be8b2730eff153acec15217c325201d680662d7abf030abf824425f2c69f21b9

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
readme.html
Size 135KB
Sample260930-clq4aat19j
SHA256 be8b2730eff153acec15217c325201d680662d7abf030abf824425f2c69f21b9
MD5 92698dcf794378ba3061e4e2dfce0a6d
SHA1 b046befa9fec12f7dc8f68ae3a117894f082fb1a
SHA512 1ff91b9ebc8d666a35ce0f2bdc5d467284cb461f46238889144cef0fa42ff9b85dcc359d6d8bbade39e619422909d6e3725175b1dd1a02a3f2e97b7357fcc807
SSDEEP 3072:kDfP/GUUrOucJDK7C5b/RV/7njs32Jpz4vDEEJBJcy91sBbhKYIEoV:ykOHDK7CR/kbQYAM1sB1UEoV
TLSH
T138D3F1F3114EA8DF33221D1BEC193B04AC5578BF6B82C2469DAD588734EB150CE699E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2292	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{1D34C748-7C29-40FB-89CB-A7940EA2FF43}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4972	4700	msedge.exe	88
PID 4700 wrote to memory of 2292	4700	msedge.exe	89
PID 4700 wrote to memory of 1680	4700	msedge.exe	90
PID 4700 wrote to memory of 1680	4700	msedge.exe	90
PID 4700 wrote to memory of 1680	4700	msedge.exe	90
PID 4700 wrote to memory of 2404	4700	msedge.exe	91
PID 4700 wrote to memory of 2404	4700	msedge.exe	91
PID 4700 wrote to memory of 4356	4700	msedge.exe	93
PID 4700 wrote to memory of 1060	4700	msedge.exe	94
PID 4700 wrote to memory of 4356	4700	msedge.exe	93
PID 4700 wrote to memory of 4356	4700	msedge.exe	93
PID 4700 wrote to memory of 1060	4700	msedge.exe	94
PID 4700 wrote to memory of 1060	4700	msedge.exe	94
PID 4700 wrote to memory of 4884	4700	msedge.exe	95
PID 4700 wrote to memory of 3904	4700	msedge.exe	96
PID 4700 wrote to memory of 4884	4700	msedge.exe	95
PID 4700 wrote to memory of 4884	4700	msedge.exe	95
PID 4700 wrote to memory of 3904	4700	msedge.exe	96
PID 4700 wrote to memory of 3904	4700	msedge.exe	96
PID 4700 wrote to memory of 4908	4700	msedge.exe	101
PID 4700 wrote to memory of 1320	4700	msedge.exe	102
PID 4700 wrote to memory of 4908	4700	msedge.exe	101
PID 4700 wrote to memory of 1320	4700	msedge.exe	102
PID 4700 wrote to memory of 4268	4700	msedge.exe	105
PID 4700 wrote to memory of 880	4700	msedge.exe	119
PID 4700 wrote to memory of 2948	4700	msedge.exe	120
PID 4700 wrote to memory of 2744	4700	msedge.exe	121
PID 4700 wrote to memory of 8	4700	msedge.exe	124
PID 4700 wrote to memory of 8	4700	msedge.exe	124
PID 4700 wrote to memory of 4744	4700	msedge.exe	127
PID 4700 wrote to memory of 4744	4700	msedge.exe	127
PID 4700 wrote to memory of 2680	4700	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\readme.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7ffbe237c188,0x7ffbe237c194,0x7ffbe237c1a0
