hxxps://sailortraining-eu[.]mykeeta[.]com/#/assignment-hub/agent

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sailortraining-eu.mykeeta.com/#/assignment-hub/agent
Sample260809-pdgwvsem3s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3256	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307511670823583"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{67D1AB01-89B0-48EE-8B37-2D44DE30B5C8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2984	1400	msedge.exe	86
PID 1400 wrote to memory of 3256	1400	msedge.exe	87
PID 1400 wrote to memory of 560	1400	msedge.exe	88
PID 1400 wrote to memory of 560	1400	msedge.exe	88
PID 1400 wrote to memory of 560	1400	msedge.exe	88
PID 1400 wrote to memory of 3284	1400	msedge.exe	89
PID 1400 wrote to memory of 3284	1400	msedge.exe	89
PID 1400 wrote to memory of 700	1400	msedge.exe	91
PID 1400 wrote to memory of 700	1400	msedge.exe	91
PID 1400 wrote to memory of 700	1400	msedge.exe	91
PID 1400 wrote to memory of 1220	1400	msedge.exe	92
PID 1400 wrote to memory of 1220	1400	msedge.exe	92
PID 1400 wrote to memory of 1220	1400	msedge.exe	92
PID 1400 wrote to memory of 3832	1400	msedge.exe	93
PID 1400 wrote to memory of 3832	1400	msedge.exe	93
PID 1400 wrote to memory of 3832	1400	msedge.exe	93
PID 1400 wrote to memory of 2272	1400	msedge.exe	94
PID 1400 wrote to memory of 2272	1400	msedge.exe	94
PID 1400 wrote to memory of 2272	1400	msedge.exe	94
PID 1400 wrote to memory of 2352	1400	msedge.exe	98
PID 1400 wrote to memory of 3324	1400	msedge.exe	99
PID 1400 wrote to memory of 2352	1400	msedge.exe	98
PID 1400 wrote to memory of 3324	1400	msedge.exe	99
PID 1400 wrote to memory of 4724	1400	msedge.exe	101
PID 1400 wrote to memory of 3608	1400	msedge.exe	103
PID 1400 wrote to memory of 3608	1400	msedge.exe	103
PID 1400 wrote to memory of 3608	1400	msedge.exe	103
PID 1400 wrote to memory of 4600	1400	msedge.exe	104
PID 1400 wrote to memory of 4600	1400	msedge.exe	104
PID 1400 wrote to memory of 4600	1400	msedge.exe	104
PID 1400 wrote to memory of 4836	1400	msedge.exe	113
PID 1400 wrote to memory of 4328	1400	msedge.exe	114
PID 1400 wrote to memory of 4768	1400	msedge.exe	115
PID 1400 wrote to memory of 3824	1400	msedge.exe	117
PID 1400 wrote to memory of 3824	1400	msedge.exe	117
PID 1400 wrote to memory of 2804	1400	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sailortraining-eu.mykeeta.com/#/assignment-hub/agent
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff9a697c188,0x7ff9a697c194,0x7ff9a697c1a0
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,4963003184039208161,1936764429380419222,524288 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,13035639237004413800,15129105130028232894,262144 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,7948480654777825942,6018259930741507535,524288 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,6795904281545977712,15493503224646232801,2097152 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,8579032380988450195,15236495216704972072,2097152 