hxxp://corplearning[.]net

Analysis

user interaction
yes
max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://corplearning.net
Sample260730-2bepya1xes

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5828	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299238631759044"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{6DDF0A77-92B7-486F-ADC6-3281F68C3301}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 3520	612	msedge.exe	88
PID 612 wrote to memory of 5828	612	msedge.exe	89
PID 612 wrote to memory of 1320	612	msedge.exe	90
PID 612 wrote to memory of 1320	612	msedge.exe	90
PID 612 wrote to memory of 1320	612	msedge.exe	90
PID 612 wrote to memory of 2056	612	msedge.exe	91
PID 612 wrote to memory of 2056	612	msedge.exe	91
PID 612 wrote to memory of 4972	612	msedge.exe	92
PID 612 wrote to memory of 4996	612	msedge.exe	93
PID 612 wrote to memory of 4972	612	msedge.exe	92
PID 612 wrote to memory of 4972	612	msedge.exe	92
PID 612 wrote to memory of 4996	612	msedge.exe	93
PID 612 wrote to memory of 4996	612	msedge.exe	93
PID 612 wrote to memory of 2140	612	msedge.exe	96
PID 612 wrote to memory of 2140	612	msedge.exe	96
PID 612 wrote to memory of 2140	612	msedge.exe	96
PID 612 wrote to memory of 6056	612	msedge.exe	97
PID 612 wrote to memory of 6056	612	msedge.exe	97
PID 612 wrote to memory of 5164	612	msedge.exe	98
PID 612 wrote to memory of 5164	612	msedge.exe	98
PID 612 wrote to memory of 4784	612	msedge.exe	100
PID 612 wrote to memory of 4228	612	msedge.exe	107
PID 612 wrote to memory of 4844	612	msedge.exe	108
PID 612 wrote to memory of 4224	612	msedge.exe	109
PID 612 wrote to memory of 3952	612	msedge.exe	117
PID 612 wrote to memory of 3952	612	msedge.exe	117
PID 612 wrote to memory of 2112	612	msedge.exe	118
PID 612 wrote to memory of 2112	612	msedge.exe	118
PID 612 wrote to memory of 3092	612	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://corplearning.net
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffc1b77c188,0x7ffc1b77c194,0x7ffc1b77c1a0
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,3067445290752390892,11100918409336080282,524288 --field-trial-handle=2324,i,5999974686952842283,5659768452544414202,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,13152088435912882279,12748631848140172942,262144 --field-trial-handle=2324,i,5999974686952842283,5659768452544414202,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,9851578905434288240,4374375890725685290,524288 --field-trial-handle=2324,i,5999974686952842283,5659768452544414202,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3360,i,10303669056092068989,16970236978249825548,2097152 --field-trial-handle=2324,i,5999974686952842283,5659768452544414202,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,8114144749740516258,3346774988762676108,2097152 --field-trial-handle=2324,i,5999974686952842283,5659768452544414202,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5012,i,13468064007926150446,239830518244727305,2097152 --field-trial-handle=2324,i,5999974686952842283,5659768452544414202,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,18445889230040102815,703850396612129619,524288 --field-trial-handle=2324,i,5999974686952842283,5659768452544414202,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,4867327633987319897,8574321438674705070,524288 --field-trial-handle=2324,i,5999974686952842283,5659768452544414202,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,10546457504305871048,1744101319156791378,524288 --field-trial-handle=2324,i,5999974686952842283,5659768452544414202,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,10546457504305871048,1744101319156791378,524288 --field-trial-handle=2324,i,5999974686952842283,5659768452544414202,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,14373371481746868349,15201280708291497768,524288 --field-trial-handle=2324,i,5999974686952842283,5659768452544414202,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,2122574896341590757,9004419024666877673,524288 --field-trial-handle=2324,i,5999974686952842283,5659768452544414202,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,11050746987388562105,10467164443672100535,524288 --field-trial-handle=2324,i,5999974686952842283,5659768452544414202,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3004,i,6720542990956671193,5911832004967346251,524288 --field-trial-handle=2324,i,5999974686952842283,5659768452544414202,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,12390520190240550937,12966405002028605211,524288 --field-trial-handle=2324,i,5999974686952842283,5659768452544414202,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,2200489499497899628,15861925543066641739,262144 --field-trial-handle=2324,i,5999974686952842283,5659768452544414202,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ebdaa271a2cd8894f5c151ba9fa19a1b0c9f3a0fd90bb6ac28a2ebe291418ec5
MD5 32a92686a6ac674d4bc79c7bc1744af1
SHA1 b73189e399001bce64b3eb7cad5e37d4758484b2
SHA512 a880ab3a8f81531bfb15c8c9a1d279789a9cb83e9217eb0c0a1dc4c9708ac270c35062d261c8280a5c2a4b07f58150d114e5111201db6cefe4d3e20ec2363d5a
TLSH
T12EE022AAC822EC2708FD1798A4498786E751139B3A408D5F3B3D82098FB466A86C5C9C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 736675979306a8868aed365669db09b13b214ba46790b958e2a9f5630639ff7f
MD5 b75469b5913295775529951d2ee0be88
SHA1 1abbcdfc62f055dc122674cc8f6a5ab223feea48
SHA512 379f6209842043f2922ff813393f7893c3c3dfad671e70cb0117e36320de1d9099dc0687cf6db8035ecd7da1c5428e9839f8d86f7b21558d027a7491ddd0c97e
SSDEEP 48:jA+D3WOgsVQk3Z849TJwjeaQEB7OdVvNoqIrmrhPV3Uthu1AhiIXQrI2uOsB1PM2:Hwse/bVB6mCVfYRXQpWXLKe
TLSH
T16F81B7380B960CA2E7534F3146D230E4F63982FAFDDF5E871F20A835541A7A5887D967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 bbf6a8122406120f95027e6a95dd7a29bd2f26c71ba844bde99549e7d226116d
MD5 ff75e9d886eb2801a11ec1ebdd3495f8
SHA1 84741ddd9f197d1974658232989d393c2c73c5a0
SHA512 06f71a27050734e860ab3e550dc4934471f6dd8f90125ce9d859a726e1196705e87d6319809789f4c46601b098cf28482cb3f746d5d10ac4973fdf4fed52efc2
SSDEEP 48:G+D3WOgsVQk3Z849FJwjeaQEB7OdVvNoqIrmrhPV3Utdu1AhiIXQrI2uOsB1PMEj:dwseJbVB6mCVbYRXQpWXLIe
TLSH
T13581B6380B960CA2E7534F3142D230E4F63982FAFCDF5E871F20A835541A7A5887D927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe587d0b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587d0b.TMP
Size 3KB