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,167807711352829337,743641936619843376,524288 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,2436734307146188614,5231760810567530163,262144 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,17131139884541362718,17008747148976470676,524288 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,7130973954925086522,807542792881787537,2097152 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,3879262012736012262,11582744470597188360,2097152 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,4715728181080638475,7636840245385822010,2097152 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,5173781953591012849,5213229155928492521,2097152 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,17997079197431332802,8267771061740377343,524288 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,7163604965454186880,3594379124037437315,524288 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,3085347645481948318,15116865384168281609,524288 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,3085347645481948318,15116865384168281609,524288 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,7320363182436648730,8229433590415116030,524288 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,11858859468648729959,12511299822494510674,524288 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,6780825001328898,18245794159650427962,524288 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,10592234124191454229,11062962662939896513,524288 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,16638861297045921694,17017080395811283522,524288 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6080,i,9585757062751483917,12061453681365573681,262144 --field-trial-handle=2052,i,14668286105005540701,15058718821357276677,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a2cdd1b5f0eef5626af9ae595a01b721ac054ced178f5b4de00f2484ad391315
MD5 3b0aecdf7bb860654e8c73c216b156f4
SHA1 0f6e9db2de70b7e541495c7155c043c22799a61b
SHA512 3dae0d2bdcb49fe361c1cad311f6d202a6ae2c3f69a5058eaac5e2a9400d2b4432684d72ef39499c518308da6b8ceb45c8efaa36dcac02a69ac3f952c0d0f9c4
TLSH
T1B461A4B126930490FBABDA7790D405A73673A3BD44E36F460BE8D3BB874B7F4A054009
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593743.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593743.TMP
Size 3KB
SHA256 0904aa39679074fe44f6d0c7f76da709a10a90f6c69a67d9bd068a7d41618fdf
MD5 5cddd5dbe5c35cf0a051e6afe10a43b4
SHA1 afcbbed500c8902a434867b4ee83e8e3ee82d450
SHA512 fdf686c655e7f05f7ca6960bfa9601238230efc10ee784818299dda7c4202895289165643e407c7c4c40f8c14986ba33837d63ec5e637edcc0797d139063b8d4
TLSH
T1E26194B166930490FBABDA7794D401A73673A3BE44E36F460BD8D3BB874B7F4A054008
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 f53bd4d66330406fe86322d7833f07f8e1807bc4b6c0f64aced9fc6e997d4287
MD5 67ded1427d7bd4d0a47666d516e23a03
SHA1 0e2b35982fb00f0774aec2f92abc338a4f31ede5
SHA512 d8ad3d41d68e04d893ed91426259b30c172a3fbd2ae27b196619dc3038f2e6d2f71cfe1e405db7c80a198e792b7f1d52c9ffba31dbaa7e424a0c5740a96180a9
TLSH
T1711190F3C3D595AE8D051AF06A24AE2BCE1E0505421C7D19D9D4EF6BD3E3075E10299F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 dff6da8cc552971cd71d6303dca13517da344f2039bf10fd0717460954ec79af
MD5 e8605d8caf87e4654498bd832d65fc4e
SHA1 e15a9d5a771f94037e3e9d4c4b6c5d5f7f65a530
