hxxps://central[.]github[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://central.github.com
Sample260813-mcdrpsab59

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4012	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310899438758285"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{091AEB3B-598E-4BBF-930B-ABCF96E1318B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 1156	3828	msedge.exe	86
PID 3828 wrote to memory of 4204	3828	msedge.exe	87
PID 3828 wrote to memory of 4012	3828	msedge.exe	88
PID 3828 wrote to memory of 4204	3828	msedge.exe	87
PID 3828 wrote to memory of 4204	3828	msedge.exe	87
PID 3828 wrote to memory of 3664	3828	msedge.exe	89
PID 3828 wrote to memory of 3664	3828	msedge.exe	89
PID 3828 wrote to memory of 4760	3828	msedge.exe	91
PID 3828 wrote to memory of 4760	3828	msedge.exe	91
PID 3828 wrote to memory of 4760	3828	msedge.exe	91
PID 3828 wrote to memory of 2936	3828	msedge.exe	92
PID 3828 wrote to memory of 2936	3828	msedge.exe	92
PID 3828 wrote to memory of 2936	3828	msedge.exe	92
PID 3828 wrote to memory of 4748	3828	msedge.exe	93
PID 3828 wrote to memory of 4748	3828	msedge.exe	93
PID 3828 wrote to memory of 4748	3828	msedge.exe	93
PID 3828 wrote to memory of 2136	3828	msedge.exe	94
PID 3828 wrote to memory of 2136	3828	msedge.exe	94
PID 3828 wrote to memory of 2136	3828	msedge.exe	94
PID 3828 wrote to memory of 1964	3828	msedge.exe	98
PID 3828 wrote to memory of 1964	3828	msedge.exe	98
PID 3828 wrote to memory of 4292	3828	msedge.exe	99
PID 3828 wrote to memory of 4292	3828	msedge.exe	99
PID 3828 wrote to memory of 4780	3828	msedge.exe	101
PID 3828 wrote to memory of 2612	3828	msedge.exe	104
PID 3828 wrote to memory of 4244	3828	msedge.exe	105
PID 3828 wrote to memory of 4656	3828	msedge.exe	106
PID 3828 wrote to memory of 4980	3828	msedge.exe	110
PID 3828 wrote to memory of 4980	3828	msedge.exe	110
PID 3828 wrote to memory of 2464	3828	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://central.github.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9e8d6c188,0x7ff9e8d6c194,0x7ff9e8d6c1a0
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,929330384038502198,8742360776139222853,262144 --field-trial-handle=2292,i,16308850257079319991,13239410681143313179,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,2677162821983709037,17013556819187725980,524288 --field-trial-handle=2292,i,16308850257079319991,13239410681143313179,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,3122198120376759566,11326855559575717261,524288 --field-trial-handle=2292,i,16308850257079319991,13239410681143313179,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,8852479253074167189,10208882209595458835,2097152 --field-trial-handle=2292,i,16308850257079319991,13239410681143313179,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,12756364512462323587,2939527627573258178,2097152 --field-trial-handle=2292,i,16308850257079319991,13239410681143313179,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,3628245024435636205,1173398541760403866,2097152 --field-trial-handle=2292,i,16308850257079319991,13239410681143313179,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,9123386618800404952,16966669614424493790,2097152 --field-trial-handle=2292,i,16308850257079319991,13239410681143313179,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,928618174796878129,7884721530560752569,524288 --field-trial-handle=2292,i,16308850257079319991,13239410681143313179,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,6493521663521897880,15490104361147614706,524288 --field-trial-handle=2292,i,16308850257079319991,13239410681143313179,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,2848275592802258523,15662320088164912087,524288 --field-trial-handle=2292,i,16308850257079319991,13239410681143313179,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,2848275592802258523,15662320088164912087,524288 --field-trial-handle=2292,i,16308850257079319991,13239410681143313179,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,11695151009987426411,12775328049878291130,524288 --field-trial-handle=2292,i,16308850257079319991,13239410681143313179,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,13554994533017744510,14598021497386100762,524288 --field-trial-handle=2292,i,16308850257079319991,13239410681143313179,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,15545009654024432722,10481324612739351857,524288 --field-trial-handle=2292,i,16308850257079319991,13239410681143313179,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,13198149387610035510,12010547807914628665,524288 --field-trial-handle=2292,i,16308850257079319991,13239410681143313179,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,7027112523748471393,2866802724659463121,262144 --field-trial-handle=2292,i,16308850257079319991,13239410681143313179,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dd93834da96bc48df415033553eedf80bf463830fefe71342451e6e1b32c7df4
MD5 4c06f574572eee1673951f747ca76821
SHA1 df69bd0102f053e4561f41f282f3f7737318c3e2
SHA512 c1877b6b3b78a0b4cfbfb13ce0642e895f7d5d2c05e2baa9946f294b3c71b3059f0ab80b410a2b047739a8cd8e0e70440e81f617957ffac4b11ed7e9d358fed4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
TLSH
T1C3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c6d4755170d18928bb74f13c403757e0855b0abdf3e21f5385c01eeee6a067ba
MD5 a00c95f3713f61483b7371b13f53bb50
SHA1 ee3b6ebc10e6da4a7e2657dced6c9aa838c39b28
SHA512 94af4e25e928793b820b75fadaf8518afcaf2deb079dd1fefc751444be6c6f6df186343325ce3771031ebaecb58a055d7153569aec5613193135bbd5314461ef
TLSH
T112713A58069209DDD3503230EDEE1F5671318BC42F5B4E023F7488BCA5253F389E28E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589a47.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589a47.TMP
Size 3KB
SHA256 05c7c8e11cfb28ac42a299a9e6d8a20ff1d10f509acd7041093df9364dfa2d8f
MD5 1da5fa0a36cc364e13a8017e3400c234
SHA1 e48df2d240485c7fb3f0dfc5872f96c7e2530023
SHA512 b87f99794158f71773ddd06a3e1ae95b44b4c602e739fbf6f0e4f95e11d01873f7d1d5ec348e38342bbbf875d008742939815c969701dc3c23df34037ee70352
TLSH
T120711A584A96099DD3513230EDEE1F5A71318BC41F9B8E023F7488BDA5257F789E28E4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 29fffa078500e9665162d094f10426e95d49225da28d3623a15ba38ac9195c5b
MD5 d60a94f24727de7e09e408ca6730fa78
SHA1 74506b66d6689c891789d6b7d3e451eb0f7e61f2
SHA512 6f45245721761502ee340a970855cb77625c1e61e716ff5e30fb50a2c238bc323e6900907a2e8a3d1ec634ed6289a3fbddb3a4ecff4e47dda05e2a7a0d189f9f
TLSH
T117116DF383E5956E8E1116F06A24AE1BCE1D0515431C7C1A89D4EF67D3E3475E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 dae5342c83d3a4fa0018243e3746759299773c4597c159ac7436a8683432655b
MD5 6c7845d03254a9a02e288d2cdd00d4ca
SHA1 15ec77ce2bbb5bcb8c543560f7e63a1501315584
SHA512 992ffe1d327d3a8a9e6ae7f42599f1461df77862f256386ae98552f5d4be748f313cc25d2b10b4bf09aa35abd4821eef76fc473cec0fce54d73993d8bf394a6f
SSDEEP 192:sxZhR/yM/jK1Ml8Mkn/fJs6TErDIdpDVHW6+WNNaS/YLL+CUIgrJ:sxZhlMn/fJs6TErc5Hbt/99
TLSH
T14E52E8116A346A77CCDBE20DBA45BF53D7F9456292900E44A9FCCA1C04F6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 350e92049a57d31ae936fe759d82ae143036adb3f0176626deeca80aac1874d0
MD5 598f3b8cbdf0920b6625d6535875edd8
SHA1 59ceac23f18936e8d4f0dcc572f4f74412ac8136
SHA512 e1f406ae337a6c51d879eb229adc38502bd0c95e23ef974f5e192f49899c4b3d155f021eecbf0b1c64ae96cced6c5438ed440d546b1aecf8781e6899ca90a77f
SSDEEP 192:sxZhR/yM/jK1Ml8UQlkn/fJsLTEADIdp5VHW6+WNNaS/YLvFKUIg5NJ:sxZhlqun/fJsLTEAcjHbt/8V
TLSH
T1D952D7116A345A77CCDBE20DBA55BF53E7F5457292900E44AAFCCA1C00F6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1e44f6e2cbeb0a2bdc1d02b9311324f845df4128bcb5a3513fea71a5aaa3a019
MD5 9359742cc26a5f02f0b4578123e21e38
SHA1 9e293655ec0dea98a0908da2bf17561a0d6fa470
SHA512 5ae52ab9358bdfb0a78ad255456a8e79a6b9e60a527bdb4eb48b0682b6fd94a8e02b7686afabd30424f104b837d99a9278ff4d9711b065dba429e1cf07ee366a
