69c809d4614eac589dc817e2e397734c8252acaf45b4c5e04fc3d62e590f96e5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EduSite.html
Size 3KB
Sample260824-pg3yhas1hy
SHA256 69c809d4614eac589dc817e2e397734c8252acaf45b4c5e04fc3d62e590f96e5
MD5 aa9008e3a4e417a7bff6dc056e464512
SHA1 cc9ef9847c4564372cb2415c71247ba1b129052a
SHA512 e28f4511c67e3bf5e3ae9c5eb91f65fe264fe208f59f3cd4e26da12b88a062c911a2374cba80b12e89c0a5cc5f1f42fee63f043c0e5d8ad261dcfdff0cf8b29e
TLSH
T1DE81445DA6B31522753390A92F3777033261AC03D409D92937DCF2E8CF91A9CDEA266D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4888	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320475407001852"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{AB450186-EAF2-413D-9E50-FAF1A78B5136}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 3944	2444	msedge.exe	85
PID 2444 wrote to memory of 4888	2444	msedge.exe	86
PID 2444 wrote to memory of 1288	2444	msedge.exe	87
PID 2444 wrote to memory of 1288	2444	msedge.exe	87
PID 2444 wrote to memory of 1288	2444	msedge.exe	87
PID 2444 wrote to memory of 3464	2444	msedge.exe	88
PID 2444 wrote to memory of 3464	2444	msedge.exe	88
PID 2444 wrote to memory of 3816	2444	msedge.exe	89
PID 2444 wrote to memory of 3816	2444	msedge.exe	89
PID 2444 wrote to memory of 3816	2444	msedge.exe	89
PID 2444 wrote to memory of 4028	2444	msedge.exe	90
PID 2444 wrote to memory of 4028	2444	msedge.exe	90
PID 2444 wrote to memory of 4028	2444	msedge.exe	90
PID 2444 wrote to memory of 4368	2444	msedge.exe	92
PID 2444 wrote to memory of 940	2444	msedge.exe	93
PID 2444 wrote to memory of 4368	2444	msedge.exe	92
PID 2444 wrote to memory of 4368	2444	msedge.exe	92
PID 2444 wrote to memory of 940	2444	msedge.exe	93
PID 2444 wrote to memory of 940	2444	msedge.exe	93
PID 2444 wrote to memory of 3932	2444	msedge.exe	97
PID 2444 wrote to memory of 1820	2444	msedge.exe	98
PID 2444 wrote to memory of 3932	2444	msedge.exe	97
PID 2444 wrote to memory of 1820	2444	msedge.exe	98
PID 2444 wrote to memory of 3392	2444	msedge.exe	100
PID 2444 wrote to memory of 204	2444	msedge.exe	103
PID 2444 wrote to memory of 2016	2444	msedge.exe	104
PID 2444 wrote to memory of 1840	2444	msedge.exe	105
PID 2444 wrote to memory of 4748	2444	msedge.exe	112
PID 2444 wrote to memory of 4748	2444	msedge.exe	112
PID 2444 wrote to memory of 3744	2444	msedge.exe	113
PID 2444 wrote to memory of 3744	2444	msedge.exe	113
PID 2444 wrote to memory of 4424	2444	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\EduSite.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb3667c188,0x7ffb3667c194,0x7ffb3667c1a0
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,16434477686944540504,15438564305257083724,524288 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,4919505802172266219,6019543332420674017,262144 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,12585722596006593904,11556323969658618325,524288 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,4950813986235360191,10813035724649123931,2097152 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,8368391704469148571,16458678247420229295,2097152 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,10795015233893160721,8772353302267502535,2097152 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,16165600141116430666,10174366590212597332,2097152 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:2