SHA512 2b836930071ce803822e3e565c3557750f739bcd1579977e0c98fabf98d61926719e644ce0b81fc366547edf4cc2d71b63bae1d3b7d36d8d4faf72e1856f02cf
SSDEEP 192:sxZsRBW1/fvsizIdpdzHW6+WNGYYBa3TIgrJ:sxZsW1/fvsisJHbGfM9
TLSH
T19822A6116E78A57B8CC7E219BB557F53E6FA503251D01E58AAFC861C04E6ADE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b49b2000fb52523b3a0b218f77dce40a9900b51418126da3dae0677282694212
MD5 f7ec7a2deb7bc1307988e620582d3701
SHA1 bd19b8fadfaab62ded93feee3b681827f822f474
SHA512 90ab2f6a904272373732bf50fda889047badd0b0b510e58ddbbf8758dc6e375c1385bade070acaad73ff6cab3a891c1be60c35114cccbe3d8bff7a1577bae2cd
SSDEEP 192:sxZsRBW1/fvswzIdpHzHW6+WNGYYBJ3TIg5BJ:sxZsW1/fvswsTHbGfpl
TLSH
T14A22C7116E78697B8CC7E21DBB557F53E6FA503251D01E48AAFC862C05E7ADE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 72f01aac0e7fc776b973fcf7b3f174a70db6454f30bb151f963d28c7e12f2745
MD5 ee03a2041e5d58f584bcf30585c30a62
SHA1 33d98f44418c36cd0a360dabcd306b130f28a359
SHA512 46bbbfb846def35c392c8948e51cae8eecfec0474e39a5e75ea59f569fba802aae7b79322fdbbba8d4ea68de25058d4d351e8354ec93c05442b503c95f031182
SSDEEP 192:sxZsRBW1/fvswzIdpdzHW6+WNGYYBS3TIg5BJ:sxZsW1/fvswsJHbGf0l
TLSH
T11C22C7116E78697B8CC7E209BB557F53E6FA503251D01E58AAFCC62C05E7ADE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 8183a74b412d1172dcaa671ce34a99cfdd2ca3345ffe1fe1cb275969ec87521d
MD5 d34545980de9c25d59bee98c573c59ac
SHA1 c3791eb5e02fbed348150ab60e6706dc41ffd3bb
SHA512 371a94c4a49eb25f9d2a3ae36346dedc422792cf86674d280255549a574bde778f342c743841ab71cc3bcce4067beb98e6cdb9e844902f7df5aa0e0c849195d6
SSDEEP 192:sxZsRBW1/fvskzIdpdzHW6+WNGYYBa3TIg5zJ:sxZsW1/fvsksJHbGfMz
TLSH
T12422B7116E78A57B8CC7D21DBB55BF53E6FA503251D01E58AAFC862C04E7ADE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 1fd63f66e4efde4665e36291eaf71fd83b7622d23abb01c9615e52ae490a1f64
MD5 f9df7ab77c403df59253a766f2724e87
SHA1 d7cc43a18cefa5a9b4ec2fa087be6b95c0a52c87
SHA512 d1a544ee2c5ad641d6c4b0876191350607d2c15c5e6dc46b829ee936f2e590d150e0e4836fdcb79f194c54637f25dc029548dfbef9670f8a5ef927cea507dfac
SSDEEP 768:T0yYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXkropY98:T0yYR7jWv3NpBu1ja/CL8OXvB
TLSH
T153C2E82F640DCB7E4FC01E9DDC5A6F9B6E9802C7A6548D4047FA984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 33e0026b59db964a805007ca6ecee059f0d64667943b38bca776c134aa952dcb
MD5 f5c4ed548d7aa65e3ee08c37b3fc00a5
SHA1 b29eff1bbd5fe5e8796949e867ad7ea04ad09ec7
SHA512 059cf5fd03cf0b30086b32d70f2f876c8095645be91057f9872399d89e12b1fbbcfab4a3d27fc8342ec9bb6e9d0d6dd99727204786e7daeba24ddaf38c4e0231
SSDEEP 48:KgMb6G02aDbqpyIS+DK9a14Dx8TYRi6AyLvSbvRxRqbpkZIS/qK9f1VqxP6Ycd9w:KEbKKcMuqMAK9Ka2YKDCuh
TLSH
T19B91F10234760240387E395D85B4976E864272637559EE3BBFFC44A64E2EE089EFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

808c1b63-6d6c-4aad-b940-1ee349be8e3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\808c1b63-6d6c-4aad-b940-1ee349be8e3d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c7ddf79bba135964a2045eb8461241e3fe7f154175cbe163e5fa2decedabef6d
