hxxps://listserv2[.]hofstra[.]edu/scripts/wa[.]exe?LIST=CAPTRIALS-L

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://listserv2.hofstra.edu/scripts/wa.exe?LIST=CAPTRIALS-L
Sample260910-wmbvjawvcs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3036	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335369234700630"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{1E57480D-5821-4109-8CFF-73C7BCCF9C05}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 1292	4512	msedge.exe	85
PID 4512 wrote to memory of 3036	4512	msedge.exe	86
PID 4512 wrote to memory of 4328	4512	msedge.exe	87
PID 4512 wrote to memory of 4328	4512	msedge.exe	87
PID 4512 wrote to memory of 4328	4512	msedge.exe	87
PID 4512 wrote to memory of 1812	4512	msedge.exe	88
PID 4512 wrote to memory of 1812	4512	msedge.exe	88
PID 4512 wrote to memory of 4452	4512	msedge.exe	89
PID 4512 wrote to memory of 4452	4512	msedge.exe	89
PID 4512 wrote to memory of 4452	4512	msedge.exe	89
PID 4512 wrote to memory of 2552	4512	msedge.exe	90
PID 4512 wrote to memory of 2552	4512	msedge.exe	90
PID 4512 wrote to memory of 2552	4512	msedge.exe	90
PID 4512 wrote to memory of 2524	4512	msedge.exe	92
PID 4512 wrote to memory of 2524	4512	msedge.exe	92
PID 4512 wrote to memory of 2524	4512	msedge.exe	92
PID 4512 wrote to memory of 1092	4512	msedge.exe	93
PID 4512 wrote to memory of 1092	4512	msedge.exe	93
PID 4512 wrote to memory of 1092	4512	msedge.exe	93
PID 4512 wrote to memory of 3360	4512	msedge.exe	100
PID 4512 wrote to memory of 2916	4512	msedge.exe	101
PID 4512 wrote to memory of 3360	4512	msedge.exe	100
PID 4512 wrote to memory of 2916	4512	msedge.exe	101
PID 4512 wrote to memory of 3768	4512	msedge.exe	103
PID 4512 wrote to memory of 2300	4512	msedge.exe	106
PID 4512 wrote to memory of 2300	4512	msedge.exe	106
PID 4512 wrote to memory of 2300	4512	msedge.exe	106
PID 4512 wrote to memory of 2244	4512	msedge.exe	111
PID 4512 wrote to memory of 660	4512	msedge.exe	112
PID 4512 wrote to memory of 2200	4512	msedge.exe	113
PID 4512 wrote to memory of 4128	4512	msedge.exe	126
PID 4512 wrote to memory of 4128	4512	msedge.exe	126
PID 4512 wrote to memory of 5068	4512	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://listserv2.hofstra.edu/scripts/wa.exe?LIST=CAPTRIALS-L
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2bc,0x7ff9f3dcc188,0x7ff9f3dcc194,0x7ff9f3dcc1a0
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,13338479638418696739,1442814167763198392,524288 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,2718370238137699468,17300432978635141117,262144 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,6224544381083790711,737574266734050229,524288 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,14618785778647660483,17856434088655856952,2097152 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,3547911236856978311,8561849211552963820,2097152 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,1827949046491200624,13398201321869713919,2097152 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,4112376802500674006,2088428496398240059,2097152 