df9d87f7d741c11d40488e36d61118dccba795a12bee8957ec24d827e40ba2c6

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gpbc/courses-2.html
Size 46KB
Sample260930-w7tabayeng
SHA256 df9d87f7d741c11d40488e36d61118dccba795a12bee8957ec24d827e40ba2c6
MD5 daac956685252c6681514306fb9c5f9d
SHA1 56e08f64fe73f44af7c44eb8602524328a8b5032
SHA512 8a51df194a728677f8052dd81c0c7d72269902c1ef6b3ef5262dc6d1be48c5322e31b2c87102b317ba3ae2ba653f7ae578a3a93f0f9880a6e38b29145ab3cdb4
SSDEEP 192:Y8dnhzTgIKbkMEPpYz3v0CG72Oi+OK/3mCBcXGhndMPwydfldCfU+L:tdnhzTgIQkMEP72OICLewUGfU+L
TLSH
T1FF23A92108F9503702A2A1926E682F2B3FD2D617CA2A5B0532FC1FC85FD7E47DD63659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3432	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{4EC7255B-4D61-4A94-888B-87FBA8930F2A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1172	msedge.exe
1172	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 4004	2972	msedge.exe	87
PID 2972 wrote to memory of 2268	2972	msedge.exe	88
PID 2972 wrote to memory of 3432	2972	msedge.exe	89
PID 2972 wrote to memory of 2268	2972	msedge.exe	88
PID 2972 wrote to memory of 2268	2972	msedge.exe	88
PID 2972 wrote to memory of 5088	2972	msedge.exe	90
PID 2972 wrote to memory of 5088	2972	msedge.exe	90
PID 2972 wrote to memory of 5012	2972	msedge.exe	92
PID 2972 wrote to memory of 5012	2972	msedge.exe	92
PID 2972 wrote to memory of 5012	2972	msedge.exe	92
PID 2972 wrote to memory of 1452	2972	msedge.exe	93
PID 2972 wrote to memory of 1452	2972	msedge.exe	93
PID 2972 wrote to memory of 1452	2972	msedge.exe	93
PID 2972 wrote to memory of 4916	2972	msedge.exe	94
PID 2972 wrote to memory of 4720	2972	msedge.exe	95
PID 2972 wrote to memory of 4916	2972	msedge.exe	94
PID 2972 wrote to memory of 4916	2972	msedge.exe	94
PID 2972 wrote to memory of 4720	2972	msedge.exe	95
PID 2972 wrote to memory of 4720	2972	msedge.exe	95
PID 2972 wrote to memory of 2040	2972	msedge.exe	98
PID 2972 wrote to memory of 4244	2972	msedge.exe	99
PID 2972 wrote to memory of 2040	2972	msedge.exe	98
PID 2972 wrote to memory of 4244	2972	msedge.exe	99
PID 2972 wrote to memory of 4332	2972	msedge.exe	103
PID 2972 wrote to memory of 1384	2972	msedge.exe	112
PID 2972 wrote to memory of 4964	2972	msedge.exe	113
PID 2972 wrote to memory of 3724	2972	msedge.exe	114
PID 2972 wrote to memory of 3060	2972	msedge.exe	124
PID 2972 wrote to memory of 3060	2972	msedge.exe	124
PID 2972 wrote to memory of 3888	2972	msedge.exe	127
PID 2972 wrote to memory of 3888	2972	msedge.exe	127
PID 2972 wrote to memory of 1172	2972	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\gpbc\courses-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fffc17ec188,0x7fffc17ec194,0x7fffc17ec1a0
