hxxp://waveschool[.]lovable[.]app/

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://waveschool.lovable.app/
Sample260909-eshrlabl4s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1532	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334007401677936"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{B9CE61A7-5D94-4B5A-A346-8FF2060F5C98}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 4740	876	msedge.exe	87
PID 876 wrote to memory of 1532	876	msedge.exe	88
PID 876 wrote to memory of 2148	876	msedge.exe	89
PID 876 wrote to memory of 2148	876	msedge.exe	89
PID 876 wrote to memory of 2148	876	msedge.exe	89
PID 876 wrote to memory of 4452	876	msedge.exe	90
PID 876 wrote to memory of 4452	876	msedge.exe	90
PID 876 wrote to memory of 2504	876	msedge.exe	91
PID 876 wrote to memory of 3456	876	msedge.exe	92
PID 876 wrote to memory of 2504	876	msedge.exe	91
PID 876 wrote to memory of 2504	876	msedge.exe	91
PID 876 wrote to memory of 3456	876	msedge.exe	92
PID 876 wrote to memory of 3456	876	msedge.exe	92
PID 876 wrote to memory of 2808	876	msedge.exe	94
PID 876 wrote to memory of 872	876	msedge.exe	95
PID 876 wrote to memory of 2808	876	msedge.exe	94
PID 876 wrote to memory of 2808	876	msedge.exe	94
PID 876 wrote to memory of 872	876	msedge.exe	95
PID 876 wrote to memory of 872	876	msedge.exe	95
PID 876 wrote to memory of 1536	876	msedge.exe	98
PID 876 wrote to memory of 1536	876	msedge.exe	98
PID 876 wrote to memory of 1536	876	msedge.exe	98
PID 876 wrote to memory of 2536	876	msedge.exe	102
PID 876 wrote to memory of 4836	876	msedge.exe	101
PID 876 wrote to memory of 2536	876	msedge.exe	102
PID 876 wrote to memory of 4836	876	msedge.exe	101
PID 876 wrote to memory of 4060	876	msedge.exe	104
PID 876 wrote to memory of 4588	876	msedge.exe	113
PID 876 wrote to memory of 1904	876	msedge.exe	114
PID 876 wrote to memory of 1984	876	msedge.exe	115
PID 876 wrote to memory of 824	876	msedge.exe	117
PID 876 wrote to memory of 824	876	msedge.exe	117
PID 876 wrote to memory of 4472	876	msedge.exe	118
PID 876 wrote to memory of 4472	876	msedge.exe	118
PID 876 wrote to memory of 2788	876	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://waveschool.lovable.app/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x248,0x7ffe4559c188,0x7ffe4559c194,0x7ffe4559c1a0
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,14651393856973301972,10605727369098437742,524288 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,748837581554533750,9287904247661798739,262144 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:2
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,2233579498483142521,7140086925107431111,524288 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,17595400405411567222,1280072245509029293,2097152 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,2577107037293783571,17148273007749878853,2097152 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,108924093165894273,16552594759465500253,2097152 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,10230281303786003207,14857208835760944080,2097152 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3596,i,13140683506281389527,17160174619355954697,2097152 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,14721800224014346789,5767244934061178672,524288 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,3295970595949662924,10315689650669293552,524288 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,5444912625402064354,973722539792629651,524288 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,5444912625402064354,973722539792629651,524288 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,16824789514163339383,420824929388148868,524288 