hxxps://projectx[.]lelefinn[.]de/

Analysis

user interaction
yes
max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://projectx.lelefinn.de/
Sample260723-vfg8astalc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2132	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292993604642733"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{45962363-7953-4462-AC6B-FFA2B40655D2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 3352	4924	msedge.exe	86
PID 4924 wrote to memory of 2132	4924	msedge.exe	87
PID 4924 wrote to memory of 3056	4924	msedge.exe	88
PID 4924 wrote to memory of 4804	4924	msedge.exe	89
PID 4924 wrote to memory of 3056	4924	msedge.exe	88
PID 4924 wrote to memory of 3056	4924	msedge.exe	88
PID 4924 wrote to memory of 4804	4924	msedge.exe	89
PID 4924 wrote to memory of 1512	4924	msedge.exe	90
PID 4924 wrote to memory of 1512	4924	msedge.exe	90
PID 4924 wrote to memory of 1512	4924	msedge.exe	90
PID 4924 wrote to memory of 1940	4924	msedge.exe	91
PID 4924 wrote to memory of 1940	4924	msedge.exe	91
PID 4924 wrote to memory of 1940	4924	msedge.exe	91
PID 4924 wrote to memory of 4760	4924	msedge.exe	92
PID 4924 wrote to memory of 1480	4924	msedge.exe	93
PID 4924 wrote to memory of 4760	4924	msedge.exe	92
PID 4924 wrote to memory of 4760	4924	msedge.exe	92
PID 4924 wrote to memory of 1480	4924	msedge.exe	93
PID 4924 wrote to memory of 1480	4924	msedge.exe	93
PID 4924 wrote to memory of 4576	4924	msedge.exe	98
PID 4924 wrote to memory of 4576	4924	msedge.exe	98
PID 4924 wrote to memory of 3096	4924	msedge.exe	99
PID 4924 wrote to memory of 3096	4924	msedge.exe	99
PID 4924 wrote to memory of 1832	4924	msedge.exe	101
PID 4924 wrote to memory of 632	4924	msedge.exe	108
PID 4924 wrote to memory of 632	4924	msedge.exe	108
PID 4924 wrote to memory of 3716	4924	msedge.exe	114
PID 4924 wrote to memory of 2280	4924	msedge.exe	115
PID 4924 wrote to memory of 3712	4924	msedge.exe	116
PID 4924 wrote to memory of 1720	4924	msedge.exe	117
PID 4924 wrote to memory of 1720	4924	msedge.exe	117
PID 4924 wrote to memory of 4948	4924	msedge.exe	118
PID 4924 wrote to memory of 4948	4924	msedge.exe	118
PID 4924 wrote to memory of 1672	4924	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://projectx.lelefinn.de/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe6e2bc188,0x7ffe6e2bc194,0x7ffe6e2bc1a0
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,11770169532768076728,7385501149270612712,524288 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1788,i,11723078693430210525,642700241623604763,262144 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,7539213700221136965,6397894578954452960,524288 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,3518550604175086590,15631841079086166339,2097152 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,16675024423789510041,6688418411090209821,2097152 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,12207043718236791798,4590255775919437012,2097152 