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,12444073313049895019,455494789652174242,2097152 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,5992006620035057159,8939128996840524100,2097152 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,14577547102935354764,12441812235836944152,524288 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,6714023023469952251,4487324094817724579,524288 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,18167411481371493504,14773584619001385251,524288 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,18167411481371493504,14773584619001385251,524288 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6280,i,8618745924205079876,6774681920990962320,2097152 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6404,i,9354294536657255900,4397650196044058369,2097152 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,12699712364465386455,4802135243910538264,524288 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,15129328577398016191,16132774548481266215,524288 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,7713223588025139398,12582934474018712030,524288 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,2971984578664641663,14336422135107733424,524288 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6184,i,1343477676833109949,9254006171999139583,262144 --field-trial-handle=2144,i,6284854915731414172,12408293098822699273,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b82f3ed4d6d857ec07ec9208e2b4720b0252188b092045a9944c3bf4df2dc466
MD5 2fca869d7ed50b536ecd2d93f4589e0f
SHA1 85f04ab3ab5e3656ccd7dc5b241cadb7d23ae9cd
SHA512 612f9306b4e0a8bd9c445d1b4cdf9d1d2dd5c92ac76295b6aeb1fdba6fde5a8ebc06afadaf416b8ce69622e767cb5fd85f0a6e22e0f16dc33863adf3980129cb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1E3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 73fd4faaa2e0b99ee8f3ba97a85c327c1a914ee227a52ca5d6beced01c1c074d
MD5 edc51df2d6af090b246fcbf0d54a2736
SHA1 00206b4b202c71c3a4b377023b7bb9ac2da0b633
SHA512 ab183c2fa82c0825edfc0e64b1e56a44fc669a0573f148af3f27fdf741cba135e9892958b74602ae50423d930b99edda97228803348cfe294e87efe20625ac07
SSDEEP 96:IGVcS2N28MVIfjw6baQ7sPk0FcCbaE4pMHFczg07WDk:IGVchN28MVIfjwcpd0FcC+RpeGV7WDk
TLSH
T1E291097408698B52EBD001BF41F7FA14347682EDF8431E3BE1905E342A2FBA46726D0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58b59f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b59f.TMP
Size 3KB
SHA256 d62dbef503215cc5bc5c1046fe28325a0799769e3c9de4c9e02cae82a9e0d36a
MD5 b44af9cc1ddaa00a27279ca0d73afe65
SHA1 5e3c5fbba8fc2697ba4c2ed21d136cb662e92cf7
SHA512 4d5e48103ae172b68710bef77b31ad922e25468a7e552f6ce32e28ae8e652606d4e06e7f89229be5a84a7cbabf1cf4b6bfce1d45f33fb9afaa3747d4e8fddea3
TLSH
T1F8715E740D368FA2FBD001BF51F3E25574B582D8F4131E36E19056382A2EF68A1ABD4E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ssosv.sankuai.com_0.indexeddb.leveldb\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ssosv.sankuai.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d9b005dd5b5dcea7f04dd413bbc0af9059963fb596acb66f75a9642d696b5f8c