SHA256 eaf0e07c63ea372b433a7b1f5b0a98b9897feb442a377cb854fca4087ce54bb0
MD5 c06ac30b30765fcd137eec4d43756306
SHA1 77c118bcd35c1df412e05b4bca457354f22d23ab
SHA512 c09a808645e4c9d291838c70e143a081eb5d4a3b7c7eb70e908b2454f8ae503974babcd2e02f4d7171d0bd2e38e77e1de50883b06118f5becc0dc26fe0605269
TLSH
T14F81A4380B960CA2E7534F3146D231E5F63982FAFCEF4D871F20A8356409795887C92B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6da5a7bf90caf84884c3341d16f8196c611a7d5f77e2e8b2a3e29a4cb782e7cb
MD5 571a0b766f630bdf7236a2d14c8bed32
SHA1 0f7d2fba054e9aebe452997836f4bc4cc189273f
SHA512 b48968534c00ad9bf6a3b325ac4c96837e95b8d5350265572e8af1afa1bc14619d28c33e3f2175423e23bb9a6c056453098f8dc57e6d07e87c3704d596e004fd
TLSH
T1C431C0F383E8856E8A1095F0B618AE2FDE2D0514432C3D9AC9E4AF1B93E2471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 2de76c42e79910620a1e8cc05bbe60b110e144de6165a28d00c023ee0b5b38ba
MD5 ab6f24db59ce36b33e922a0b35edc39f
SHA1 a1144fed45d1a4a0116f2894bf762663d18c94ca
SHA512 90e16cfd5e8c5b3ab9703d8ffcd07c5a46b3b23200d4e2fedd3392d5cd59d1cc9187e722c4c0a1d66179776c332766f024a2c390ab1d14eb882e052f428b1623
SSDEEP 96:D1JOf4Zi1ut2aaij6bz1dEwt1ixaU39tk/LGGtRwJ:D1MAZi1ut2aaij6bxdEo1ixaU3Dk/LGx
TLSH
T1DEB16CF782E8CA6ECA1156F0AB182F2FDE1D0A5993283C1E89D4DE1BD3D3471D10565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 177ef66b831de1a727edcb8456f842de2c8950821241b9097b3f8f650215a862
MD5 45056150a091e5e80807e14fa4e02bb1
SHA1 e01092e7d26d83370e5e25ce5828cee506834743
SHA512 f5f5323a2176f66eb5b746f1046342b1cf7ab32c38f79e0bea07b94f6d6640712e355d906c58b30d5f67d8b70ca71fcad68dd5e512bfec44c3fb6e8be170d6ce
SSDEEP 192:sxZARkxyMqZjK1Ml8Mkd/fFsBAaZdRzodpWYHW6+WNH7AnL/YvlSuuhxxIg5gaJ:sxZAOcMd/fFsBAazavHbbEL/A4LKW
TLSH
T11662FA066A3459779DDBD219F6457B53D3F91163E2905E445AFC8A0C00EBBEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0d67df3b0486063daa75005e15bc797ecfcfa72732dd82d2885d0e91555b4f78
MD5 013f4bae697367bd50c7f4be4fcadb4a
SHA1 e10c069a55fa89a8e7c518c6a95bad7cc1b52720
SHA512 68b6768679cd5c1fd9668c9022c46af694348c90754c7f27822ba9b2531592c49ad245810bc27da6cc844c5fe3b9ceb5cc8235435de2e43732e78566febcb210
SSDEEP 192:sxZXRkxyMqZjK1Ml8Mkd/fFsstAaZdlzodpWYHW6+WNH7AnL/YvlSuuhxxIgjaJ:sxZXOcMd/fFsstAazuvHbbEL/A4LjW
TLSH
T1D662F916AA3459778DDBD219F6457B53D3F91163E2905E44AAFCCA0C04EBBEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a21a77368dfdbe3f0ee72ad2d9dac958698924e3be4a5694225f6c5933724f3b
MD5 7bd83695200a3da1bba29b05c53f8490
SHA1 9a370954270e5cd0021cbd45fea76bcb6e42f5c0
SHA512 9a57a6adbf480335fe6af454aef3ebf0ca76d1b933cb8b1fb4467507aea447ac697e520a49194d7a3d7533a8740ff37a00837549ca4765756ca06f2359450147
SSDEEP 192:sxZARkxyMqZjK1Ml8UQnkd/fFsB5ZdRzodpWYHW6+WNH7AnL/Yvl+u2xxIg5gaJ:sxZAOcqkd/fFsB5zavHbbEL/AqLKW
TLSH
T18B62F91AAA3459779CDBD21AF5457B53D3F91167E2905E4469FC8A0C00EBBED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 1e3983ee9189ce58abb3f0c1705af88c5b72f3a3f3cd5d14fbc77e074dcf0535
MD5 f7798b0372be78ab0175417e94b7aa08
SHA1 197dea8372d4b8d1bc93167e7418e54959cd831d
SHA512 b5fb0394ec9875805a8691cdbe820a921c0af651b4cec4e393e236e22a2f6bd36c8183234286c8ff023f7a361dbbca55e5b738c7c15eaae78f2340362e5e57c6