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,3550104790008139686,8264198191495455923,2097152 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,10612847130650227366,1792487204587887409,524288 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,8960198797271100367,15641716104464280199,524288 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,11489379093800493857,4778945983264285074,524288 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,11489379093800493857,4778945983264285074,524288 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,8953072841319660390,3240432942889646796,524288 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,13931385656247145021,11979609829804414131,524288 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,8020171769464850842,8045393628373629793,524288 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,11559774371992658736,5169033781587304637,524288 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,1424850135929466378,17118022472266120118,524288 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,15912056660149132357,3371329680417210081,524288 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6640,i,15296231650444199083,3414369947011151427,262144 --field-trial-handle=2304,i,13639951087664752621,14760364908044760625,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 79d12715eb7d904a63783349abd72756211877b50c9bd91e293448b2ca3a1134
MD5 ab0ba54a7b70a4c93cba74361414fc83
SHA1 9e22ded8abc60cc9721c3e0b36ad85c696c66cd5
SHA512 bc495858b43978a46ca75bb4cd8f7e3fc517ed6708c6ad0a1c4f485bb6b710d2c806992a0dbecf54eaf229a24da1f8a8ca9e08f38d1f23dfde5aca4c4fd442e1
TLSH
T10071C7F5A6C10895CBCAD370E2D21100FB3B71E9F90F7ED28C951AF45A07319A9D9606
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589815.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589815.TMP
Size 3KB
SHA256 6f6c30e6e53111c80cc31bb12bb17358c1be05b8549280cc0513ae26ea014b39
MD5 4fb853dd27ee40c4cedb79d4158cc1ad
SHA1 0297a3828cf466b467180d1f33fdc32a30275d93
SHA512 457e0f9f2204ad47cfa6089d347e872f83a01e7bce61a087a36e1e9e31bb6e0bf829a6f4ebcc0b9f56d5386f84d851f5db2a1f87061957d6736b5fe5b9418fa4
TLSH
T18071C7F4A6C10894DFCAD370E2D21100FB3B71E9F90F7ED28C941AF85A07319A9D8206
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8ff1c396832fcf0a940aa816bfcd32b914223dd3c954a6e3d815ac19d1dcd113
MD5 22330f7d70336783886bda9cc9f52970
SHA1 337696a9cc4f9e01b9bfec3fe9598b3b2b8e636f
SHA512 6ff9f96d3d4df25e2c2a227a4f322aa4497dac21900be5e9b7f849fea7a796bcd1af8d38dac9b8620c9f490fb67a633a70abc31934146a147e5c31ec8c180737
TLSH
T1AD41CFB3C3E4812DD92256F4AA286E2BCE1D0915436C3C69CAE4BF5B93E2470E101A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8d3284e35b8032acae31c40670a4b764fe34b615ab6936f66f9ec2e5b89f08e6
MD5 33d2b7e001ff9cc7a5c101603fa0a424
SHA1 95211e6fda24bb473e6d3dcd0093bab72eb2ca18
SHA512 23ef69c935b2914fcd9f4dde0b90e67a3e79e709bf8ac7a9a6e8b367e7d4701a363aafbb5aecc926411f2be5b85784e2df384ab67cbf0405a22d66d0a369373c
