hxxp://true-forthe[.]github[.]io/true/index[.]html

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 19:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://true-forthe.github.io/true/index.html
Sample260804-xy39layapc

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
162	drive.google.com
158	drive.google.com
160	drive.google.com
161	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4064	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303446098966314"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{AB1054A0-9CB1-4E63-8F46-FD3F84588C12}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 3204	4844	msedge.exe	83
PID 4844 wrote to memory of 4064	4844	msedge.exe	84
PID 4844 wrote to memory of 4012	4844	msedge.exe	85
PID 4844 wrote to memory of 4012	4844	msedge.exe	85
PID 4844 wrote to memory of 4012	4844	msedge.exe	85
PID 4844 wrote to memory of 3580	4844	msedge.exe	86
PID 4844 wrote to memory of 3580	4844	msedge.exe	86
PID 4844 wrote to memory of 1012	4844	msedge.exe	88
PID 4844 wrote to memory of 1012	4844	msedge.exe	88
PID 4844 wrote to memory of 1012	4844	msedge.exe	88
PID 4844 wrote to memory of 2432	4844	msedge.exe	87
PID 4844 wrote to memory of 2432	4844	msedge.exe	87
PID 4844 wrote to memory of 2432	4844	msedge.exe	87
PID 4844 wrote to memory of 1804	4844	msedge.exe	91
PID 4844 wrote to memory of 1804	4844	msedge.exe	91
PID 4844 wrote to memory of 1804	4844	msedge.exe	91
PID 4844 wrote to memory of 2956	4844	msedge.exe	90
PID 4844 wrote to memory of 2956	4844	msedge.exe	90
PID 4844 wrote to memory of 2956	4844	msedge.exe	90
PID 4844 wrote to memory of 4616	4844	msedge.exe	94
PID 4844 wrote to memory of 4616	4844	msedge.exe	94
PID 4844 wrote to memory of 4616	4844	msedge.exe	94
PID 4844 wrote to memory of 3308	4844	msedge.exe	99
PID 4844 wrote to memory of 3028	4844	msedge.exe	100
PID 4844 wrote to memory of 3308	4844	msedge.exe	99
PID 4844 wrote to memory of 3028	4844	msedge.exe	100
PID 4844 wrote to memory of 4480	4844	msedge.exe	102
PID 4844 wrote to memory of 1504	4844	msedge.exe	113
PID 4844 wrote to memory of 432	4844	msedge.exe	114
PID 4844 wrote to memory of 3688	4844	msedge.exe	115
PID 4844 wrote to memory of 3444	4844	msedge.exe	120
PID 4844 wrote to memory of 3444	4844	msedge.exe	120
PID 4844 wrote to memory of 1772	4844	msedge.exe	123
PID 4844 wrote to memory of 1772	4844	msedge.exe	123
PID 4844 wrote to memory of 1772	4844	msedge.exe	123
PID 4844 wrote to memory of 3324	4844	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://true-forthe.github.io/true/index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb70f2c188,0x7ffb70f2c194,0x7ffb70f2c1a0
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,4346612507769038190,7174957502988913292,524288 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,421197189872416534,5146765436640097209,262144 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:2