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGM:05ppxnY753RNBvRJJdt7p5J9bPv+F
TLSH
T161B2575A703E0211397E2988B39696364F4235A37058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 bf8a8cc5adf22392e307c1eeda14bed795a0859b30f029ada41f79c226117bb8
MD5 7fb530f9ffa041dfd2649af5bbf254d4
SHA1 491fb2d4c2ce75dd99f7392c070580affe67e160
SHA512 80d9e3ba70c889118b5b9d3a9495d12731bc17a6f6d0bfdc8af1993de9caccedde6d9a811e814152859407a59356b6b5ba99303c2770723c616770e2c4780d27
SSDEEP 768:plFccps3EwgbkUDU8XGp1UhMXM967I8p00LQ:js3Wxv1iXRI8p00LQ
TLSH
T148C25C36DC68CA7BFCD34B99A74B3943DEE05157868C9AE4DADC1D0D009B1AC530BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1984e7f1cf0f51b6d27acffe5b621f953a9ddff0607ed00f393f8dfe5a74f3ae
MD5 90c15f998427e7b753af969c078633d2
SHA1 e510f9e791f1f7cf17f4acac793148fb208641ce
SHA512 d6681b8acd4088fb996df8f20c521d9bcf86c4e41586a9c49bd2d2451f7dbb938409fa840e3be20e0a07d955f8430a94a5874ed25a7a3e19ee6fec0ea2045a3a
SSDEEP 384:nviFiZcIg3sNt8TUNTUlI4zQckCrTfxpvtfxGp1UanuMX+jh67OObjI9G6w7eitF:6FQg30wgSk0PXGp1UhMXMh6729M3
TLSH
T10ED24A3ADC64CA7BFCE78B95B74A3A03AEF44167C68C5AD4E5D85E0D009B5AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ec7b35b8b58944d8d5ca4ff1ae9f59654d4c63c866cfd2a2c25543823fa687bc
MD5 dfd6229f487e8f3cf348fe2b172a5c19
SHA1 57c6d3d0574d95f47937450a6b9e84bdafb461d1
SHA512 2b412c2773e99bb217426ed2ee6ed3908490a119d6bf2c5ea3538f0ff298ca470cbf3d68f9906b535c0d1e33942080e9119d6226b301b739f25041589ff1d347
SSDEEP 384:npAiFiZcIg3sNt8TUNTUlI4zQckCrgfxpvtfxGp1UanuMX+jh67OObjI9G6w7ei7:pbFQg30wgSk3PXGp1UhMXMh6729M3
TLSH
T1D5D24A3ADC64CA7BFDE78B95B74A3A039EF44267C68C5AD4E5D95E0C009B5AC030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 2d95359b0173257dcc6f0be64d790242deb475d809f9ca29bb361d8bcd388df5
MD5 eecbded1ed6ce35047aee484f1977c33
SHA1 44246de3d0ff05dcc6e8f565596e78ba6fe6e9e3
SHA512 ea61ff0a8ca06face458a74673934f415df7738360219e25a4a344b63eda62bff1e72f9da964ddc2bf789d647892bf832472fbe41d91dadf9fbf8260f75878c9
SSDEEP 384:npriF9CcmyWCs3sNTQ8TUNTUlIm2QckCr9lBUKpvtfxGp1Uan1bupye4KV8p00LQ:pGFccps3BwgbkUXUkXGp1UwblI8p00LQ
TLSH
T1FAB25C36EC68CA7BECE74F99B74B7A03DEE0116786D859E4DAD81D0D009719C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b724845b751a9db903634d1a6260f6a10640e2a06dbe6e52e24faea484fc512f
MD5 47eeeb5fb6087107b4e3135ca78679e0
SHA1 514d7e6d3c42b03716ab54a607b79908e022da4f
SHA512 38fcc0101c3746cf83331ba463794a3abf103b53b1fb6613f02dd9f612fdc5814a8fc49e71120635cccf1fbf3a8a5ceb828b5c26ef6c85dbc8e424fbf34752f1
SSDEEP 384:nNiFiZcIi63sNt8TUNTUlI4zQckCrTixpvtfxGp1UanuMX+j967OObjI9G6w7ei7:EFQ530wgSkpPXGp1UhMXM96729M3
TLSH
T15CF2E6F698D78976E8AE4B87A77E2D029EFCC153B6885984B7D84D0CCC464BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1fb97ebb761f3ebf01e284e78d59ff551442980dd0e44e7e127fe018f2b7a7c7
MD5 429724e2b9e2d42a017c5f10b7133d3e
SHA1 96933eccacb30a13dc2cf6b30caedd8c90e75cab
SHA512 6f26d44b9cacadae05e807fbc306fed1bdc3b22f2bf9a6913137415b40fa3cf457d01ee1f67104d3919334f2ff225d8321560aff6700ec27cd43728e2acdbdda
TLSH
T165411C58B9FD1158B3B36E5A9BF6A95E447FB8322E06D49D00110E8F0A66A40CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4784-268-0x0000021F45700000-0x0000021F46700000-memory.dmp

Download