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,4847690420406292353,1797662721091765704,524288 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,3547514139288341312,5221800622281858265,524288 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,17993515743169747977,12710952115744031085,524288 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,17993515743169747977,12710952115744031085,524288 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,11968330319016902818,10320924202145380905,524288 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,17172276474016639332,12898769756152497161,524288 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,16118512700605890747,17290553808935792993,524288 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2192,i,15536539577975613304,2745141891236528533,524288 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,8033037258409559217,6561174128514453998,524288 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5348,i,1250234460093802107,15814892772879630670,262144 --field-trial-handle=2032,i,10381255331274452466,13899850149808944208,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c46a599bfe691a65ee08d32eef932d4fe01d353bca89af43c00b4e1fef40046c
MD5 e2b99abdd1684b24e0ffa24c42e58a7c
SHA1 ba9fb65d8d4cde684264965dbe4e72eb548f6e02
SHA512 281278740e3bb4942ea61d0017a641cbf9d450b8e166b15fd08a2ab2d2d6e53ea990f82237d1cd185580eba8a5af0eec1774a0e043697c9f1b95bc414ebf4e3b
TLSH
T11661605B0216EBB7D329C930E3E22505BCB281150A2B1F7352818A7DDF31BE7B16621C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5892e4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5892e4.TMP
Size 3KB
SHA256 6a359d68c26722875fff5dfd853ea03e4f5bba25b042ea0950c42e7c9c3c6464
MD5 3baee128eb27b7d9ebc2037a165385e6
SHA1 a6ff50538ef0ae508e74ca795285107cd7af1955
SHA512 701ca9d39ca54c1d09047d95f8af26a8531ff3d7280ef2e6452c67a918f01f1f53654890dec641652534801d6fd501dec4568c4c447cee58aeec8e4261abfd9c
TLSH
T11861715B0216EBB7D329C930D3F12505BCB281160A2B2F7352818A7DDF31BE7B16620C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 d6b9fea7ac9890274ca85229f57b54621d03ad1fe3378d93a5c0149ea225b2f8
MD5 f695bac70ada156685ce36e6e2a7fc14
SHA1 bdd83d332045aee2528ba5c8abcbd702dbc8d9f3
SHA512 b2059693b12c7920e9d6798897c11352f7a13eeb64ed801d5fc7f5a241f1f7d57e06ae5d5a8f7223ef879881874d8ef8c2f97d85fc80698b8526b05044935a08
TLSH
T10E117DB3C7D5856E8D0157F09A24AE2BCE2D0506421C7C15C5D4FF2793E3079E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 290edab8d282ed3f1df88b25377c6f1b2c5cc63fe82ee5c02f3e086905188ffb
MD5 f68318d3e0765ae0fd773a6ec88e71bf
SHA1 9f685eac90e2bfdd26baa00f6f54c98da9dc8223
SHA512 caaedf05fc2acd6cd4a604e2b68ed37264849340db3a03a1f2114f31e62e3d344e3167854ff8582196935bc13c456023311ed5a3edf24820b13902eff999e22f
SSDEEP 192:sxZpRGyM/jK1Ml8MkJ/ftscWxuIdpd3HW6+WNGY4wbk3IgrJ:sxZpAMJ/ftscWx/hHbG39
TLSH
T17542D811AA386977CCDBD209FA557F53D6F90462A2900E48A9FCDA1C05E6BEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ba86f9ce0bd91bc56137fe13b67355b289a4f4007ac5e2086388a32f974470b7
MD5 e274af91c016dde0a052d6ed0bb00093
SHA1 252a2ff0368fd926c1e6b29f1e25884da2846d25
SHA512 55079614cfbf06da4d789b86fa07e92eab2a3dd24d8113bd4ff897236774497c5e9319fa6e6877ebf3a4d7faa8e08cf5ac135af79137782adf81c5a899ecef61
SSDEEP 192:sxZpRGyM/jK1Ml8UQFkJ/ftsOPxuIdpH3HW6+WNGY4LMk3Ig5lJ:sxZpAqOJ/ftsOPx/XHbGh1
TLSH
T17452D711AA385977CCDBD609FA957F53D6F9047292900E44AAFCCA1C05E6BEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1eda382d45d38bd56447b36583b683f6413ea2d95728af94c7fd2914d4949352
MD5 e87a06148467006f91d6f862f458ba9b
SHA1 7866a1034ac57ef1dc86c436594b5a41bd979ff8
SHA512 283a3bf1140d0ee9747f3acc23ac353b7ebf387ab5c267d4d34c5eb289c844f8dce8d5bd3172f0d3b3442954deba7613ae68c4b2663c0e99fdf73d811246fb10
SSDEEP 768:rb8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdgroekrUnD:rb8iJPNWvx76ru1jahALocdr9UD
TLSH