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,6866408711320994958,8224632655917016019,524288 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,16319416710593866642,4318984199103801001,2097152 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,6523973075446427125,11862578129937292452,2097152 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,2319437054079994803,17635771990468618160,2097152 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,12675261360531579833,14739476028767521398,2097152 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3928,i,6789553830070788246,8043695875916450581,2097152 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,18101156455865636430,3230110127563386674,524288 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,5082080102997495435,3650815877736645649,524288 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,4344111396682841234,3346404695738217768,524288 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,4344111396682841234,3346404695738217768,524288 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,17463182475937538912,17021271677218352819,524288 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,15695248769976308401,14582516118807013043,524288 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,406517465523623230,1551843195516100633,524288 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,17016833561500598015,7197603155599003214,524288 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4188,i,15982068850584097895,15894031941253017924,2097152 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3488,i,4531354386534349137,902603579447758059,262144 --field-trial-handle=2916,i,13903102494212364862,15002336021980351790,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec09ba5da501666cac506a8e17a37a0b19f2d9712ad11c5ba4ad14b3ce62e7db
MD5 e1404f4875306f456785e26a92aed547
SHA1 053db7b2ab0b6a59f2b44973d8f1751505d230ac
SHA512 a6ccf97239d40b1773848dd7f6ee31e91a3f8b90e05f43c6d7b13ead4ba9896a88cb2a9ebb06880b10b5223c52e29e192ba9e6e80528cece8415c817c164e52c
TLSH
T137D09B203A88F441CB45017195049F553B2654542057DA0BE165585D5CA51D493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4edb54045978d0a43d7409840426c282ee3571c93e386ec4528363ce3f2a24df
MD5 6fd5ab567bec18343c3b17ee76e412d4
SHA1 db9b67a95c8bae878c4a1e54959f49f69401024f
SHA512 2e067f86dc2b21ead741789a852f9045d18bfa95d4d8d589cc05718f17269ba07174cf01eab01d2e8648a293af4d81a42b3328224b3ff062eb8233b8a3cc64b7
TLSH
T11061D8380A12B89DF7301373F5D03BFD33F251A94D5B4ED911A018BE158BF324A56418
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 88548452508c081015e43270c547c9a2cadcd40f8e6a5123aef3b01cfec948de
MD5 8432576ea24107da5505fe1564681338
SHA1 7e4fea2864c834e913282d1999d3f6e39ac60af7
SHA512 d8ce6c24ab14534fb7e93a6ec43fe9cb5193d2ff37b1a4c5ec63a7b4edfb3d709dbdb0ee3f766c989d70e755226d4a348d899ed1ef2976a43430f1c636015a2d
TLSH
T1A161D6380A12B89DF3311373F6D03BFD33F251A94D5B5EC951A018BE158BF328656418
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a92c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a92c.TMP
Size 3KB
SHA256 e6e0f50f35baa237f06051e30867802bdc8ea39abe90086fd04dbeb3b8e080a8
MD5 a4ccf32465042c51e42ceeb54de398b4