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,15113076608241683470,938804172717116192,524288 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,10875754198368754646,5195285839738932641,524288 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,14672940566256383181,12847936141497585435,524288 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,10558805560431016107,3245230320569262793,524288 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5252,i,12345288609841158578,10061933009608079612,262144 --field-trial-handle=2900,i,9692654175613427945,3654401539441966517,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 21916bd4ff5d8352c56dee6a81be174493beaf79015a1cd73bf87d3641937777
MD5 3c64d7d928426c0990a1d275b3d712c7
SHA1 ee73164dabf406188415054f8478e3e0a735499b
SHA512 8362ae4d667e7f8e36014d289a1d224e820d3aa7afde9c1a3cbb3f608d045c8478266170b54db3988b0ce2ef11cec1d52e8dc8464fb773f77e3f48575752d729
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7q:fwUQC5VwBIiElEd2K57P7q
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6496c287ab952104f6b9a41bda8420c4059d1637dba9b8f1060dd1053c0c9401
MD5 01155ca8f4df5fcad3ca64a6ab405256
SHA1 e0cf2a803c2f5dd7ab66c40a6982254746850e79
SHA512 b0c842d69be2164424b9466f5de2e35cd224c01bc9120e0163bd428d014c4d3a753146665ba23bbddd2b6b3045fef2060a3d706dec03bc1b49e72760f671b9a6
TLSH
T121714C3B26DC9EE8E35103713CD2C209F1B182D9FC979FAA7254C4B31915B11836EDA8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d56c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d56c.TMP
Size 3KB
SHA256 491993eadca9458e8131d4dbec7fa76ad26dd9249939630099b143bd6a645157
MD5 fb303a20d840f6f67d2a09655536d082
SHA1 0fb02e41515ccb900e6fb6b2a8eae5bb65d2e523
SHA512 23c33f72039d3914ab6fb09dffadfc3e6e99228cad505d76e7f746858b97e62132e0fdcbe5dcfb65743e2b6bfa5def1bf84980c902ede6d71f005d109d072250
TLSH
T125713B3B36C89EE8D36103B17DD6C248F1A182D9FC979BAA7294C4B31915B12835EDA4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 98f56b49a818dabd3c675eabf8ab2528ae551d369714e07a2e40d5f5ce7afa7b
MD5 30b6b735e6f8352bf84119d9db9f471e
SHA1 52644e4235d1ea553b3bf8b1b61d36c2423ceba4
SHA512 dabc8fe065777866c937f6c8a93e00db25d3d9ec1c7f13ed266ba7ac32e63ae0f641f72e434da78842f3927e357966508ca3df3ad80bbf6b7d828692c49890d5
TLSH
T1AB41ACB386E4C96EC8015AF4A724AE1BCF2D05114B2D3C1988E5AF9B93E3471E14074B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9d6416111a99db6694b61e2ce71b2b8e5c169d0b8bf0bfb6012b65981297d021
MD5 f452c9d83460e1babbf5b9dae72e2a6a
SHA1 3278e9a0ef4840f2c2d3ac08dcc2cc7522062e96
SHA512 20698540bc8e72a59b8ec70d9686179012d49f37f454ac2cd0c9a9a9c1b8b66dbff16e36c6055c6162ecdd2284021d490a5d6dc9c81dbc0eb72f108a3d4de75c
SSDEEP 192:sxZ4RwyM/jK1Ml8MWN/f1s6BIdpUNHW6+WNDET/YCct/yxIgrJ:sxZ4quN/f1s6q8Hbg/Y49
TLSH
T10242E8117A34AA77CCDBD309B955BF53D6F9057292940E44A9FC8A1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 99d7e97132e5a988cc37be3dc41c5b518588b6f405a5b6da770301a0c945f0cd
MD5 ce835084744f1a01086da54832cb8f58
SHA1 42d45e42edfd5c977734d4c1f629b7ff1148bc25
SHA512 196dd4a15ca391e5d8195c7786bce6c992ce47644522ed4c24dc8dacb2deb5553b51085ffae29c54c9c0436095bae3dfe05d35a8e6c9819aada4f7998597a529
SSDEEP 192:sxZ4RwyM/jK1Ml8UQOWN/f1sbBIdpKNHW6+WNDNKFYCs2tyxIg5YJ:sxZ4qqZN/f1sbqSHbsFv4S
TLSH
T18A52E711BA34AA77CCDBD30DB955BF53D6F9057292940E44A9FC8A2C01E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5a3c111d6cd8d80f2c6f62ea4cdd3f668836a1e10f3dfe72593086cd180f6ca9
MD5 588de19a1499c6a7d79d1d1862a9c6d8
SHA1 14a9391806f1c4c65ce35f25222264141205f189
SHA512 813b1e2665274f005f21c246424730db39b25992093091344dc1f77bae00ab0df50c9c00a9175e7b1a07c58873dbabdb29185efe6a75f7aa072e731d8a8bfa5e
SSDEEP 768:tG8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVGrog:tG8bqn+WvSCt6u1jaCZLbWV9g
TLSH
