b5628bb09ed9c234706e78362c31fd1152dd8ff3ac1954dd95da351ea5291f48

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fitsal.html
Size 11KB
Sample260728-pkr1eahb37
SHA256 b5628bb09ed9c234706e78362c31fd1152dd8ff3ac1954dd95da351ea5291f48
MD5 47c5b05a9c38a63981fb2af7d3b905fd
SHA1 7399b838a4c486df9c770148532c060a1e3b14de
SHA512 eda68bb693c17d854d0140557691f45a9a58e10a20535340c454860678ababa5be2be96bc75f7f47178ddb5e7d13e18ce5f9d7d97076f500cdb5828b0914ff1d
SSDEEP 192:772q6mE94jTZLox1JJx4RWUSR2zu70emijtmFZHKizLiTiT4BdlhwTXih:7ylR0emi8zKi3iTiT40TXw
TLSH
T1D832D8627688043D66B3C1A971B5AB44FF36C107EF41019A34AD2A971FFBE414977BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
41	api.ipify.org
42	api.ipify.org
40	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1888	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297150281128872"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{BBC1B8A6-48B1-4ABF-9A72-EFE5EE22CA84}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1808	msedge.exe
1808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 3112	1964	msedge.exe	86
PID 1964 wrote to memory of 4420	1964	msedge.exe	87
PID 1964 wrote to memory of 1888	1964	msedge.exe	88
PID 1964 wrote to memory of 4420	1964	msedge.exe	87
PID 1964 wrote to memory of 4420	1964	msedge.exe	87
PID 1964 wrote to memory of 4404	1964	msedge.exe	89
PID 1964 wrote to memory of 4404	1964	msedge.exe	89
PID 1964 wrote to memory of 2432	1964	msedge.exe	92
PID 1964 wrote to memory of 2432	1964	msedge.exe	92
PID 1964 wrote to memory of 2432	1964	msedge.exe	92
PID 1964 wrote to memory of 4360	1964	msedge.exe	91
PID 1964 wrote to memory of 4360	1964	msedge.exe	91
PID 1964 wrote to memory of 4360	1964	msedge.exe	91
PID 1964 wrote to memory of 1636	1964	msedge.exe	93
PID 1964 wrote to memory of 1636	1964	msedge.exe	93
PID 1964 wrote to memory of 1636	1964	msedge.exe	93
PID 1964 wrote to memory of 4948	1964	msedge.exe	94
PID 1964 wrote to memory of 4948	1964	msedge.exe	94
PID 1964 wrote to memory of 4948	1964	msedge.exe	94
PID 1964 wrote to memory of 804	1964	msedge.exe	99
PID 1964 wrote to memory of 804	1964	msedge.exe	99
PID 1964 wrote to memory of 4676	1964	msedge.exe	98
PID 1964 wrote to memory of 4676	1964	msedge.exe	98
PID 1964 wrote to memory of 3536	1964	msedge.exe	101
PID 1964 wrote to memory of 1548	1964	msedge.exe	104
PID 1964 wrote to memory of 3760	1964	msedge.exe	105
PID 1964 wrote to memory of 3256	1964	msedge.exe	106
PID 1964 wrote to memory of 808	1964	msedge.exe	110
PID 1964 wrote to memory of 808	1964	msedge.exe	110
PID 1964 wrote to memory of 1808	1964	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\fitsal.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe8b7ec188,0x7ffe8b7ec194,0x7ffe8b7ec1a0
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,2605378096034138009,6496596346301788698,262144 --field-trial-handle=2368,i,9662707517490507071,3602586310121381608,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,16276330003053444885,13452879808948643251,524288 --field-trial-handle=2368,i,9662707517490507071,3602586310121381608,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,18351298786664024057,17645420770258364725,524288 --field-trial-handle=2368,i,9662707517490507071,3602586310121381608,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,17046558106309866408,13053030865663874008,2097152 --field-trial-handle=2368,i,9662707517490507071,3602586310121381608,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,18420100356816712403,15141746839882548609,2097152 --field-trial-handle=2368,i,9662707517490507071,3602586310121381608,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,1333246543616494095,6776688607105835783,2097152 --field-trial-handle=2368,i,9662707517490507071,3602586310121381608,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,11371224869286015306,2283431833015262430,2097152 --field-trial-handle=2368,i,9662707517490507071,3602586310121381608,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,708265568606172648,9797141567954949805,524288 --field-trial-handle=2368,i,9662707517490507071,3602586310121381608,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,14239447143051564691,8697048765431328604,524288 --field-trial-handle=2368,i,9662707517490507071,3602586310121381608,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,3957750978796312011,15991889022382012122,524288 --field-trial-handle=2368,i,9662707517490507071,3602586310121381608,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,3957750978796312011,15991889022382012122,524288 --field-trial-handle=2368,i,9662707517490507071,3602586310121381608,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,17357534135118743041,4689395082375898147,524288 --field-trial-handle=2368,i,9662707517490507071,3602586310121381608,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,11229257069687429324,6465408260379172869,524288 --field-trial-handle=2368,i,9662707517490507071,3602586310121381608,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,6793935762006848865,2594729257310681062,524288 --field-trial-handle=2368,i,9662707517490507071,3602586310121381608,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,5734624440732897254,2121403502901998647,524288 --field-trial-handle=2368,i,9662707517490507071,3602586310121381608,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2056,i,17292937275733166821,994802508220267426,262144 --field-trial-handle=2368,i,9662707517490507071,3602586310121381608,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1259f296647864f2c4f56894ef3849cfce3fb7844bf15a470d2382dfc547f39c
MD5 710f2d1be1300808a397cceeb57b9179
SHA1 a453f90a7292a91140dd8931a5efe0d7d66b7362
SHA512 5ac399107d8a0eeb793e96d3596cf6e87da3acf990359f4a39a2b97051369433247ca8fc3918472cdda7377e627d05b15de8394722a75ad2d860b61cd349af2f
TLSH
T15E713C19CB834C53EB018E35D7F102B175328BA84A6F5DBA2174CBFF6E0EB258519D29
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b457.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b457.TMP
Size 3KB
SHA256 bb0c6b1397ff9734c2bfe8ae6891d45b724bc13e22b698a9a2577b966a6c9d64
MD5 c83333098d6060b842944648ef5e4e9c
SHA1 5c65010375b8cdbf327452557f59fc60a851f0c7
SHA512 bb04178d337ce133cac2797bfbbdcee042f41331ae91869aa96eb68eb39c79b3adc6cfec3a087b4afe3aeba6491b0f154dde328c96b02354980d437eedb255f9
TLSH
T1B1715F19CB434C83EB018E34D7F102B175324B98466F5D7A2174CBFF5E0EB218919D28
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e1879d955e5c73f6ecd0c1491f01a2f07a3ec114f62df5d3925c42f06c387011
MD5 5de752fce3540294ceeba8872cea1138
SHA1 2becacfafb7aee2a8e31b5852e502a85d2a96d66
SHA512 308bd57de7360728d0c944f4db425ec684134ca33e098abb3f992f11adcb7935bd66c15791e63d0a83bcdab732e846c8238468f47caac9c10543039ca25e3ec5
TLSH
T12D517EB7C3D8867E890156F0AA25AE27CD1D0557822C3C1689E4BF5FB3E2471D2012AF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c205a7f10e45bd101c414db8a662b9057caf5adca0f644ee1e5ddf48ddba6ad1
MD5 92044ceba60021e5e913b8eda3a2c6f6
SHA1 ee2c00fc3ba01f0aea81d10bb7c6cfa887668b1a
SHA512 03f1ca610909197a807ab5e67341850d521a91c23ac0e2ad04d721b2fad4837ca36b50cbec86444d9b3bd9e83d5991b57c754fdfb8d0754615a2435ff2a2418d
SSDEEP 192:sxZ7R/yM/jK1Ml8MksH/fxgsK6oDKIdpdryHW6+WNGYwKzp3gIgrJ:sxZ7tMq/fusK6oXVyHbGf9
TLSH
T1934209166B385977CCCBD209FA517F53D6F94432D2940E44A9FCDA0C05E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8e826c80e9e1601fc49deae9cad14c343d8ffd70a963bb37bba8d9bd10da67d8
MD5 81acfb0ee3ccfb707eea17d14dd8cbfb
SHA1 0947ced8c8f20aca54c46da5f8af61940cc3af6e
SHA512 bcd6a274b80339e463c80a879b92a1bdb5c96ee5c7b240747224b853459acb9ef0e5154746478f7d20c55212a00d3463f72a8032175de1608c2e7964cf2c68f8
SSDEEP 192:sxZ7R/yM/jK1Ml8UQdksH/fxgsn6vDKIdpHryHW6+WNGYw2ga+3gIg5jOJ:sxZ7tq2q/fusn6vXLyHbG2js
TLSH
T1555208166A385977CCDBD219FA41BF53D6F94472D2900E44A9FCCA1C05F6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ca149d6f0312065aa48f1f3514d3c43adc82f0f00d5a7804064ff8eebaa65114