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,10303943787863334484,13045682865599209496,524288 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,2019779788567276603,8308206827814973089,524288 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,10115758008671369004,7213507190881038943,524288 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,10115758008671369004,7213507190881038943,524288 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4248,i,2292173305611482861,10643163956173261096,2097152 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,7781082252197922645,13720404282535334895,524288 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,6466837009387746976,14459146582286277856,524288 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,13420519969708673491,10522613149649458296,524288 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,453147534914607696,2046940388975575478,524288 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,17909761061949925257,2666694018292055679,262144 --field-trial-handle=2216,i,5291655608040686479,12307479048123837434,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7169592317eaaea8fff337dc26a1e08b02d0d152b0711ece91c0a9da275064cb
MD5 977bb58c8ca41b9001045c6df98df5c0
SHA1 4ce8db295ce44a7ac4432e5166ce829d83a160ea
SHA512 10c0751fc6603e951bfe8da9a56cdf9d83e8f6abb2c9cbfae8c0bc7a7ed6e75490c20ce1028ebe54a54cedb84a85dd34e4e45187fdc95bbf3d3307e5d76d4259
TLSH
T145510824D2124EA1EB91A233C5C1171437BAC6963BC75F44F29498F96E0EF6E4E7D109
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595aa9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595aa9.TMP
Size 2KB
SHA256 d48e7aba250dfb9a1c178c44219f8af6611c200d974f5df501e19dbed62b6f3c
MD5 0b89dae051d6c4abec0cf9f30946a82b
SHA1 e109a91da86e969925ea0e47677d83df8acd04b4
SHA512 67a820b0db3ddb3b1b3f0cfcab6e2b7a78b0cf3a430e0cc8d068e34944b15edf7ecf3d58ab7afbceb70eddefcb12d9d85556815be759fa84c50955a1074ea4dd
TLSH
T1EC514C24C3520E81EB911233C0D02754367AD6983BC76F94F28858F91E0EF2E5E7E119
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8ada4338ef6d95febd89ba297af7285753f0186d929daaa866d0fd3cd39d855d
MD5 9c33375ea942ee20a0c601bd2ccec627
SHA1 12f5c6e3f8bbb8d37b78047f45af3a2d09146d18
SHA512 c6c92c86153f29f0316e18f65a37a70a4e798e349197c8030d5965e8daa08fcde78ac47f57baebf6febb9f9fa24c47c8047ba8c8d4e16248a7f576ffd5ad2734
TLSH
T125419BF783E5C22E8902A2F49A14AE2BCE1C0911531C7C29C9D4EF6B93E34B1E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dcabdda374e7cd171d12fffd024f478db8330be085ac1c65f5760d936fac62b2
MD5 2ffd1d420f62baae70f7f22fba95cbcc
SHA1 acc5363e1c2812cf88386f0ebb65677b728b4128
SHA512 0cf27550f0da7318af4cf37a0cd7e01cacb8f374b3a82cf5efab9d9485eed4d45f2058457f4aa9a7652761020f91f0cbe179dff1e35d8c5cce4f2ffe2ec8bd7d
SSDEEP 192:sxZWRuYyM/jK1Ml8MWGW/fQsL6VIdp+94HW6+WN9iQXY9IIDNQWIg5EJ:sxZWduGW/fQsLJ/HbfXQ/e
TLSH
T1A652E9116E34697BCCDBD20DBA95BB43D6F94472A1940E44DEFC891C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a841fcdf86e6cdd0f154a58bb0fcc90d91bc6abf92ff2d8bac41bf815e2642b1
