hxxps://click[.]communication[.]kedge[.]edu/?qs=ABB7InYiOjEsImQiOjQ5MzB9ADIAAAAAAQflzC3pg0Es-bs9RlRg0RAo0uBtHL0o0w36dzg-8oNgP2I2GydwtzZfZNUSTSYCO753ezVr4aORfSlg0dmhwVVGMzAdK6NJrpE8N6ga

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://click.communication.kedge.edu/?qs=ABB7InYiOjEsImQiOjQ5MzB9ADIAAAAAAQflzC3pg0Es-bs9RlRg0RAo0uBtHL0o0w36dzg-8oNgP2I2GydwtzZfZNUSTSYCO753ezVr4aORfSlg0dmhwVVGMzAdK6NJrpE8N6ga
Sample260708-e6hzhsbw5n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4252	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279587958972275"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{C95D36B9-CB32-4F1C-9E41-54CC1F2CD3F6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3172	msedge.exe
3172	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 4052	2400	msedge.exe	86
PID 2400 wrote to memory of 2364	2400	msedge.exe	88
PID 2400 wrote to memory of 4252	2400	msedge.exe	89
PID 2400 wrote to memory of 2364	2400	msedge.exe	88
PID 2400 wrote to memory of 2364	2400	msedge.exe	88
PID 2400 wrote to memory of 1092	2400	msedge.exe	90
PID 2400 wrote to memory of 1092	2400	msedge.exe	90
PID 2400 wrote to memory of 2328	2400	msedge.exe	91
PID 2400 wrote to memory of 1408	2400	msedge.exe	92
PID 2400 wrote to memory of 2328	2400	msedge.exe	91
PID 2400 wrote to memory of 2328	2400	msedge.exe	91
PID 2400 wrote to memory of 1408	2400	msedge.exe	92
PID 2400 wrote to memory of 1408	2400	msedge.exe	92
PID 2400 wrote to memory of 3688	2400	msedge.exe	93
PID 2400 wrote to memory of 4648	2400	msedge.exe	94
PID 2400 wrote to memory of 3688	2400	msedge.exe	93
PID 2400 wrote to memory of 3688	2400	msedge.exe	93
PID 2400 wrote to memory of 4648	2400	msedge.exe	94
PID 2400 wrote to memory of 4648	2400	msedge.exe	94
PID 2400 wrote to memory of 1148	2400	msedge.exe	97
PID 2400 wrote to memory of 1148	2400	msedge.exe	97
PID 2400 wrote to memory of 1148	2400	msedge.exe	97
PID 2400 wrote to memory of 2140	2400	msedge.exe	98
PID 2400 wrote to memory of 1560	2400	msedge.exe	99
PID 2400 wrote to memory of 2140	2400	msedge.exe	98
PID 2400 wrote to memory of 1560	2400	msedge.exe	99
PID 2400 wrote to memory of 3852	2400	msedge.exe	102
PID 2400 wrote to memory of 4100	2400	msedge.exe	107
PID 2400 wrote to memory of 2864	2400	msedge.exe	108
PID 2400 wrote to memory of 1132	2400	msedge.exe	109
PID 2400 wrote to memory of 4208	2400	msedge.exe	117
PID 2400 wrote to memory of 4208	2400	msedge.exe	117
PID 2400 wrote to memory of 3172	2400	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://click.communication.kedge.edu/?qs=ABB7InYiOjEsImQiOjQ5MzB9ADIAAAAAAQflzC3pg0Es-bs9RlRg0RAo0uBtHL0o0w36dzg-8oNgP2I2GydwtzZfZNUSTSYCO753ezVr4aORfSlg0dmhwVVGMzAdK6NJrpE8N6ga
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe0732c188,0x7ffe0732c194,0x7ffe0732c1a0