SSDEEP 192:sxZER4yM/jK1Ml8MkK/fOsWYlDIdpRcHW6+WNDPk/YzbOdeGIgrJ:sxZEWMK/fOsWY2SHbg/j9
TLSH
T12342D7166A349977CCCBD609FA457B53D6F90472E2940E44AAFCDA0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 05a93df3b18f58f6eaf592b6c61d6c7cb02d3974d11e07f9e4469f74603a619d
MD5 e8fdde4588373d773365c2cffc32b9aa
SHA1 87df853ec44d567114ddf137a7b64cbf37ba6c64
SHA512 1e96087e605ee6f4e00bd771e6045acfa2d9cef420d006bd82bd7148b488bcdc9bc244cb8dcf664c196a59b86db649d2477b7436753f957c419d07c3ed46d3c6
SSDEEP 192:sxZER4yM/jK1Ml8M9K/fOsmYlDIdpRcHW6+WNDzAXYz3OdeGIg52EJ:sxZEW1K/fOsmY2SHbAXvMI
TLSH
T1A652D8166A34997BCCCBD609FA457B53D6F51472E2940D44EAFC8B0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7d4b8a106a058cec852e0ccda0158408dfcbaccab70e041e5682476756922c8a
MD5 38eb328df13aa59146b443eb01bdca6c
SHA1 bdee0af654f46cae5d25cd02479c7487d5a2ccf9
SHA512 1a79aff37e5a4d010646ac054a6530dfa5c38d2b916a129fe8bb90ea65f42aa04ae4810fe22a32c85750b569a94a6c8cbe0574fc14635c553568525ac73ed04d
SSDEEP 192:sxZER4yM/jK1Ml8UQb9K/fOsm4lDIdpPcHW6+WNDzAXYz6tO4eGIg5QEJ:sxZEWqpK/fOsm42kHbAX/96I
TLSH
T1B652C7566A389977CCDBD609FA457B53D6F51472E6900E44EAFCCB0C04E2AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 71fbb8f99082b25ab55caa3601f2e88fe13bcfd02953d58f4943f73e5502df2a
MD5 22c19d64d3e77bc0a8dbb7efefebc985
SHA1 1c93cf8c9fa937dbb714b48533c31b5e9b0b6c27
SHA512 df1382b89da63b8368247909f9768ba746de48f1822aad84c4f24b0c7e13a3c027bca94986611461a8efa01083ec9f8b709ea866900e2ccfe6c17b01ba4ab08d
SSDEEP 768:JQW7kf0Wvqina8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj+roIM0XYe:JQW7kf0Wvqinau1jaa5LA3jV1e
TLSH
T11CE2FB3B680CCB7E4F841E5CEC266F966ED801CB66988D544BFA884C03CB6EB51165DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9f4044913cd22a17e0348017efd7f29a899fccd15d92db46e61fe23eb26b7168
MD5 9becdfbcb29db1f6533165691952f729
SHA1 5ff2fbfe7acfdd1dc155c0b235404b3f14346bb8
SHA512 3879d42ca40a1497ead4b57dc06372053c7276a470fa9d41c82357fa7500e44eb8bc56bf8b6d6c567c6b9e0d433f849e032eb8386a455213f1241d6e47162f73
SSDEEP 96:KIbCKcXfGKAIG8pUtJvPv693CJrZ6KDPr76/JhqTh16Km2:s69fy2
TLSH
T110914412703B4641387E2858A3668A368F827593385C64FF7BB848661E67E520DFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592f05.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592f05.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 27e14961f58e4cfe4d447d117cfa3ed88dd55222913a3ae1b8ceb51c6548c7a3
MD5 82c582a8e57b301292ea836814103361
SHA1 73fc9978a487d7fdf865eee61f75befdf7f03305
SHA512 cfc035a6595ea05ac9a6d84c3e6b4a5f47f42b7ecfc84fbe465621cd6cc15e29e2a0b60c6ef57209d0c0cd7f75fbbc9469d0273f88f2d324159076168b523d55
SSDEEP 192:uwLsNIBJQAJBbStQmiU1Bhb4aGBPKZX+FdGumHqK+2PRkr7dNQqTDc0T:tsNIvBbgVExd5ml+2PRk/BDtT
TLSH
T157422B355C389D275DA2A545F54B37035FF8816BEBC42F94E6ECAB0C01DE6AC230A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 bed2e0c05ca57a68716d2541e8857729dc1605e8d9177f9a91b67f2fb32c8395