T184D2FA3B680CCB7E4F844E9CEC266F966DD801CB6B984D5447FA884C03C77EA512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1afcdf39c8fa0a07bff6295c83148a4c476d543762f8dfb8af6f286985c0fdf5
MD5 5b904612726aa6b7870ce6374d075064
SHA1 d19d5e670d205dec141b977c27564ddb19b82c71
SHA512 94afe7f49b05dc050f0c767b6f0ba56e5392c8e0ecfa1f2bc65e20b49ca7acaecb31fbf0e28432ae76978c6271d2043941a7b05e2ba99ec97273feccc6e9fc27
SSDEEP 24:KdeXKmfeXKJeXK6eXK7aeXKodeXKceXKIeXKk4eXKceXKo+eXKPIjeXK+eXKkKiD:KwfIlKoK6IfKTiELyp4IXKRGctDIVKoA
TLSH
T16F91230271FF42263C7E2518A26587369B417AA3305CE42B7BB954F10E6AE340DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59309b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59309b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c1f751f26d355aaa0e2cc8917ca5105ddd17c52aebe972d067b7e9498bef6110
MD5 2b48f18420750608be09316fa042951e
SHA1 a8ae87ef5a5dc2fbe1d5655a76d2eb1e12701bde
SHA512 25b470e686c8bb2fb099078ef331c44232eaa69af0af9de199b78fbaac6d902e67d8e54d47f9287a6211ca496e79977074a54beae14f2508657970cf478b0997
SSDEEP 192:utRm+xasuheOwQxMGsNAdQoar2CmYMQmiU1Nv44k03bb9zUNEjNLI2qaLt4/tyAM:vZcIhsNAdb1H1THkqbFUiWeLivC3poo
TLSH
T136829D712C78AC765CA3E541F4463A1B9FB88067D7C96F84D4ECA72C06DE698130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 3b6fecc882d3cf82b735fa24e0a7fad404f8ad3fc9ed9f6c463c183383c6ad9c
MD5 4ef8f63cae62e4169539fcb3bef92214
SHA1 8be05c60a1d7371d3e63115cbf10c08b4f427d5b
SHA512 bdda043addec45ac27d11058a99dda1b395b90044e0fc3c9a9e4caa540a28a2684c622254f889c5f4bf9828f3d6f386423a5625531fcd75dd5e20d656bf52e1b
SSDEEP 384:hBiFiZcITsNA8TUNTUlIlyb1H1THkqbFUiVeLivC3poo:aFQTBwgWlbV2iK5r
TLSH
T17FA27D735CA8D87BADA7DA41F54A36178FB48077CBC9AF90E6D89A1C01DA5DC130BC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8d35bae7f10f1f7686e0c4773835902544ef1ee434aaa7a9595a429852e404ad
MD5 f28a13f793a9dfb2720cd75edb385294
SHA1 caacb338215b3aa5a04fa8df12d03455f02d7082
SHA512 c746b0c6325c0ecd785a65331c9890433f14895c48605032b55bb8b1d7939bd7ab9eaac938d86a642aedbb1d3663a7805709ecc396119336305448bf6189b362
SSDEEP 96:ZqONkxQsjpfmUTmDK5ih/cIPURHl8h4otop5S5D0BhPwivh50xy0SFYK4AxYYCbx:gONZ6kDfQmiUys4Z903bb9XQihCCU6
TLSH
T15D02F935A8786CBB8EA3AE49F48777175FA8113BEAD52F84D9E81A1C00D765C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 31c90f1d3f7f653e2cb626ebd3d8d764a38998bc1e0e93fe511cc183d3639825
MD5 3388366173f0538f5b7e9e585567bc60
SHA1 5be1e92851831248ceb4b3d5b472b106e988c3a4
SHA512 64c54797467472874d713a5b8d32fd08695cc1ab99ed37c462674be7eee9f74394472f59298836b4d4f42193ff6c9f743c82fd0bc49ebe712206591b456dbfbe
SSDEEP 192:uJRm+xasuheOwQxMGsNAyQoar2CmYMQmiU1Nv44k03bb9zUNEjNLI2qaLt4/tyAM:rZcIhsNAyb1H1THkqbFUiWeLivC3poo
TLSH
T12E829D712C78AC765CA3E541F5463A1B9FB88067D7C96F84D4ECA72C06DE698130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 baa56d52aac5e9ccf9641866a366e61c4a60bf9a8bd9d842c769d61a3472724c
MD5 04fc731d785fb3a709652a12eab6d70d
SHA1 871492d729486e341f64f52d542a087be14b7daf
SHA512 751ec04ddd9f56b58ace55d5d0ecca273e8f96f063979222e12c94613983ff4539eade7ce8e3121179075a2ce93573b5cbf0bbff5e3fb055b3faccaa666eb70f
SSDEEP 192:+ONZ6k9QmiUyo41903bb9zUNEjNcR2qaLU6:+ONZ6C819qbFUiueLU6
TLSH
T134122A32787CBC7B9DD3A955F08736175FA84127EBC96F81D5E82A1C02DB69C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cc4c758eaf2a919b27da1c9857df86a293d4dcd91aa34b993525766cac5b5739
MD5 8844d2fad19b071bc3927f50b5597c5f
SHA1 e2b171c5d1569acd84cf741caa5bcccd2ba8c827
SHA512 2637a6222005885c558e77bf3950c7aa3c3296e6ef56930fb8e1b01256f0b27a617f9220691ea48ea34d6d7067be2a237a6e3342a2c4899d074229f64f7a17eb
TLSH
T106412758AAE90158B7B77F5AABF7A86D447FB9372E0AE15D10110D4E0A22A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download