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,12519822926738222012,6574717890478662359,262144 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,5976836478122392225,2262471876860777729,524288 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,17143329878532122912,2756298222202487358,524288 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,16605885496907993027,6541373209353628455,2097152 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,2794378721153404093,14134880728933841603,2097152 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,7450792424398226115,13845194914561586295,2097152 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,6101912551959515208,4466954146418145443,2097152 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,5804393187041599235,5772333894670023132,524288 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,6005662335342509019,7200909457175930817,524288 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,1386622365362649727,14344889574881546806,524288 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,1386622365362649727,14344889574881546806,524288 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,8581044604900729263,15301036167259346852,524288 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,18329049368640264054,6019850918157125488,524288 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,14556291078318114782,15053059383696504160,524288 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,8920041549310446121,5397983467703338427,524288 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,5808576864516579042,14008759028359399874,524288 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=688 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6200,i,1437140560204938005,18322232847893007821,262144 --field-trial-handle=2360,i,2398119678663002064,1778698297449685860,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
MD5 e74d8b44e8d40662fd1b1b255738f7f7
SHA1 274571a893d99afe45f887bf62213edcdf6ce25a
SHA512 fdd52b8ff528e9564308a28f53b7774dc738711d7dccce592af97c88bf2722ddb380e7bf76101bce36a685c115e53c6bb3d415de6eecc3c382b674f304fb5a40
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T1B2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0ce718bf2a5cd7e43be7c6c8a26055e5654ef615ebcd02002a8817834ffcfe8f
MD5 6356c93ada7424db86d959da583bfc16
SHA1 d368d3e49982da534409f33576413317b0483fa3
SHA512 b86b3b1befdf9afb9020c5f1e142b962b22a9e48ba10077017b8f9bbbe187b8df03fa42dc3f5a3a507a7a115597e4ea9d944704eadb88a324c09347a36f7907c
TLSH
T16461878257934C90FF9885BCE1C5258B39B0E44B9FAB9E5F0DB8C87B5936314D51F490
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592f53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592f53.TMP
Size 3KB
SHA256 c28d4f577f7ed107c75ab98ffee0af530001d250d41eb0716d0f86c24ab77035
MD5 92b1fb1190799c4f905af8f4cded87f1
SHA1 1d2b3f58907d8e637bdd6b98ce1237b59b2297a2
SHA512 55fd5dd7236596ca99db4a727cc49851f53754039a96b433e67e5579d1b8f748bc5284402c80d73f43467181afe86cc46c9fdae92d2561c9a8a3a3813723e344
TLSH
T1C161958257834C90FF9885BCE1C4258B3AB0E48B9FAB9E5F0DB8C8BB5936714D51F090
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 98454d80d1b66b9b2760f9db1ea731781ca7f5ed7143bbc1bb4e0d4508c89757
MD5 0508a60824ed1c4c59a7f8dd7cd628fe
SHA1 40ee21f1f4e1fcbb67985b3a15d4361ce1f8e95d
SHA512 e0b7e94e9c2fcea533a58076a9409ff1d65d570a4f8e2e3fea9349b72c8cb156f1958c1b9c518c771a82408ef103edd3dc42826b29e548c0a01178cb69ad1e5b
TLSH