MD5 8e90ce18041468d3e01bdbb38960efce
SHA1 ec9f9bf0d2cd24910b8ed863013967e4bcd6377e
SHA512 75137f9b753283a50f260e759412f0d2d6ee251aecbb68186d515ee683c1b7cda9449d67d909723f9b0e9918fd6653b8163546f4ee256a58af78b54b3cdfe3f0
SSDEEP 192:sxZWRuYyM/jK1Ml8UQ50WGW/fQsDkVIdpk91HW6+WN9iQXY9IuwxWIg5qJ:sxZWdq5/GW/fQsDDoHbfXKI
TLSH
T1B862D9126E345977CCDBD20DBA95BB53D6F94472A1940E44EEFC8A1C01E2BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eed5c145a1480613fd88739020a3258da4ffc4f6a5fa60cd6f2fbed40f9ac327
MD5 0e24403f8f90b3bfba2a949d347af850
SHA1 4738eb68c63ad701b6fe091b440c7d1a67874b65
SHA512 9725664491d53e517ac7ab778a4793bc97704500465e96d245eec93d28423449d57d3ea394586b1e8ecad0af06404e46936787c6bcf72eb3a79a509930b14040
SSDEEP 192:sxZrRuYyM/jK1Ml8MWGW/fQsm6VIdp+T4HW6+WN9Ac/Y9I4NQWIgrJ:sxZrduGW/fQsmJlHbN/E9
TLSH
T10352D8126A346977CCDBD209F955BB53D6F54472A2940E44EDFC8A1C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a438017a8c8be0377ff7e52c59f9cc7475f36c77ee925e8302bfa333295fb073
MD5 a5cab70af956343f7b71133c8360f6cb
SHA1 b80e1e2bc2a858c49abd40339724894984c08292
SHA512 3a17241cbe8f16a5f7a17c762577b4a841e0868880356fb4e61c5dc1bbe0d650f31f4524a0d2b67edb42beaff860f77eebd9b5a984a6af87c0ac5ac22d2a4b24
SSDEEP 768:1icv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNeroxg6P:1icv21wWvu+Z+u1jaeFLeRN1x/
TLSH
T11ED2FA2B280CCB7E4F841E9CED2A6F866DD801CB57984D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2f49d13a96800bd7770ea51b29f5c7bbb6cde4c4e15f9dbfed811a6f7a84dc68
MD5 e94d5d6075e2291423d5d59465200d9c
SHA1 499d726390d1e3a66dd7d246124d93e6b97035bb
SHA512 3848b508080ad8a8f6001e66e9cca34cef884e480ec0e11c78e041828771a983aa8f080276fa8c061061956579477189f9a2239e52885a9ecfd6e16d04c43265
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD6aEKPaGO1WKO06C4AKFex:mTfLRl7i
TLSH
T122C14216B13B4642387E7908A79286374F4531A7781CB4AF7FB800669E2BE115DFE4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 19d2e8ed84150365b442c503f9142c22a8dd008b1c9d544e763b1dd2f32099f8
MD5 4f6fdfe7f5af3920515e4ffaae46a4f1
SHA1 3a32367c1c29cef8643084b15506561bc4b1f59e
SHA512 d712e47d217abf6fcee86ce53879c5359568d59ca35b0115cffc87772e5ec92e28904875d4cb433174cb14212af0f98a333ce15a94d861540a7f4fd4b19896d5
SSDEEP 384:wyqZcIJsNvLQEziUGS12e+CzO4eyfhesa+VY0o1:KJ1QkS1BrOXyfhehg3e
TLSH
T1A5B218F229E75C76D5AE5347A77E2E134EBCC057B5892A40B3D86A0CCC8627FD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a3e76338676a89c385dbf49d4d1acbd92442d578ddc42de5b019856fed58bbcf
MD5 ca196b9ed19094ec4b0b349276d1db02
SHA1 1b378f07c9a07341233ca48af48ab12d13f42610
SHA512 21f0f919e0d892bf75177998843d9271452a26b463c8955629f60494ab3f8c010b761e90ba5cf324c385f5370c60fcfc32f18e00f70e8a55cc0e5dc479be28f0
SSDEEP 192:JONW6v+YLNQmiUyG/Zh+CGSO49oQusQtU6:JONW6vz/zZh+CzO4eGYU6
TLSH
T11B02D93579381CBB9FE2AE45F58736275FA81177E9962F40D9E82F1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 447a0efd8324d3ecd66017bf2e2e542903f5bd66664f616fea9e61ae23f17779
MD5 e0b751a731cf4e76a7f66f3c7bec3be4
SHA1 3774546b83d2fd5c3e77f8dc70bb011de29246a8