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,532673130719903265,10798649775129012664,262144 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,10851154579639553137,17230066545087061510,524288 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,13948814687176356338,15505578009799758545,524288 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,17832080566822339727,6116320259763812590,2097152 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,7286982089222494270,7585195814671509855,2097152 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,369416706240798868,6955094505729714158,2097152 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,5492255655947928579,11706712853475524435,2097152 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5072,i,12329665705720067238,10524499268977468939,2097152 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,15649126186689926173,10841097413092706403,524288 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,10631943628893701271,14693473282247037882,524288 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,18160803982024238953,3230166373200513838,524288 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,18160803982024238953,3230166373200513838,524288 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,11876419408539153045,3179015825098907688,524288 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,12246504444801665060,3046927769693883659,524288 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,8019298427067936297,10830559413534918614,524288 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,15216514566793436465,5306290415289539549,524288 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6344,i,938058214070970780,13230841282393649622,262144 --field-trial-handle=2232,i,14110288094087161548,114071826223522012,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 31201e2e44f6b31815bc13c0618dbb0762bc63a4cf60672b9ccd6ed6fdf76b35
MD5 fd36d5c8204c44f037675a4bb52095b8
SHA1 6344bf0c6aa42703b55584cf498e8a1f2dca20df
SHA512 26b1257f37919e12c700380774e13e91b436b7e5088afff8086f2e6736af47b4bac202b664efd93c5f2b0c6f6c13e590e8481c7b82418603b8bf9428c003970c
TLSH
T13E7170FC2B6508D1DB596471B4E20680747C2ED5F63FBE4E435094FA2201F658F4D2AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f817.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f817.TMP
Size 3KB
SHA256 32b633ec570388ed16a1652fc0a5d98dd7bef9d920be6bc3df1be4a3588def95
MD5 c2bd12880a4b7bcdd2f21bac75e56f35
SHA1 ddff9e656e975a41d9a68e35090e137f472826bb
SHA512 68dd40979bcf3a828c1bf97830ef3a25e8fe6ec3a699ce74abb851dc0c257df88f307ba0ea1fba8935e6fe27138c76f01bbd7aa4507a720c229177bb090a5a53
TLSH
T1A261F8FD176208E1E7694071B0E20644747C3EEAF53F7E8E535048FA6616F668F5928C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 54e6770517498e0ec4e2fb6b9149d9113634e582fdb5c0e3cf097046219c2837
MD5 b5e26a0d3c28f6ae5c288fc28bb39b4b
SHA1 1f52c56db057fce4d6930081e1ed9620953efcd0
SHA512 19a290293afa1ea3c0403725c911cfab0076885b71d1b353fb51f3c491053a5b16c6a79f77404edce0128c69aff4b8a9726e64ad93bd9b53e3d01503c059ef46
SSDEEP 192:DBdRQ7SCdJx+6ynl+d+Au95HeKUca8AdGkj6boRKTuu:DBdRQ7SCrx7ynl+d+Au95HeKUc7AdGkY
TLSH
T1E6D1ACF783E4826D8812D2FC5A24AF1ACE5D555583183E298DD4FE07E3E2071E31274E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e54664629605259aaa296b1c06fa8e1ef8cf27f534f557f07ddde594dd4f0bc4