T1C1D20A3B280CCB7E4F845E5DEC266F962DD801CB6B988D4447FA884C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 4b40f7b4b5d96c0263484df91137468851990f71d06d3bd7cdea21d64b9c2b8e
MD5 7a4f2b14f5b84fd60906b05eb501ab83
SHA1 d8377b6cefa3b47896460d1cef53ece0a6b41bb0
SHA512 fa726d7895a02bfbbd07ef7568408c469f880d271bc46025c07ff290013c0b9845846542948752e49caa9834bb737909f2787d6d5eafd37d195e8d71324d5a36
SSDEEP 48:K8UI7KNyc/yFHIRKc4sUjIVKIUo3yZWInKnqgl:K8UgKNyWOHaKc4TjOKIUSqWkKnqS
TLSH
T1C9C11723327B024128BE650C93E9A5779E5272733814E96F7FB850E21E66E216CFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596930.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596930.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c6fbc0c73848f931575ebaa7dca4b2fb28bbf31801fbeeec5e86d66d57b36cd3
MD5 e63e4bc4446fa7019ef64e938d0ff95b
SHA1 50487c8ac54d0eac75dd4739a6ea0b637df20f53
SHA512 fed827b26d7ce7c993cf13aa9552208889b73682803a1f649136e51fc99108cd32f6c6998eb83c89e2b3f346957522c379dcacd707345dacd0e82fa9b60ac3fe
SSDEEP 384:PZcIhsNa0VQqu6kKagEa+zOhzlKIn7O6R2FeoYh7Ucoi:Hhlqu68Ta+OfKIn7TRrFt
TLSH
T1CE828D322C789C776DA2D345F84736179EF890A796CA6E90D4ED9F1D00DBADC130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e5aebc644de0d6edf63e299be35e7409d7f272234c4344c239f460e7b4e4629f
MD5 d5f9b23763e99b1cd742c2a859ec50e2
SHA1 92bb00736f7feb452d22b2c659c1e93ef37f7d5f
SHA512 5eb7a282fac7f7716109b9ec9682bd94518b89690602decc90364278125821246d7f17af4dad9d30d7a8c6634daab1a2f137ba26a19b3891d969e02a8e80978e
SSDEEP 384:liFiZcIUsNi8TUNTUlIlfVQqu6kKwgEa+zOhzlpIn7O6R2FeoYh7Ucoi:sFQUHwgUqu62Ta+OfpIn7TRrFt
TLSH
T1BDC22BF218E78836E9AD9747E77E3E178EBCC063B5856950B3985A1CCC865BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d1c8f350ea6238f6ca76c185f5ed9d2055568229dffb20d26baac0d0a9dc38f0
MD5 25dd8438b3cb584b85c3a1b6d3e031fd
SHA1 aa1b4bf076e222984d5a8df880321119d3bcb886
SHA512 17874de4987d7c6c9fe77459bdad1ad206ac579f0e98733a55275579f6a3e8c724d258b32be258e5066110eeaabdfb80a3e1bb8c403c90fccd7dc2204a26b3c2
SSDEEP 192:vONp6Db6QmiUyhZHBa+jXOm+tmUJARg68mxU6:vONp6uSHBa+zOhzJyxU6
TLSH
T14102E83578786CB79EA2AE49F8873B279F94207BD9562F84D6D81F0C00D764C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 69675954fc81333bd2e4ae61dd8b530104ab690011f031474ff33ac6cd207134
MD5 cf735b17125afaf80ad6318944f82cb3
SHA1 e54df7c24b3c78f425e0cb11f803dc8fb81356f9
SHA512 e9dd0bf842eea481ebcd7852aa62405c7750b47709ac33dafc70d2d77bb2eff147ae546c49426acc1ca81a953bbf0ee6f626350fbf520b0af242f552e5b3fba8
SSDEEP 192:wONj6DbDQmiUysZABa+jXOm+tmUJ/YNzMqKnU6:wONj6NxABa+zOhzl4InU6
TLSH
T1A3123932787C9C776EA2A684F48736179EA84167DA8A7F90D1DC1F1C00DF69C230F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 22e006a9bf9841fb00c6fd6fb2343a9a971e010d086a718f229723244addcdb6
MD5 cb32299d9d32958c86b41e86651cc725
SHA1 9b157bcaeacbdaa899b555565f89eb1755f4548f
SHA512 472e90427e686d357051345ec7d27123352c3edee8b3a9e1dcb7d35cbcdfd3c523a4bf6c32fd48b77a8ebc71be2ca61651b7270406a8cac37e9e8eb1ee9afef0
SSDEEP 384:NZcIhsNafVQqu6kKagEa+zOhzlKIn7O6R2FeoYh7Ucoi:Vh8qu68Ta+OfKIn7TRrFt
TLSH
T1A9828D3228789C776DE2E345F84736179EF8906796CA6E90D4ED9F1D00DBADC130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35e3c8a6-45f7-4c96-97c5-6ed61661814e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\35e3c8a6-45f7-4c96-97c5-6ed61661814e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 954fee31ad40d469aeb9c1c2b7552329c1a3602819d1f4343afbb1b373f17ed1
MD5 48f4e8a40ce5531867ef3a7eade43ab8
SHA1 4bba56161ec9730f27d7ef79879402e26dadf411
SHA512 ff0a751a69813ac7609527e9b41e7568fd2172de58dfb191035fb7fcd878cc60f235feba19431aeee0191558ee3adfbb6684200019f4841c1dad62e57fc6cd95
TLSH
T13241475CAAE81148F3B76F5AABF2686E887FBD632E46C45D00010D8F0A63A40CD61737
MD5 SHA1 SHA512 TLSH

Submit Download