70
SSDEEP 192:sxZvLWP/f8sMoIupdWHW6+WNGY3Dyr6EIg5vJ:sxZvqP/f8sMgMHbGJT
TLSH
T19622C81A6E28A97B8CCBE21DBB157F53E6F9503260911E58AAFCC61C05E76CD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ce617f9cdc3bc018b363153fc920cbed5f13a4852e4addd741d928e6e48e9e08
MD5 53225b413c091f2c92b2470979b766e1
SHA1 17751b63b4d1332d0367545338e81fac759414e2
SHA512 bcb61e19a1c9de8426174770f82b2b72371a8f15207acf72e96e6e8bb2a78d50e5d0a1bd435d4cf84cfb9b86ef88c3dd89aef9735a0173b4e30570f6893ed7c4
SSDEEP 768:TT30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72YrolZMM:TT30AbSWvS2l9u1jaLmLZ12jL
TLSH
T153C2DA3B644CCB7E4FC01A9DDC6AAF9B6E9C02C796648D4047FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

251b3010-d776-4285-9333-8ca0482cc867.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\251b3010-d776-4285-9333-8ca0482cc867.tmp
Size 22KB
SHA256 e482e0287f5d53c3ba44f707953029fd78a279155339825c80835c329a77ac98
MD5 c349164cd27e763456564bba6d4ced8d
SHA1 081af2cb261854522b6712ab8e0340eaeb01ea0b
SHA512 a24eeaabe2490e290180b02f40b4ca6138c60b7e8916b334f2ad0cb5fe1483bb97cfa581edb09860dbd044810cd390d855aa365138be3d96ad8dc1773ca37f7a
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uj:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAe
TLSH
T1B3A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d02b61baccce8069f6fd4b9109318ac3910fe7529ea7f32ebf9c918e861b932e
MD5 01a38ff09de4376de2bda2f319198eef
SHA1 cc69dc973fe918b2f7337b4d824a4239bccfdb39
SHA512 68c1565002bd9821bfd1a75e4d50fe516f21465eea209836cf1183daba54981513053ec19db4ed723b059d4f82308b3cdd2452536a11475c1f88f53970555d55
SSDEEP 384:3ZcIhsNdjxhvpus6JW9iX5Fp8gXzD1NzujJ6c74HT:/hsiJCaRzDmjJ6c74HT
TLSH
T12D827D3A6878A83B59E2F605F48E36139EFD4027E7C82F44DAFC971E05D97A81316C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2766e9af0777d28ca1c94a029a965f45fdeee782346965b2550fc26e5f8c642a
MD5 e30fc281d95eba605c55c6312c34ca20
SHA1 ef168d6ae49a50e960b335a95371854079f52764
SHA512 6d35d0a87095c26f7675a5ae1ef943a14f83976abe9cc3bf642b583da5fda1c839ebe84de4e7446ca0e6e6b7bfdde0302e803c0cfab70a4d2335ddff2e5ac17e
SSDEEP 384:FNFiZcIazsNn8TUNTUlIlixhvpus6JW9iX5Fp8gXgD1NzujJ6c74HT:rFQy6wgaiJCaRgDmjJ6c74HT
TLSH
T101A27D3758A8983F6DB2BB45F94E36039EF94063D6C46F54EBEC9B1E00D629C0306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 14ed97fdcb89d3abe8b109b88b4c8903b3888c64872453f11fc90d042793874e
MD5 502240416c35e50b22a225a6c83000e2
SHA1 3cec2f0fed9a6d120df4461f3aa6240dfa7896e1
SHA512 f9efec2de5f5ffcb0035afe41e44276be5df485b84c6388905900a3f6747c117d7fff386380d747ebd5de9280bf3111b154ff92bf6ab6a5c82043c5d799c2b48
SSDEEP 192:LONq6AmwprQmiUyNf6siX5F1jzor64JiMAU6:LONq6ipd+6siX5Fp8KJU6
TLSH
T11F02DA35AC786C7F9AF2AE05B4873713AF99116BEA952F44CAE81B2D01D765C1306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 feaddefa08c60d00dc3b0fce1318c8095be702afcb9131ddd9800074eaa5eb61
MD5 b95c63a3c553a5e677529c8424e30f4e
SHA1 86fc8d31161701d813999c5fe9bba91f61dd538a
SHA512 527c24d64c33f55414bb9f4391a9f3c31aed2dafef7c2e9b583f9aeaa2d27b095e9eafc4f19438c7946d307cd62836e4eedfa529699b6b3fda1c7c9f64c7983f
SSDEEP 384:+ZcIhsNdixhvpus6JW9iX5Fp8gXzD1NzujJ6c74HT:8hxiJCaRzDmjJ6c74HT
TLSH
T1EA827D3A6878683B59E2F605F48E36139EFD4027E7C82F44DAFC971E05D97981316C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 24520d2358713bc76372650690c162f62b189b1035b9001f28944686dce899ee
MD5 42e56046ef6e3249aca4b2a84f73d5c0
SHA1 a67b2775f4d82e530f64c41f97e16bfa7f333435
SHA512 89f21962686d328aeeed058f6b32fc6e5ad85c91ccf73600c722e10d3ac33b3270066c7934114eff1d132d24931879e3d299aa3ed246473856b75ccd72efc85d
SSDEEP 192:LONA6AmwpCQmiUyq1fCsiX5F1jzor6BXKlRS/sU6:LONA6ip+vFCsiX5Fp8gXYDU6
TLSH
T19B121B36B8786C2F5DE2B555F08B36139FA94127EB887F54DAEC172C01DF65C530A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eef7cd2e-6b2a-4c85-b364-c30577e053a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eef7cd2e-6b2a-4c85-b364-c30577e053a9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f0401410fd727e3c91d10141c4df28e2b55407c3cf46cebc6660caf7a532bd4e
MD5 2fa6a28cca612510360b9b7270ba198b
SHA1 edad0212c6492f33f4761f6af9676f289eb3fb04
SHA512 56480e00b29d38f797c8b124eff2a00157a92c9956bd91e345798c6a60bffa8d7ca1c4cdfdfef264b0b523619931e2829b277d3b59d7e93400c380bf33bfb32a
TLSH
T1A541F458AAE91148F3B7BF169FF6A96E487ABD772E0AD49D00510D4F0623A40D862733
MD5 SHA1 SHA512 TLSH

Submit Download