MD5 f2e71ca7a32f555b03be279c893922dd
SHA1 6ffff8ffc49f5935ea768a852ad53fcc4ff84f88
SHA512 d279d59479b5c70ce7cdc761b9a5ebd66b04b22b3d23571918cb32a37c67b0bdcb93a2d0a66116fce91b2185ed25a531404ccee725311150fa75215ecefdcd80
SSDEEP 192:sxZwR4RbyM/jK1Ml8UQlk5/fxsLjDoZ+IdpjAHW6+WNJBu/Y9ISDKlIg5VJ:sxZwyFqu5/fxsLA5cHbi/t9
TLSH
T1F452C612AA349977CCDBD209F955BB53E6F50572D2940E44AAFCCA0C01E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 089d270fd552eceb10fd21ecf93a64462cef95232f6cac53744e4c3dec27a495
MD5 f72344c0e4b54f65b9d362af3260f52d
SHA1 a875e703386cf2da7664f27a3fb63071cb8b7896
SHA512 2fec779fb063f6a8ba9e88f2534ced45e493fc08edbe31db421011b625ec38ba9bec0c179b3705b12faf8673f439782ef6d056c7d9ac51026601b61d3515b5a0
SSDEEP 192:sxZwR4RbyM/jK1Ml8Mk5/fxs/jDwZ+IdpJAHW6+WNJBu/Y9IJgKlIgrJ:sxZwyFM5/fxs/o56Hbi/B9
TLSH
T1CB42D712AA34A977CCCBD209F955BB53D6F50562E2940E44AAFCCA0C05E7BED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 cbb4d5d975e2c7e5de83686ef5edb45ccb82c4ab72d0cb2024e84568d0f67b34
MD5 657782b226b817a61b208b66963b47c2
SHA1 a44773f50468856297d4fd57bc066e2a001b51bf
SHA512 da77b8c9ea5ddd6142f53d10915921719df29b3d014c87e234827828b1952b66d4a5ce2b48d6cc167a25eaae9836fa90a835490755af0e391d2a08e671a8180f
SSDEEP 768:wtcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNjro8g6K:wtcv21wWvu+Z+u1jaeFLeRNQ86
TLSH
T18CD20A2B280CCB7E4F841E9CED2AAF866DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ab4640c1982f19da2504bd7e3cb81a07bc2006b6fcee59acb02b5403a5dd7ac6
MD5 c10cb1ad13fe56fc6939c7f9f6cde538
SHA1 5704dc9211b2ddf8f4478f7d736bf0280e6d5498
SHA512 ee6de4e6280a5456d26f11a5030ecbc7de07f3bf574259f1e555eac6475b00e6a59f12c443497155cfad065838ec84d4754fee94b6f230c473c456f914a15a01
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD+WqP2qc8cKWkB5gaKK4/ggKcKiJ46jHinF:mTZqP2qc8c1kBKay/ggRKiJ46jHinOiH
TLSH
T1DA919615713A0291387E688CA296A5279E8171673924F43FBBF811624F67E439CFECCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 167B
SHA256 6230b9b6fa4354b21a1bc522a055b70b8d0d8e2bef09f90d6f593ad416d539be
MD5 5cdc62f12bb328be515ba6d9bc837c3e
SHA1 080ccdda4627ebae829c1a2648df413eb9abf1e0
SHA512 ea08f82e697a1f130ff2c05436308ff423461e18419cd20502f4602f4c3fc27aafbcd9892ef07bf4ce1f48837a097699d10302164784eabd6a1eb132edd9d119
TLSH
T183C012EB3109888F06B0AAD01414B29EC20B030A8CC8C8BC8908500131A8A275E06D2A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58e162.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe58e162.TMP
Size 174B
SHA256 98a86cbf795dde124da9d2dc20fd295ed245733b934b4d145be3f5c9ac3884a7
MD5 cfdb5983801a5cdaea548229bc9e9299
SHA1 dff87c341ebb41ccf831ea7a7d3cefb6fd818bb4
SHA512 5742bde7ac892c9c027c1c95d7779ad3ce30aeb84605e67716a71dc9d6523fe5a1bed3ad871e9c7b6bef2b9efae651fc3cb3195d056829274d6000f2ff75c668
TLSH
T13FC08CEB3119888F07B0AAD11424B28EC31B0F0ECCC8C9FC8D09700131B8A779F09D2A
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59742c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59742c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 63f97e5c271b15159b5a13e221b06c84e6e488f171425f2b0350c6ae262b0934