MD5 61edca51153661ed8591049284c4815d
SHA1 2116dea238934dc9cbccc5e53cf8673cc901a37a
SHA512 9a0284b5c431de0db534adb3283a00bd3f8d24532b4ef3b0fe4a97d10ccfe3ce895bcd7a44211d643f107f3b76b089e0067808d8438a9b688f99c406e97cc425
TLSH
T1097199F743B4866DEA1192F8AA555E1FCF1C0420972C78A9C5D86E1293F3471F00675B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e23ac4f69c5b766823c1a7d2620ad953d09c8cea8837566b1ab2b4294284dbe7
MD5 1e00173d78b9f9724d1c3089d37c9b08
SHA1 f8a6c753556c2d7b1078f63a333f7c7380ccbeca
SHA512 737c777d99b8107123132751ffd17e81803bc33058bdd0e0edbdad1840b1274aa1763399d93e9703d1d5e3c8f8247f63013a3b8b9d99f6e45c691e0148bfcc8f
SSDEEP 192:sxZwRkyM/jK1Ml8MkR/fhsNbtaqKIdp6/qHW6+WNRSvb/YCTdr33IgrJ:sxZwOMR/fhsNb8qDjHbY/Vn9
TLSH
T16652E8126A38A977CCDBD20DB951BF53D6F5147292900E58AAFC9A1C04E7BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 29f6dd7a6e694bc90e70515d023b0f964ef4df481dc84f3678f333e92bcca7a6
MD5 19dcf18a7a889b6eb6d744fadfd46d3b
SHA1 6653c1b2f499176c66bf63a26d48783b91b00a04
SHA512 02217f7abff487deb5407c2188013aeffe57f432c311bdb36f40c7c3cc705d0952d2988a9f11b49b2b0f98080b7b2f62e544a32d351804264152bff6093df9f4
SSDEEP 192:sxZwRkyM/jK1Ml8UQCckR/fhs6btgqKIdpg/qHW6+WNRSvb/YCEGr33Ig5XJ:sxZw2qGR/fhs6b6qDpHbY/9nj
TLSH
T1B452D7126A389977CCDBD21DB941BF93D6F4547292900E58AAFC9A1C00E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 221cec1a844e2b5ca6fb0b7a8b2c3a25aae0c17e37c69a0540cf4bc25cb62474
MD5 db5a26c29329b545d4ce1df8619eaf4b
SHA1 86bf434347665bdaa9799c9e1c1d37780cee74c2
SHA512 78496311f212c8fd3ec9efdd739a2915b3a536d0cfe7ba66e4a0a7e5af3e273375401c702cd2b21b27b41cf7c450409042544bd5ee647bd2e512e6d81933b0ed
SSDEEP 192:sxZwRkyM/jK1Ml8MkR/fhs6btgqKIdp6/qHW6+WNRSvb/YCZdr33Ig5XJ:sxZw2MR/fhs6b6qDjHbY/3nj
TLSH
T10F52D7126A389977CCDBD20DB941BF93D6F5547292900E589AFC9A1C04E7BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 aef5bab494a44d70254be177ca94e19479ee9f3227c89d2d8f91a405aef37dc2
MD5 4be70ab48f3797d8967096e2f6b5992b
SHA1 6313e105b5e3b1b7b4a1662ca9fde48dcd2ce8df
SHA512 e6a7069868b679b809957dd79bf6bc3a118a8d362f9f27a1191ee375ed8aceb2fdc585f82a423e71b8a6e649726cc65f7f43d02ad0a52566fe9041e5e7d1fee6
SSDEEP 768:qP8bqn+WvSC368F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKV1ro+:qP8bqn+WvSC36u1jaCZLbWVO+
TLSH
T1C1E20A3B280CCB7E4F845E5DDC26AF966DD801CB6B988D4447FA884C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3408e859335297ad9d4d5cd94b40d8db6bf9f6fdf323550d68637179a53ad757
MD5 6aab8223e4a21e98c0157e728f722c36
SHA1 a37edab77ad96d5afad36e5a60aee7148e71c101
SHA512 5106657392e2cec3492aaba56af12248d39681516cdf031b32771e74a86bee9ff4fc3c6f33c6bb10cb753723bbbfc2b2f46eda418c364371245544da690a18a7
SSDEEP 48:KQ5IZKSMkzy+FYf7t33duT6QIZDdKsc0NdIVNjCzMCI/KrCo3yFz:KQ5aKSMayawK7aICEKrCC+z
TLSH
T13B915F42B57F224138BE691891A5897BCE4231A37519A46F7FB808A20F76E110FFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62908088-1732-422f-81ba-b9bc79ecbc5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\62908088-1732-422f-81ba-b9bc79ecbc5e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 68249baabe26ff78d715b99d0f18e4e6846d4634d231c144647e78a25e4f3cc6