SSDEEP 768:Zts6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJN2roO/c:Zts6pD1WvxzWju1jahILIsNNO/c
TLSH
T119D2FA3B680CCB7E4F841E5CAC2A6E967DD801CBAB98899447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 2eba937405b6ab11255c1c1b887ac96f7336b4a7c7c5c28ac951b9b6d84c06cf
MD5 0692b6faa3bae5d566901197c9e1ff09
SHA1 bfa0f95ae313da74a1a0df3a1fc0645ddbe66297
SHA512 6fe0e41850c9425214888e0b11aeddb30601a2d90f3a9a1a7e2adea30f3c08401daea21750b1b1e7180265d4e3d618df733daaac79f9c7f5439f36801ccf3ff6
SSDEEP 96:KUAAKtePe9OKW06aMgKtS6ioK3K+qKcKD6L:iiRlHWr3w
TLSH
T1F8E1270231BF0A123D7E6B199255877B4B92B563301DA42B7BE940B14D6AE380DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a543e2ad-ded2-4dad-be00-90cdb87b57dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a543e2ad-ded2-4dad-be00-90cdb87b57dd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8b9ec05851ef3fb07463355d2ffa2a06a9f0b99b833e5fb166f2ba22bbabffdc
MD5 09a9d5291d93e89571da455bb3dd0d3a
SHA1 c2598c2628326b8f3d8838f18fb01cea6ed2aa26
SHA512 fbd331c74e40f3ab832875bb1b2a87460ddf9c45d67ae717c859d935f8ecc66d1147e17b6d20c5a4a6a24c4090063fd9fe0eca5624956b511b20037b0e71b8a0
SSDEEP 384:JZcIhsNNFUTfZGFOQa9xOsHeDfOOPrXLpe8C/XBe:BhQOZrOqeDfOi9P8e
TLSH
T106928D7168786D625DF3F682FA8626079FB84067E6C52F84D1ECDF0C00DA5AC131BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5a5e6139c5d659869b7d65f9978199463256fd448d08315ef33405603670c0b4
MD5 390bd88799eefbb9878a3802e8136893
SHA1 a14c1774c761c123815dc1c895196fd7706ce1dd
SHA512 d108a3c2bb9494dd9f8bd532e0ee41b37a81199d58be1f81b526cac936e16ddb95f0b0b960ee8deb126db38605394c2ae9bb5dcfe0904f14377ba7f31978b4e3
SSDEEP 192:qONQ6O7+3hQmiUytfGttb0sO2b/WgGxrU6:qONQ61+Gt9xOsIdU6
TLSH
T1BB02E83578686CB78EF2AD45F68B27279FA5107BE9952F80DAEC5E0C00D765C2343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 691ea0be9bbcf469713e8dcd9742aad1d113aeabd60fcc0a2d1269a5f9b5db69
MD5 0e24aae046d0a7f4cb9aec94b8d0097d
SHA1 180451844a9a0310d9c642ea41f313da79ed5603
SHA512 7816a372ede19fc3dfebe5cc07ecb61ed2b0bb7d48102740313914d04dfa37c8fabba4f87f0323f7ee519937ab8a8ef9ae580be34e5bf83f12249ff37f1ddb0a
SSDEEP 192:1ONI6O7+38QmiUyJofQttb0sO2b/H5ExcNKq2IU6:1ONI6SGYQt9xOsHe2fU6
TLSH
T159121A367868AC774EE2B545F98736178FA5016BE94A2F80D5EC2E1C01DF6AC234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 cf5d3cf8741cb6acdef0f72f9c9be52709611dd189410a349e01bbc583d43ec3
MD5 4cb74fb30e0f7ae03f7e306a881bbcfd
SHA1 91a3e55cdcc9c147ee5224f3ac9b9adce5177399
SHA512 3015e9ecea3be13429b397d22f05fa68a3a5805a2d88654c5aee29d496374b3239bf82f1ccc8c2b4b06bedeab0ea37f843f099537ad281ea07283703ca0352d8
SSDEEP 384:eZcIhsNNIBUTfZGFOQa9xOsHeDfOOPrXLpe8C/XBe:chROZrOqeDfOi9P8e
TLSH
T11C928C7168786D625DF3F686FA8626079FB84067E6C52E84D1ECDB0C00DB5A8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0df80b3c0fef9f6e62aca8ff7d3571202978ec12340db2aaa6e6a7aa40e28703
MD5 9ed75f77820fd48c903a1f3e6d458b99
SHA1 a7d0b37e1aca0f299f5000b62d0366f4e58b58cb
SHA512 1c305557cec1ac43e33143c202466245ead026da4a934cbcf087c72d70be7342d55f03fb1491897d28f09e59d7684e4ff91279fc60894432c50f7f64f0f68718
SSDEEP 384:CiFiZcIPsNX8TUNTUlIlIBUTfZGFoQa9xOsHeCfOOPrXLpe8C/XBe:JFQP6wgQoZrOqeCfOi9P8e
TLSH
T133D22AF258D79936D9AEAB43A77D2E038EBCC067B5915A40B39C990CCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e25c7a3-6931-4dc3-a1ef-37528ae18019.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3e25c7a3-6931-4dc3-a1ef-37528ae18019.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4fac88426b089edf6456672ecc5d198a04c9effd0cb8856ff0ff112d62c9dcd4
MD5 1d3568786cc2ac8902d9684c486763a2
SHA1 3e3090591bae06bc0ceec75e8e558d5b56478b87
SHA512 4accc5d9ffc638a845d03633241d7e5e55d4e121b304fef988765bccdeccc289ae3154f9e91fb660852a0da913d26e7b8000fcf43402f9dfeb34d964b60ddd05
TLSH
T13741285CA6ED1108B3B77F569BF6A96D487ABC772F06D49D00010E4F4A66B41CCA2733
MD5 SHA1 SHA512 TLSH

Submit Download