T1FA31B0F7C3D5867E890156F05B24AE17CE1D051A42283D5AC9E4EF5B93F30B5E10259F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 132e6b24dcdcd1a2dbdfec0527f6a85fa3a8f3194d0f2623a0adee5c694307aa
MD5 847a4984e80de265d068ba811902dfe7
SHA1 51269e17ee4fb9f88cca70fcf5c32e48265007d3
SHA512 8e5f8b28c209df586ddaf34c191a5ba0b3995298605efbfed1d66ded38948563d23e7894769335507374e224a48b9e8d2093ff6465031f6626b51c37e0e5278a
SSDEEP 192:sxZARDWu/fzsUGIdpdkHW6+WNGYYBaTLIgrJ:sxZAEu/fzsUn2HbGfo9
TLSH
T14712A7116E38657B8CC7D20DBB65BF13E6F9503291D51E58AAFC861C04E7ADE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7fe144d81d2a0dfe2a1974245f9ebd922f77b3d76c3460f7f5b0ceec0e9c7da1
MD5 138b595cccdde9820294d26ca5adf28a
SHA1 3f8eb08d2e712b8cb351bbdf4b9d5a2e4b74a9f6
SHA512 60a28dc021c7ba8ae87dd74b8d389eef1bb108b75b9610c47bff5c5b61fab997358372ffe707ba7da94415050340a11ebb792c91c36decb5773293ad6f4d5656
SSDEEP 192:sxZARDWu/fzs9GIdpHkHW6+WNGYYBoyTLIg5DJ:sxZAEu/fzs9nEHbGfoQ7
TLSH
T13722A7116E78697B8CC7E21DBB55BF53E6F9503291D11E48AAFC861C05E7ACE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ead23855792ca6739ed73a9217c6876cc0710b95bf10803bc99aefb844431468
MD5 df2ed4485b06989265d08482b524f18f
SHA1 93deb9d627f69d58f93c6e71c509357fee035082
SHA512 f6b0ffc9694f17589f294be50fab8ee916aa8f0ee7723d8439a1d9c043aea7192df278e0d99c22c28869ebae5eb49c42bd5d289d70b13f5fa27b3cb8dd8576bf
SSDEEP 192:sxZARDWu/fzsiGIdpdkHW6+WNGYYBaTLIg5ZJ:sxZAEu/fzsin2HbGfoV
TLSH
T17522B6116E38A57B8CCBD21DBB55BF53E6F9503291D51E48AAFC861C04E7ADE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 92a265e7fe2e714a18f90316a5285ac3f5b40cfafc4e38f182ee8b9cbcbcf428
MD5 8beabce58c1e30d69a1a5fc1c1cd89ec
SHA1 b05e6dda83bdae0a4a820e4f16f709e7bafb6525
SHA512 96ffc59aeda284665e0becdde9c53e041cefee23cf1959957cc658f550164b3ba466dd4e08db8f4294eec4fcd623d08e32ecca1d583328308311dd066cd06259
SSDEEP 192:sxZARDWu/fzs9GIdpdkHW6+WNGYYBpFTLIg5DJ:sxZAEu/fzs9n2HbGfph7
TLSH
T13722A6116E38697B8CCBE209BB557F13E6F9503291D11E48A6FC861C04E7ACE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 eca34ed6c77c96bf217e6f4497dd151f6d22a478de8fd2a4199dd3891345b522
MD5 8ebce5c366e0760143c0b9789a925b25
SHA1 c4bd06a328cacfb2e91e1b8ab47ecadd4c1776fb
SHA512 b0f23af1df35cc134e859d5d21bda9e66cd8b28e0910772e03ed0b5325031fa50be934062c5e15e493d8baee7248f5c9c6d700702af03a44c718e4bd1bfba428
SSDEEP 768:Z+yYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXKropYaf:Z+yYR7jWv3NpBu1ja/CL8OXhv
TLSH
T102C2E93B644DCB7E4FC01E9DDC5A6F9B3E9802C7A6548D4047FA984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0c7ca2c78244526ed94ff63353f2a486b6d3293ac563f0a4a05c932e77a8a7b9
MD5 60c6975e2ca0b6f044af7295f6a18b66
SHA1 f12564462a11409d215773397a05061e2b73f150
SHA512 53ac18ded2d5ce4c16ab80e91b25555bddafeae1361f313019de667fe5722a34e60521b74665c18cffc4759967d347e95d3685ea17eb9fe5af5bf9e130d4e0bd
SSDEEP 48:KghwdR7/DcbvaHISpcK9J1jcxBMY6LBByL2xMwuUUNb4PgISINK9s1uNxmdYHYo+:KAmYKDKmut+Kms9tWKmAyCIQKH
TLSH
T153A1221072BB22543C7E258882A9D77F568235723558EA3B7FFC10718B6AE446CFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2400a9b-7be1-48f1-acb9-1abedf3c7cbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b2400a9b-7be1-48f1-acb9-1abedf3c7cbf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 ebee31536756a5affdaebbf71f4fc11f79dfc7f8fdf29bd6d46ce9f693eb7059