MD5 9ecb2a209beb874ef86bf641495cf2a2
SHA1 c4d5d407e1e25df8c7b38259268578b4894392af
SHA512 4553c32e80984d0820b145e8887cb8f7f6a37b9ffac2a9718a71dc46a395ba30ff13021d0ab4fe1d58af0d74af74a8903942270b879d9e02e749c354042aa9a7
SSDEEP 192:uvLsNISJQAJBbStQmiU1Bhb4aGBPKZX+FdGumHqK+2PRkr7dNQqTDc0T:4sNIyBbgVExd5ml+2PRk/BDtT
TLSH
T10B523B755C389D275DE2B545F14A36035FF8816BEBC42F94E6ECAB0C01DE69C230A41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4ee3bab7ef1792f217d480b63b350bd78229c6ad85833428e80043a9b036d9dd
MD5 f8204e026f436b58f6698ea2dc11ad2c
SHA1 5a5eb3820c9c66536af8139c231ce6668ac19978
SHA512 dbaa4f324276c1a218aec64dbf6efa85aa3df9259a3d794f6a39eaa259d4d9183fdc7c6fb5f7849f76015835c367645ee2403cc2a9666806a5b56ab40e0e13f2
SSDEEP 384:liFiZcImzsN48TUNTUlIlvBbgUExd5ml+2PRkYBOObjI9G6w7mAW:sFQWxwgfR4gleYB29M+
TLSH
T1B1D218F248D78936E9AE9703E77D2E174EBCC067B6845A84B3D89A0CCC565BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a89a26cde089653986e65be6a01e498d46af5e09e6e8a28bf9b98912a8c08b0d
MD5 13d41ad1614d96d2d40f51dcf68ccf0f
SHA1 c8df952a3413099833addca3c2216493acb61f37
SHA512 4628baf7d2f324d8080bb03e0a96b5ff701438b39de6f24620e3c032fce5dbcedfb379415edda992ea1e5ff2c71fc7e2510d9357803bc5503ff72539204144d8
SSDEEP 192:MONC64BAQmiUyj1eW5GBPKZX+FdGumWaDSTU6:MONC6eAwwW+d5mzYU6
TLSH
T14C020B349C787C7B9EB2BE45F58637175FD8102BE6842B44EAE82B0C009774C234782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7a78c6d3e7dbdac8a97b970de514a444ab2afb8fa2d229f903c9eb63cd230602
MD5 8506e432ba601ae623074cf1106caa9b
SHA1 f0ece99dfc701fac70699fb5932b988d803dcb80
SHA512 f386103372a50327857d475e15cfe01ec012431648f555c0cfd08831052de565b091e14c891d6fb89237ed34a095c9a67fa63bb60e1b81f52205d20215afde37
SSDEEP 384:ZZcIhsNIvBbgVExd5ml+2PRk/BOObjI9G6w7mAW:xhRw4gle/B29M+
TLSH
T10C929E355C345D37A9A3F515F48A3A175FF8917BE7C81F84E1ECEB0C05AAAAC130681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e66eb1216d6b4a2ee3cdd8cb91227015ffb2ecbe3d8a64cfc33358070b130725
MD5 d00d0229407f2bfc3bf1623461415408
SHA1 3c3dace89bf0f7e6b258cfb94186b539ce8b25b9
SHA512 748888eaf9b1c432954546e632caa9ecff9d4ffa9859cc1150e62286c1975daa8cbdc68e89758633728c72ade3ea96e90041c6f8c474f07d8c63e28415ac8d2e
SSDEEP 192:yONR64BRQmiUyQeE5GBPKZX+FdGumHqK+2PRkryWwQqTU6:yONR6evgE+d5ml+2PRksBU6
TLSH
T1381219359C74AC2B5DA2B545F08736135FE5412BFBC56F84E6EC6B1C01EF66C230A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46cb3dfb-98dc-42ea-8996-0fdfb016b1b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\46cb3dfb-98dc-42ea-8996-0fdfb016b1b7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 93caee8995d18ea3d368f717a6879e5e54d6d9afcaded88aac51f2318fb39460
MD5 1d9fc2bc448113e6c2cd336cd132fc1c
SHA1 a48d343d6d94153adae21c4516c6f0735c874c63
SHA512 969857ae60395dfed45805cdf1d10236ea6d7df0fe9b5d5a2c46cc35145c64ef2b4f2b2bfd975debe6538d20e6c2ff194d93fd4dac203b1eb0b4b891ec66ff11
TLSH
T1C441FA98B6FA0148B3B76F565BF6A86E447FB9372F0AD55E00110D4F0663B40C962B3B
MD5 SHA1 SHA512 TLSH

Submit Download