MD5 d101ff0186aff49d3cb42e03e91537fc
SHA1 fb4d7264b1479528e6160a63783de85fa1acfcfe
SHA512 2cd7871ae37805af84ca29e7912e8676e2d03d7120d8e7e5fcb0c1210906ed54143258e00023e8630c4d3f8ad67c327bee1a3f96455fb6e15c912e6c978ebed9
SSDEEP 768:304jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dkrohmcQa4:304jeXmWvmKLEu1jacPLZQdvzc
TLSH
T1EED20A3B284CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5eddb0d32718d39986936cdf4ca3746a1e6aff61e01e49b07ab5f5437d6190b8
MD5 c3dcb47fb6086e820720935fcc795669
SHA1 7e52c452fd31ba5f848e4041118f4194847d823a
SHA512 0e5c784bded67b3b710db368760f964f1b4208c66178e1aa2ad5f6804377d596a95a5e4f14cd931592168da446128731a0717bcc1d37082bb41c9c96b0a3d550
SSDEEP 24:Kdk/fkGkNkEakhdkVklk14kBk9+kIIjkhk1Kikyhakvk11EkHklSmkvMkq8klkON:KA1IBK2s8rydTI1K8cQUrIFKkkYjyo
TLSH
T1F191344275BB12827C3E654C93D0A62A9F81B1637059B8AB3FA844750F27E250DFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2fa9b7283ee878cf9dfa05138a67a031e2062e4bbe1e29a9cbb06fb7cfcf11f0
MD5 f3f50ee3869f99d55b444634eb4706c0
SHA1 9d083e6930728f360c68b846bb5fddc7ca43efb7
SHA512 dbe04b9235570b9497897f6455a95c18bf75f8ac336edb9f17397171b21461b87f393249b9c0d89993fad992ec236edea40330fdb55a46f83518916a35e1651c
SSDEEP 384:wZcIhsN5dbvGcf+D8h8RX/KFGOObjI9G6w7WrK:OhZ8n8/8G29MCK
TLSH
T145928E326C38ACB759D79652F48A35134FF8913BDBD87F84E2FDA71C049A9AC1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8b65cfe5612f7a07053949e9b40d7ee742bbb1933d026c892142e87c6ca2d9dc
MD5 e1f6dcbd389829d7be8754a2ab69d24d
SHA1 2ffca36382fd7d6cbd04b9ec4d3c306fb4f46483
SHA512 b06cea27bcffdd14a2ce28f2ed8bff364143457eaf8eaf2b5612a34d12647eac39ba394d20e3fc2399638cf142c4cbe78135562e7968a9c68793465ff0bcad87
SSDEEP 192:EONnF6hZ0QmiUySkpc/+jVpjzoruo8a5wOZuaGU6:EONF6oqpu+D8h8h26U6
TLSH
T1D102C8356C686CB78EE2AE45F48726135FE4113BEA956F84D6F85B1C00D769C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6b4eac0ff12c9856a268fa3a687ce827ca24a9dd0f2cebfd15a991815f7e421e
MD5 f8319539dcbc7cf29177a4bd07bda8f9
SHA1 10c422c79a7188a647aa0852b0a60bb6983228a6
SHA512 0232ad7be6fb8022771984214a0a8448223001434a0b5e5bc1bd9b44c29dc74f6d38818221bd23c42d452fd112f52690b8b125f0afb10ead849a74645196c2ee
SSDEEP 384:QZcI26zsN5kbvGcf+D8h8RX/WFGOObjI9G6w7WrK:uBa8n8/IG29MCK
TLSH
T193929F326C38AC7759D79652F48A35134FF8913BDBD87F84E2FDA71C049A9AC1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 607e5d020e681fe60debb71261ea8bd69a5144c8a4c5695426ffb9930afc8308
MD5 d795559e0e0f2980b4242d4c4ce77cd2
SHA1 6c6bdebae182d8d709e5c78cbe6af0ad1d9cc2f0
SHA512 22ec2a73d3cb7933ba80bb3cea08755ee819484a85ec539b44dce1a8589995d665901645ba802772056201b37baa4b15cbee00819d166cc9400e22380e3b75b7
SSDEEP 384:PZcIhsN5kbvGcf+D8h8RX/KFGOObjI9G6w7WrK:Hha8n8/8G29MCK
TLSH
T14A928E326C28ACB759D7D652F48635134FF8913BDBD87F84E2FDA71C049A9AC1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e909f9e4599a57c180eebab1f943cee00df414da3b8cb27e0550b7969c9fc79
MD5 2d5caeb0e92f4c3d0e443f243d2da08b
SHA1 3373831188c1304633542ce3fc91dbde5737fe16
SHA512 3552404fb55093f587ece10680edabade28f6ed1b9140360ff81cfc6d97b6a874cb7311d0abf8e7f26bbacceef8d148dffd2025c28fda940d9705e405a6cf91b
SSDEEP 192:HJONE6hZfQmiUyUkMc/+jVpjzoruo8RX8EPG5cOqu3q/GU6:pONE6V+Mu+D8h8RX/h9GU6
TLSH
T1E312E9366868AC6B5DD2A695F48731535FE8512BEF857F84D6FC2B1C00DE6AC2307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34477e76-b533-4c57-a76b-2f4f4665a8c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\34477e76-b533-4c57-a76b-2f4f4665a8c8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6726c908c11c3396a803be2f23f860bc31fbe4a4ff8de247628748da4b22f064
MD5 169f6508272ae4f00cf8e283b812852d
SHA1 9419c25ac434c22e3347de22e700465e1d30d170
SHA512 1679db0f9f72897374ffa051f981ea6080d500599280bde9d0b111d56d74ba6a675a3feca8042e38e3eac8b3f6b09c13954b90e3e02620afde83aee735742ba8
TLSH
T12741E75CAAEA1148B3B76F4A5BF6A96D487F78772E5B919E10110D4F0623B00C8B1B33
MD5 SHA1 SHA512 TLSH

Submit Download