SHA1 d5df377fbdb7d61c0f0bb0b51f49c05191f2e41b
SHA512 028042c8b9d35fac0d79b5ad5510cbca35568ef17bfd55163d051e4beb88ee0f919e462233f856587f2f6075435ba7aebbb0b6dca5284db3a8b69962b09df059
TLSH
T11361D7380A12B89DF33113B3F6E03BFD37F251A94D5B5ED951A018BE158BF328656418
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 7422482eb966d9b1f87bb780cfcec7bf4847d97fcab16c2322429f1f2a6cba99
MD5 7d59d9135090fa47b862e2ff7baf549f
SHA1 70b8dc8aff2ddd7fbe387d1122cc168fd4f9b98d
SHA512 90aa489c61f4b58485d815ecb681ce4674f31bca138643178fa2638013b72ce1505650eba47dd6a0f63e4c59c277cdcf9c25a4be47d5e4ff18a17a8c698bb1cc
SSDEEP 48:YALlN2O242m20XSQXrXjscfzsj0nwEsfCKsxuzslfis7svIesazs2MZEs9na:DAOhJ7fblu0nwbi9VsvIM3MZBa
TLSH
T153919FF3C6EC862DC8661AF1B754F917DD2E0A6452183C99CAE8EF4FA3D2431E20155E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 76f65d22c907b0f3363bd56c8cb4525d35fb396b00c7df4bd5f548673901373b
MD5 57e3e056e7fdb9eb61be3f0f618b91a9
SHA1 3ffd560ac6414f4eb9667702c29270262f5cdb2d
SHA512 71d32b0f8d17b09c9a3eb046ebea0f5d3d79fc9cb9bd948e9f56b01eb6b6a189398fd9c2620a9feed2e8a76aa57d892a6cb274a2b6b9948777784ad010397164
TLSH
T154417EF3C6EC862DC8625AF0B654ED17DD6E061452183C99CAE4EF0FA3D2471E201A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bec8d8bc2463292c35c3f3dc65c4a32ff16fbc33e2a1b0801304f1140db5e460
MD5 8a929b94712edf22624f64f1f9ed98a7
SHA1 7cbe7894179c88c26243eb393bd13fd196bce45a
SHA512 093ab9704270adc6fe7184c9b3d3e229499934927973de7424d7a908c1413754067f9c8d5fa364e648b326b19f6da4636d81b441d886c88c76f46ba45b3725d0
SSDEEP 192:sxZ4/yM/jK1Ml8UQQk8/fPs/Lz3jIdpvljHW6+WNIhhXYLa8rIIg5A508SJ:sxZ47qj8/fPs/nsFHb8XrHh
TLSH
T1FF5218116A34A977CDDBD209BA45BF53E6F9147392500E84AAFCDA1C00E7BDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 92dee38c50f7bb4d07c809a6dc822346cef9e5edf1aefd3ea22a9e80fb3a089c
MD5 78498a4ea49927265bd4225a675b6765
SHA1 b9ae750c17ace9a23d872421d7561897335892c1
SHA512 7f13d1c77826818c3a379773bd72a67bfd94ef18d70b7edbb6d973f8c549f888c6174b78ea10c29a826c60e0036f4b158a4f8904b6b3f3a80c9cfe1ddf035a62
SSDEEP 192:sxZ4/yM/jK1Ml8Mk8/fPsvG3jIdpRljHW6+WNIw+/YLhVUIIg/508SJ:sxZ47M8/fPsvGsnHby/62h
TLSH
T17B5208116A34A977CCCBD209BA45BF53D6F9147392501E88AAFC9A1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1038a16c642b0123992607613a676daa15a1944a7f23e0d8e0376ab211b49be3
MD5 bb7318ee5988693ff052ef06ec2abb8f
SHA1 c8b083e8a015456e2369f7476d55c8f396e81bc2
SHA512 25471ab94ebf43af1e25d551fadd2ab499e061373ff92de32658b773bfc9514cdec7996608f80b60989bd45fe780516704489c010fe7e7b66cea0b161f7e7bcc
SSDEEP 768:6ss6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNlroVdu:6ss6pD1WvxzWju1jahILIsNe/u
TLSH
T19CD2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 bb65a39c5eaa1ae95f5d1ea3da8bf20e28c80de9aa35cb4b45c9ecaa49e43822
MD5 32094ab50edf45ace0e2efcb28a09713
SHA1 048fb3997dbd8eec48ca700c756d97a20c22d004
SHA512 39413d69e59aea4c47d01c9066457887b8288de14024bd089ab46f5edee3ac08f4aaf41fdb7a5ff946cbb3e37cf22d6e17876120af7ef48e4bd6b69da1e807ab
SSDEEP 96:KUAAKtePJHohV/lR7whKKm97KeCmb7KHPCpxIJLsd5kNSKOsC9GXqW4UIg0Mpzut:iiJHohV/lR8hK19XCmbuHPCpxIJLsd5L
TLSH