MD5 47018cde3d9692078104ebfc1edae2ef
SHA1 6a848b51c41e6c33eeb0b4c0c4640d34bead9235
SHA512 8a48731a3205202fa15954069245294c01204064c4502c110f3e761581e44549059d09108a75a2d477f96b27f3e02a5d5559850578a5dc1dc24d65b90050c589
SSDEEP 384:0iFiZcI2zsNN8TUNTUlIlI1uFiDqSQX5+DtE8A1WpXMOT7tgOIwZOywLXom:PFQGswgLFTRkDrBT7Xs3Dl
TLSH
T1D7A28D338DB8CC7FADFA9A85F18A32039EB45177D5C5EBD0E6DC5A1C00AA5D8130AD52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6f44c8ae3a5536c40ba22fc70dcf1a322b52f67b306b8adb4412a31a736ab5f7
MD5 664c4863816544bd1a6a46c7cadd19ea
SHA1 785324a2fb0aad5d3b309886b3901a3e77384c1e
SHA512 64e466b11fd7d9e244dc12505f8f1f789a5ac4f79caca28f6dd3a465b1875ee49be3b3d0aeb5d7c3fc3c64a0436ada945ec372a18fabaaab473b8a2d423781c4
SSDEEP 192:EON76nnHGQmiUyX7QYcX5hQDP1UjzorA1WXMcsGU6:EON76nC8QNX5+DtE8A1WLDU6
TLSH
T1E902DB34E9B87C7B8EF3AD46B08637136F952177E5956BC4DAE81E1C00D765C230A923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 96f9edeeb86b7ebe82157d00300cadd43056ac21e8132e6df84c8a643ffee12c
MD5 554114ed7a6faaba41d53ceec3dfc470
SHA1 fc0774cf446bc3be665e4d41d54b5e38e325baed
SHA512 51697ea83d9bc4199b9efed34ad050e5cafbd722f50a6841459019a2c9980ad7a1d2284f6b553530e8c38d2a57473b36e9233e5293db1d334c85de020fb3981f
SSDEEP 384:hZcIhsNzI1uFiDqSQX5+DtE8A1WpXMET7tgOIwZOywLXom:ph0FTRkDr1T7Xs3Dl
TLSH
T143828E319DB89C7B5DE7A585F18632035FB49527E2C9ABC0D5EC6B2C00D96D9130ED23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 22e45a7aa37ab62e55cd627a2dcbde4d902730b1fb95f5f1890f6681e9c20b9a
MD5 3b4af193db19f5fb980d6bd948cc857d
SHA1 4a5f6c49e313d8ea58a54d7c6f1605a729528fba
SHA512 9970b63b23afe1c6da324a273edf0889dccec9ab5ca96156100c2a6543e52a8b83cbbadfa6a09474e800ffcbc59cb571cd731a54e2670238ca8d94d8bea75964
SSDEEP 384:3ZcIhsNzL1uFiDqSQX5+DtE8A1WpXMET7tgOIwZOywLXom:/hnFTRkDr1T7Xs3Dl
TLSH
T1C9828E319DB89C7B5DE7A585F18632035FB89527E2C9ABC0D5EC6B2C00D96D9130ED13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 df0f46a6cecc51756adadf5edb286bf7d489cb7e227f12a6c4f1745b892fd37c
MD5 6be7562f085fb13ef5e2ec2b5b5edf99
SHA1 318dfa4a58885f2422ad6129931da17f4087506c
SHA512 79793579d16cd5828ba041600ceaf14f9296d8c251e62e5ab53c8673978f69559e8965e99e0caf79a14eb6134dad6155ec440f49f523be40d0876b05b120d0d2
SSDEEP 192:EONe6nnHNQmiUyj7OYcX5hQDP1UjzorA1WpXRqlcg3crq57U6:EONe6nrmONX5+DtE8A1WpXMRT7U6
TLSH
T138121C35E9B8AC6B5ED27586B08731136EE55227E6487FC0D6EC2E1C01EE66C130DD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0b5aa7e-47da-4397-919c-86fbd0bda5f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d0b5aa7e-47da-4397-919c-86fbd0bda5f1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 43a1e8cd67c2fbfaf410ede4018fbf5feb9523ced0f68d5b6c097bfd0c05872a
MD5 7fc310430763365ab21c44b1c82db65f
SHA1 a436d3f455e4746575bc16513ce50bbd80930fa7
SHA512 527eed99fb9771ddb440208396962cb522f68b21f57d01a544f58efb3a88818449109c3c495d917c294af2e6214dca74a1033ceb8e4d1ca9b03d11e8bae43dee
TLSH
T12041D858A6F90108B377AF56ABF6686D487FBD372E06D1AE00110E4F4A66B40CD71B37
MD5 SHA1 SHA512 TLSH

Submit Download