hxxp://whitetruffleproject[.]co[.]uk

Analysis

geolocation tags

eueuropefrfrance
max time kernel
149s
max time network
154s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
04/08/2026, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://whitetruffleproject.co.uk
Sample260804-lysmbahb76

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3548	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303110352217115"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4146128427-3460078792-3629963422-1000\{69AF8729-1CF3-4229-B77B-DAABF3F1B7F3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 3128	2636	msedge.exe	82
PID 2636 wrote to memory of 3548	2636	msedge.exe	84
PID 2636 wrote to memory of 3236	2636	msedge.exe	85
PID 2636 wrote to memory of 3236	2636	msedge.exe	85
PID 2636 wrote to memory of 3236	2636	msedge.exe	85
PID 2636 wrote to memory of 1392	2636	msedge.exe	86
PID 2636 wrote to memory of 1392	2636	msedge.exe	86
PID 2636 wrote to memory of 4616	2636	msedge.exe	87
PID 2636 wrote to memory of 4616	2636	msedge.exe	87
PID 2636 wrote to memory of 4616	2636	msedge.exe	87
PID 2636 wrote to memory of 2344	2636	msedge.exe	88
PID 2636 wrote to memory of 2344	2636	msedge.exe	88
PID 2636 wrote to memory of 2344	2636	msedge.exe	88
PID 2636 wrote to memory of 904	2636	msedge.exe	89
PID 2636 wrote to memory of 904	2636	msedge.exe	89
PID 2636 wrote to memory of 904	2636	msedge.exe	89
PID 2636 wrote to memory of 3144	2636	msedge.exe	90
PID 2636 wrote to memory of 3144	2636	msedge.exe	90
PID 2636 wrote to memory of 3144	2636	msedge.exe	90
PID 2636 wrote to memory of 1428	2636	msedge.exe	94
PID 2636 wrote to memory of 1428	2636	msedge.exe	94
PID 2636 wrote to memory of 1428	2636	msedge.exe	94
PID 2636 wrote to memory of 4408	2636	msedge.exe	96
PID 2636 wrote to memory of 1892	2636	msedge.exe	97
PID 2636 wrote to memory of 4408	2636	msedge.exe	96
PID 2636 wrote to memory of 1892	2636	msedge.exe	97
PID 2636 wrote to memory of 2136	2636	msedge.exe	101
PID 2636 wrote to memory of 4700	2636	msedge.exe	108
PID 2636 wrote to memory of 2088	2636	msedge.exe	109
PID 2636 wrote to memory of 5068	2636	msedge.exe	110
PID 2636 wrote to memory of 3552	2636	msedge.exe	111
PID 2636 wrote to memory of 3552	2636	msedge.exe	111
PID 2636 wrote to memory of 4812	2636	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://whitetruffleproject.co.uk
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffe94cbc188,0x7ffe94cbc194,0x7ffe94cbc1a0
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,5363123747648815130,33255557331468753,524288 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,10669945377839282130,16176241879367625962,262144 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:2
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,14295930947716636604,1393693750586393833,524288 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,759148074980561217,18024216320308777873,2097152 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,13795597836941969706,3282861886993611231,2097152 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,13857795690267350173,12912313756833985639,2097152 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,7065691625651421265,17687898079031845950,2097152 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5112,i,14913449246462136084,14224220879813369356,2097152 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,1361315197860108786,11046805930014817556,524288 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,18195522096603656791,559014934313003035,524288 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,7855210847400242383,2319889449732868654,524288 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,7855210847400242383,2319889449732868654,524288 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,10457824384175590803,7048250274083615972,524288 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,14211547804926045033,13320013569508879648,524288 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,2217792856474708091,2186706045208187842,524288 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,14089990406849592637,17979022381207562345,524288 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,18211350427567025709,17525942023519714439,262144 --field-trial-handle=2720,i,4006467736054074853,5478912828184519316,262144 --variations-seed-version --mojo-platform-channel-handle=768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 aa0d78ec9cd90e7c6714bdce5235de1fc6b7c3088a6cd8f6e6d2c1cebea7d661