T128C1F11335BB47123C3E290C926497265B82F7A73014E92B3BA810B54E67E794DFC5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59453d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59453d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f0fb259a5814b9f43270826cf5b7099b88fc2969aab2380c59fa053ce8337b5a
MD5 06065289971be70d3c602a0120b93700
SHA1 74e5a50808b53ed774ffe1d9abbdc3ab9ae5f6a4
SHA512 8f6cf5f5f2dc6f4123de446d73fe0fcd4238357fed1f9508c8d53841ff58e5670b3ad3795a1ee9c10ce9379c3ed041933d37f46cec6879853dc74e7062ead6a1
SSDEEP 384:ziFiZcItyesNQ8TUNTUlIlrNxLePa9nODawzcBeRs9JKgqijU2+:eFQIeNwgwCdO2wzcTjKgqmU2+
TLSH
T1BCD22AF248E75836D9AD9B83A77D2D038EBDC027F5816A90B3D8590CCC961BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 34160aa58cfaa312be67ec5bea41a78c13f95e9a22a2e8cc520016a70d40daa9
MD5 4c3c554e2154f0495f184881e0e86358
SHA1 17983a643e2b61868dc023fb01a129fa3a9a98e7
SHA512 20e52f841ed5a0acaafd513cdbcc533f3248e11e2e157dd37fb43b6fd62ae3322b10d2b175af1cf1defbb0d953462ca1b31b2cd448b058333cfee483bed6c695
SSDEEP 192:qONp6O7+3hQmiUy0TGttb0mO2opgGMfU6:qONp61fGt9nOD5KU6
TLSH
T11F02E7356D7C6CB78EB2AE45FA8727179FA5103BE9962F40D6E81E0C00D765C2343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 27f7ec1deedec68bd577eab1c0e75cbd2aadf284076537d33d980dad658cb1de
MD5 cb964f8da3c44a0f994b5a33de60cbba
SHA1 f26af0be7d79a79c3374d870e114ac6367f42adb
SHA512 eab26043b95a2a76799abf9553eb10b586a6ea22648908cbf446f3677ce5518b9ceb7f300db984cc83ba47b260dbe5b0299bbcb76591c65a7b5fccc169ed565b
SSDEEP 192:RONR6O7+3VQmiUySOTNttb0mO2oazEHcNtq7dU6:RONR6BSNt9nODaw0cU6
TLSH
T138120935697C6C775EA2A584F98736139F650037EA8A3F90D5DC2E1C01EFAAC234B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c0dbe0e79c389f8ae94c709c4c33204a6ba9cb3758127b97df84de0d34cdc4a1
MD5 2dcb8748e73d59ccb9eb6a2af38e131d
SHA1 273510be1a41f24f98acfa2cc316d439cf350d79
SHA512 99ef1c2062376484017a5265ed774654f41d4aa5841d1796081162782465e1f4082bdf8b460899688b3ccede1ecc7f4c78524a9f09f895f578024b5765fe01b5
SSDEEP 384:iZcIkesNQrNxLnPa9nODawucBeRs9JKgqijU2+:QkerCdO2wucTjKgqmU2+
TLSH
T1CD928D3158386C779AF6B581F98636178FB95037E6C52F90D1ECAF0D01DBAAC230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 51bad8a967b3f94a29d8d2562c09b9bc80f7baf9f1c5458cf0858e6bf56506ef
MD5 632d16c7d2e4d39573a1b2b4b780c021
SHA1 e62541697d8abf6a02420cc5467002b39fe04f29
SHA512 e52641338b4603bf0658479675bf36a1e72a7a5be47c426f85b807ec055e9119791722fde059f66809429e373ddbe1b76b1bec580809cfab3afe07de03ad4a1a
SSDEEP 384:MZcIkesNQZNxLnPa9nODawucBeRs9JKgqijU2+:akehCdO2wucTjKgqmU2+
TLSH
T11F928E3158386C779AF6B581F98636178FB95037E6C52F90D1ECAF0D01DBAAC230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3a600915cafeb54d32e0852a9cdaac5e7861d286b028ea14e269fdf708de452c
MD5 0ca56069f5628ddf41a0591b23d47eb0
SHA1 81648dcd960a3cb1259129a207ba90ba964fbccb
SHA512 bb7d06300b73250bb4b3fe989dd30fd1e292a0cf4e798086ecdfe21fd4c09284011523ad5bb6957d52ed56a08a9ad275d9b2040f5b709570984a53b6c43d4245
TLSH
T100412758B6EA1158F3B36E5A9BF7B86D487FBD372E06D49D10110E4F0A62A00C871733
MD5 SHA1 SHA512 TLSH

Submit Download