SHA512 4e4f313c5a76143dc9e7435e3cadde5c54129d47021ed7301bf0d2ad7d0861c04b9b81e8b7b3d99269f67913ba0d8ea8babda17c28a44ba4b5c9cb7144ceebfc
SSDEEP 192:MONi6v+YLNQmiUyEO/Eh+CGSO49oyf4CHSquU6:MONi6vzntqEh+CzO4eyfZeU6
TLSH
T17E123B3679381C7B5EE3A984F48732278EA89167EA8A7F80D5DC3F1C01DF65C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 10c1cbe48ea239c858dce847d1e51208cbc8a6ee9f200922b79f3c1ecdead7e7
MD5 78d39b64d8fbdb90142372439420882d
SHA1 0785d54a8d3f652a826e44049836546cb8f440b2
SHA512 3bd5f2d2f198214e19084308326f2fafe4c225fc23bf73d65bb129c11c775ab956e64628c1ecdf518970d2ec5ce2a6c7c780fe155acbc6e5881ef6b776a09fc8
SSDEEP 384:lZcIhsNvLQEziUGK12e+CzO4eyfuesa+VY0o1:dh1QkK1BrOXyfuehg3e
TLSH
T1C1827D322D385DBB59F39295F98736138FF89067E6C92E80D5E8AF1D01DB7981307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b0d64f1c5e909e64a04ccf2bd6a1d964798a4f45934a4dd36d639ad242e1c4ea
MD5 cf07dbd3d26cd325b256692fabd677da
SHA1 ebae3d84134bab4dd73f443675ece2abe7fbf7b4
SHA512 cc4afc9497833838becd8ad5b162fc5f49bedc3f187fa820851cb6dbb632cd76a746628f0488a4d9676ad79c2927735fdfea69ae1e42eeda6a9270f02eeb86ab
SSDEEP 384:rZcIhsNvqQEziUGREe+CzO4eyfuesa+VY0o1:zhyQkRPrOXyfuehg3e
TLSH
T140827D326D385DB659F39295F98736138FF89067E6C92E80D5E8BF1C01DB798130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6bc2d87762ac01f4ee8b0308f6deac966f7825160078a454f39113f3f1e31fed
MD5 3181607648b80de64859fc5ae745c79a
SHA1 d4e2d04a1c26c3bc5033e4c2f2e8a6107d2cd174
SHA512 1fe8b4e24b2cd767fe71e57a744d6f381909000117a952311a1e2cb1ef7eaf9437e686117028aae93a5c1f235af515f94a5f9803bc8faf6eb619db577869ddb8
TLSH
T146E00401D1000471C40C473105433F001FD1C45011F54355F73001DC1C733013C30F15
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 55de0f9cbe57c05a99fc79f263883ea5aba90cad77a6034fdc52fb7680015f15
MD5 27a93f1b177eb8ace83feef2caad8ff0
SHA1 98d75dda3af2abad047817457ec0bdbadaea4107
SHA512 d12487b3e345c4dc5f765802e30b34d1c3ac949ed5472ec5a7dcf913fe9d7a807fb4a92f49e2cba2857c5d03dc38fd2fbdae211bfee00897246750b7a3688549
TLSH
T1BEE00200D1400476C41C473105C32B103EF0844012F74255A32101BC2C733013930F55
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59160f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59160f.TMP
Size 392B
SHA256 6d46192146cc28fac8d486eb1695b426958028bdae152dc51a1016e7d62d8f0c
MD5 7eff83e32d80f76863d741681ccbbbba
SHA1 5a6cbd87e4823995e78e1a900229dddab8491f3f
SHA512 9a8ec4de37842b08629cb63b41df67803da779de81124ab238d08f55e95beeb00796563b67217bdd37ebed26ec37a8f74d329671449bd1ff1d885771fd6019d4
MD5 SHA1 SHA512

Submit Download

bce79281-7487-4742-a51c-934c8abb265b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bce79281-7487-4742-a51c-934c8abb265b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ebec5e651ef17b06874f6e5dc721f55093c5a842428903aa980bd144c11e810a
MD5 51a6e4abb48e7281ff8bd735d40fb5f3
SHA1 b180b45c51f604b535abd6e8265eb879925becf7
SHA512 d64b764dddcf156e00217361e36c5e9ecc54137fb1d868aa74730210c3222e0b7db4160eafa61cacfc37afce3dbb264ed5e055689f35620e91e9deb9a0b4f65d
TLSH
T1E9412959B6FD1018B3B76F069BF6A86E447EB9772E07D45D10110D4F0623A00C972B37
MD5 SHA1 SHA512 TLSH

Submit Download