MD5 684da2b96209d4c276baa8a4803cc907
SHA1 d214c1f39cc11b920414ee68d9f19913db710fa0
SHA512 f2f0516f0d996b82f00f6784dca4a3e42e75b88efef3eced864afd4c0ab77bedea34fc97b7f1952a18b92254fe1c10affa41602c65f0395b94cb4e1ad87875e1
SSDEEP 384:PZcIhsNLePiPbiQX5+Dtm8/wX88rQUVZh6DKhHBo/:HhxmhkDu7rQUfYGHBo
TLSH
T111828E329CB86C775DF7B586B04636139FB49063D3C86BC0D6ECAB1D019AAA91307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 631b522f736fa6670b3bf6cfb67b2498f879a2536228ffce2dd8455742e9d882
MD5 1b37aec7717d7a9d5031540a2a180736
SHA1 1cb01ddba5e4f8ae92b7d4214e3b5a4695f00e68
SHA512 1e85645b3fa1ccae2c061a241c4c99a6d4d93a717da6dc1923c153affcb9347ded971ef1ed6f9e0af8d3daf67af0f68ab84da9b7cc558d0842c85274a94a1ae2
SSDEEP 384:giFiZcIWTzsNV8TUNTUlIlXPiPbiQX5+Dtm8/wX88fQUVZh6DKhHBo/:7FQ8Ywg5mhkDu7fQUfYGHBo
TLSH
T165A27E339CA8DC7B9EF6AA85F44A3213DFB54063C684EA80D7DC9A1D019A5AC1307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7f185509f39e12f230c4b850263f4f6ea150fcd6ec0327148e835a9f68560ec2
MD5 956490373bc528217e6488a76bb7aa1c
SHA1 7b2bae1d7f12f8f599fa032c33755e741666118e
SHA512 aeefdb13765614eb29345593ee993cc3145e7810a53730df83c1e764f909ee0b370e7c5d5c675500ff402da631dc48ecb58d35174fcbe0cfafd0daa0e36f7392
SSDEEP 192:EON56nnHGQmiUydbQYcX5hQDP16jzor/eMcYYU6:EON56nCaQNX5+Dtm8/OZU6
TLSH
T1CD02EC35FCB87CBB8EF36D55B48636139FA5213BE5946B80DAE85A1C00D765C2306D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 34530d180cb7fab7c83a15cf0b0bf9ce07b75eb608d5b1facce7d6f42f73a5b6
MD5 2b24ae00da4f1f2a3b5f6b5f18c9771a
SHA1 45a469f43715225361d4292762fbcf31c929acbb
SHA512 a35f2fbe7e5a9999917f2b47adf45a030a6267667822eccee4687ed7f22383561d46f5333deca3eb1fdb020c7934826cf225421dcf1ba0eb8832fa425ce39205
SSDEEP 192:EONG6nnHsQmiUyLb+YcX5hQDP16jzor/wX4FfENg3zq5UU6:EONG6nci+NX5+Dtm8/wX88SQUU6
TLSH
T14312FC35E8B8BC675EE26595B08731139FA55127DB887FC0D6EC1A2C01DEAAC534AC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cbd039b4575956cae540f190d3a4af82cb0c125ae8b0e24b5c564501164e1a4a
MD5 e9601f5581a36249406f5d5587e102de
SHA1 0a43f2e4481e95e1263ef99bf0ffe05002182e5d
SHA512 c38ae5990a9a96d5119dbc839ec8c981cffc9b94b7bd9afada8070792274eedc48d76f7dd7940f2ff4a3dadd5ae377c29a79b4b2f956543e0211c2e04b82c46e
SSDEEP 384:9ZcIhsNLXPiPbiQX5+Dtm8/wX88rQUVZh6DKhHBo/:lhymhkDu7rQUfYGHBo
TLSH
T198828E329CB86C775DF6B586B04636139FB49063D3C86FC0D6ECAB1D019AAA91307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba36545b-8240-430a-a9cf-102fdae4e512.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ba36545b-8240-430a-a9cf-102fdae4e512.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cdbea62abfde830e401faa280cd238879ff34395d954b1ba5ef5f867b438b7ba
MD5 d3184e64bb033ff1c24d8fb0771ac95a
SHA1 fc0f7a0396e52579f67fc0c79c9d3c4909454f42
SHA512 e558bcca4263640b2c86c6d6080627f590e72fc752e9efd8921aaffc11867e75219e34745b1622746c1fd3bab65478bd15e3e5c99903990b13a7d772f5d3d678
TLSH
T15C411588B6E91148B3B76F5BABF6A96D447FB8772E4AD1AD10010D4E0A32F40C871737
MD5 SHA1 SHA512 TLSH

Submit Download