MD5 a88ce9fa404609d0aed6646460054463
SHA1 43b15972cd395d69703bc849312f1bc4178fc30a
SHA512 2838059bd7873fee55d49902c59c2829890a9594738d75545222f8ebe3a25a5cbee5538bfcdb3393fa0cbbfc995106f77f8371c0e3482719a40b9802a526a3f6
SSDEEP 384:QtNn/s3n9SfsNWotOO0zihODe+CMdceCBS+2IpScjmwZr:Qj+9Uc1A5iklCclIp1j9r
TLSH
T173928D37AD255C665AE29185F4473613DFA851B3D6C52F84D8ECAF0D02CB6EC0316E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9a372df69968e09de34fa794413475becdaec35098d6bbe3db189a1a1312d243
MD5 251ad57e6fda59af8b9ef8898a38577f
SHA1 f23f6697b98cbb58037a2b85f18616165b9da9f7
SHA512 78d54d9b3d69c20670090754184a76ccd5647a8049bb69407b73eb7b4ca9eb959ea73082237b169799e1981750ab8fb9a3c5ee42785d6333abcd230143f6530c
SSDEEP 384:PiF1tNn/s3n9SxzsNW8TUNTUlIldtOO0zih0De+CMdceCBS+2FpScjmwZr:aF1j+9WfwgB1AjiklCclFp1j9r
TLSH
T15DC22AF358D7483ADA9E9747A73E2D128E7CC163B5812A80B7989A0DCDC71BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4d39932cd896922b3f3ce7b00756558f1700742cdf6919931043c2e8f40f9203
MD5 e05edbc8c2e8ce319a21966b24774455
SHA1 c4f4200f4fe965c37a470062511dc8ad9718cc95
SHA512 470c2db46458c631a665261fe233d2dfb1c2c6651bbde57be37427eccbdf6def82ec58992709c1782a37e97552fc3ed52372218fee2ce4064e883ce041293769
SSDEEP 192:JONU6v+YLNQmiUylMZh+CGy+FdeL9oCXuscfU6:JONU6vz/TZh+CMdceCDSU6
TLSH
T1E602D9357D382C6B9FF2AE45F4873A235FA82177E9912F84D9E81B0D01D769C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e8e2b3dfbf208666541fa39da1725eeb794cebbdaed8f567031894b2b578ab50
MD5 0a87701fe67436c5a98d27d72be9edda
SHA1 d3f823956c2cb64661359ad6c484648b11814baa
SHA512 2fb4adc85253486e10530640f0e1e78e94f8f4fa4323b06b2a95c9565351d1e01fd29539ac8be302d6d9a5d30110a17ad23f19178eb79db79e61b1a388727158
SSDEEP 384:YtNn/s3n9SfsNWdtOO0zihODe+CMdceCBS+2IpScjmwZr:Yj+9UB1A5iklCclIp1j9r
TLSH
T186928D37AC255C665AE2A185F4473613DFA851B3D6C52F84D9ECAF0D02CB6EC0317E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 40ff463afe263215844bd5446c9e327e3ee9c9b59fbe1653de49afc1a4637de3
MD5 9c23bbcb3a064de910d77dc0608eae94
SHA1 68a1de80878d5c9e206d3c80031b90fbe5967dbd
SHA512 ff66792ff3143f457a1bc7b49e039a7203d521e4feeefc1b6e1a10a93c51dd84611cf04fe9a39d56cb3a444e8b2baf9c380b975d75cf685e9ad696424d8af827
SSDEEP 192:tON36v+YL0QmiUyHMRh+CGy+FdeL9oCd1FS+2WCHnqiU6:tON36vzI/Rh+CMdceCBS+2XpU6
TLSH
T193121B36A8345C6B5EE2A955F48335139EA85177EACA3F80D5EC6F0C02DF6AC2346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

526ade20-2ff8-42dd-bd10-2739cc982a70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\526ade20-2ff8-42dd-bd10-2739cc982a70.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 38a8ad8fe9d8a09ab766aa7e7b3b5801acb8bc53f5caf30e6acc4c699ad47ebe
MD5 d67da903f319e6fd03abca3005642fae
SHA1 11fc1f84c29ddac972f1a43c292a01f44fe31437
SHA512 f115c4a58cdf39ba3fb4a4b646c6f7a752826794deff69de427db908952074d8ef57427ea1b9b27690093f26f57433652a96fa5627410a7a057efae8fb4ea9a5
TLSH
T1F041B659AAF91108B3B76F5A9BF7A5AD847EB8322F4BD49E10110D4E0A22B04C871737
MD5 SHA1 SHA512 TLSH

Submit Download