MD5 e15bae3bb7f6104e078f017187b76b5e
SHA1 9d37dfdd926fcda3c79354bb6110b978fd5366ee
SHA512 3536f48dff65c3b1331586e5b9fc4141c6bfe0f4ba0f874d0e78cf9d686859f122ce92081190fe4e5eaa61ff36dab3bc5c270edba9dd8a26f933289d4701d4c7
SSDEEP 384:UZcIhsNHd5Yaps93Ea++OrIEGinTKwBODNZOCXWJ:ShYY10a/OcEGinewBKZOiWJ
TLSH
T11E928D75693C6C725ED6B148F84B36078EF88173E6C92AA8D9EDAF1C00E655C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b7141c64f9f52a220521165dbe164970fe70c81fc9cab7492adbe2df53423598
MD5 cc9a94b16551979f6588132976b6a511
SHA1 0c03d4e3dd9d6b5acc0d96cefddb1e343c792287
SHA512 33b012a7cd1a646fd45060f1a40577458f48db94c57ce4095191791d33bece14fdb17bff4fea12783d58b5aa46dbcd531c0bfd42529100bb88a2285293a332ef
SSDEEP 384:XliFiZcImzsNZ8TUNTUlIlQ5Yaps23Ea++OrIE7inTKwBODNZOCXWJ:XsFQWkwg0Yu0a/OcE7inewBKZOiWJ
TLSH
T142D228F258EB8836D99E5747AB7E2D038EBCC063B5856654B79C5A0CCC961BFC30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 87e94ec4781f7a73b8cc7dd42363c1312e2d81fb1c28fc3f91d0d20e6ffc6870
MD5 781db00a0ae8779b40ef3dfb03ba498f
SHA1 1e91d6179a4f1e1ad9e34a7aa13c6e8c7a9658d2
SHA512 18ff67dff9b5e54357aa771d57a0537aaefd678040bf167ba4e035fc8d056b5f38557be6789d9115cdfa566af4dca90dd9330afd63230fb31753a6b194426599
SSDEEP 192:vONy6Db6QmiUy3vHBa+jiOm4HoxRgKiU6:vONy6uSHBa++OrI4pU6
TLSH
T11F020B3569385C779EE26E49F88737279FD4102BD9562B44DAE81F0C00D765C230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 235a2b790fe17f254feaf73ff55dc80c5941f03558763355c4372fb4596172e4
MD5 e81a35cd87c1c7c4c7f1b0d0edaa5828
SHA1 0f83465e164cf995f8175b18e536307888dc5e60
SHA512 b43a587bc5a9c8357f7458f25c13c83fd0f082fbee733822eae18c8d8f7e5d7840f1ccdedb9bbd4725209d3bfbcc24e8921851ade4b1002dfaba34aa09792583
SSDEEP 384:1ZcIhsNHQ5Yaps93Ea++OrIEGinTKwBODNZOCXWJ:NhLY10a/OcEGinewBKZOiWJ
TLSH
T10C928D71693C6C725DD6B148F84B36078EF88073E6C92AA8E9EDAF1C00E755C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5d7d70ba476e0d7fb7a98af22ec9f1853e1e42dfb2f6365b04130a7f8921672c
MD5 d40fd7a304ab5d4b810694b9c5a99014
SHA1 54f50802d3546d9baa84a619ee97ef8f06a6a5c3
SHA512 b525a0968403a5264284909e1b5735c03fbd7660a0260f60bee80cfaa6ccd41b79470dd5404eba3a21542e069ead5d2241f401f4e248082d40e2da4b34ae5154
SSDEEP 192:6ONa6Db1QmiUyEvFBa+jiOm4HoEGhNzfqNU6:6ONa6L3FBa++OrIEiiU6
TLSH
T12D122B36697C9C735DD26545F88B36139EE44127DA8A7B94DADC2F1C00EB59C130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cceb63e8-0954-4c6e-936b-87e0fe449ff8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cceb63e8-0954-4c6e-936b-87e0fe449ff8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1ef3313e18832f6012d887c0de41c6553ceab9b49ff46c5e77eb4162299fd41b
MD5 8d497646665eddd6f3e0d08db9b0a94b
SHA1 7c4db0c3a9f69fe1e7ab890b84a56d95a807c2e3
SHA512 6a4b52772819225684329dcab83bf8a13698d3d1359b264ad654e26fed2804caf5dec606f7cdb7021a26e3b587ded3b1a998cba4250be75808434e81337c9eb2
TLSH
T15141D968BAFA1144B3B37E566BF6B96D847A79772E16D09E10010E4F0A62A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download