MD5 63134f635628c0af90baed8399868c70
SHA1 0a02b0ee6e4253e3534f292530612cd9f5f16106
SHA512 3c98f5f62643131db7887f04a33b0ca1c1c00b00c63332d61c392e6bf04039e1f5ce53adff3458c5b96f00e8454a916a07ab2c53d268c7a0bedbef781bef81f0
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
TLSH
T123B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e51b9bee3c2dbb63afcbacc2cde944a53371e66aaf1c8ba0bf71c7ee6eab83a5
MD5 2857cf1b0f1c8c30a6b756a34a37a836
SHA1 b21564c162ba15d8314ad459931f7f7c36b82ddb
SHA512 9fbd8c2a41b37b8a8425570de1371b59602556a9f89dcecaf471ea286b3538f518e368873fcf7b34ac36d9a7de7577953a1abe80c4995e05e1202c1b270d8dab
TLSH
T1F9D012232A5DB011FB695274A812CB00173655A024868711E211C49C96741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7a531d1df9cdae01b650e532ebd4a8c9a4289931e89fb896753dce715d03331d
MD5 e993dcf44300205328a008fa868eaab8
SHA1 005ea0762927bd4df122a5932c9a47e268573e57
SHA512 021dc142847ba30397366fece985ced0649c66fc9ddfa58b99261463107dce9ca4fc43a79aa0b2985989883dd5a6644c2fe5b1c87d24a8455123f7d724943ff2
TLSH
T1D6D012232A9DB411FB695274A812CB00173655A024868711E211C49C86741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b1168af480492d4e6e804453e31c7e6273c5bfb0f2925d2964bdc7780b5f0074
MD5 9065b1738a3963f310dd8cb4dc8c27cb
SHA1 f2f6766bee161231393fd185ac044f4084fcf8ea
SHA512 e0f7058ead0821b69b7b8a139b8939ce36eaea433e30a803752f70408800b90dc5c3bab7fd21ae50c5db0f3cd5d3c6a2949e3cb5654f78c91b4e5cc64b21b021
TLSH
T17C811B260BFAC8B4EB561030C0D2D5CFFBF2479C462F6F66912894F6DE0BBA20051998
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586731.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586731.TMP
Size 3KB
SHA256 864cd0d1a646714117339ba45aa59f4431439d73374af41b5da5d6846040cdc0
MD5 ad3207eaeebd1b004463f1c88979ae4c
SHA1 7876236557947777dac546f77479227be033cbe4
SHA512 7207e54bee544df4ee15da9a3f13e6d5c1a51186a436b4dbde7232596593780aace8db4fcf7e1ab475536085e3c43009a6916e8ee7ba4c26919dcb0549978400
TLSH
T168713D260BF2C874EB5A5030C0D2C1DFFBF2869C462F6F6A917194F4DF07B6610649A4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6123d756b4ead4a898c424d823f2e6ed10b6dd3a80b096d2f91d76205d35019a
MD5 f93de349f0d813983d506b2b6417143c
SHA1 bb22024d7923d6e9790afb52e3eec19dd73d727e
SHA512 28093910103665ecd723ef3c6b9c917b53ee8875e9918c16ec10c55071a194ed54edd1bac9b1900a2ac8bc9bf914ace83f589c80cd76b05d912fede236672bb7
TLSH
T11651DFF6C7E9851ED91199F0A624ED17CE0D091587683E5586D4EF4F93B2472F200A4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 431ffce9cd50b42e4f2dd9e06f957f235b5b4f2ec77caf90a92def257af119f3
MD5 3ba5d164a986cbabdc10bbe41bbc2838
SHA1 4b3542a234920c7e00aed631ee21bc0a0975978d
SHA512 684aae5052eff93ed0457e527441b1faef2d97a62d330d279b0c1b32a3e7eddd9a1606c91aa911eb77dbe6278b9462871a48007dd65ff16d8db04ed203ba2514
SSDEEP 192:sxZdRIyM/+K1Ml8UQ1kF/fcsfTqjtMIdpIidOHW6+WNeRdYchY//YcDYYivCTIgN:sxZdDq+F/fcsfejLIoOHbePYKY//KYRN
TLSH
T152520912AB349977CCDBE20DB945BF53D6F614B292900E44A9FCDA1C05E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1b553044503b6cc66a2a64a415939a5bc23e1d4b0941bf1db1b4752ff4d3b655
MD5 95d8f2687d4cb74d521778ddfe2b51f7
SHA1 0c8e22575145e5e95902f85d94930d935133d9c0
SHA512 32284318f7aeca9411dccac09389e42bbabbb855e7a5521b7d83bf033c792c9d2e4a4299874860d6ef84a33a55edf92516aee59c30dc7918c431eee064347236
SSDEEP 192:sxZdRIyM/+K1Ml8MkF/fcs5TqjtMIdpeidOHW6+WNeRdYchY//YcDYYxQ/TIgrJ:sxZdDMF/fcs5ejLeoOHbePYKY//KY29
TLSH
T12452F911AB34A97BCCDBD20DB955BF53D6FA14B292900E54A9FCD90C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9547815436a6f5b56a29d4218742f93c83a52c19744466e0f25143e1ca6b9eef
MD5 377c380642582c3ae688d345f7c43b0e
SHA1 b7239f493f62ebee98e044be58f2a492a2d59242
SHA512 7ad2e43eadd50bc14aa339db03b04d4e776552ddf0be68992954d984e9df4f77ac5d19e121e594342eaccc250589231c3db138e631502b7168cc0ce641eec17f
SSDEEP 768:k74RkXUWvssLg8F1+UoAYDCx9Tuqh0VfUC9xbog/OViTLlLBERnro2MQ7cfui:k74RkXUWvssLgu1jaDTLBWR0PO/i
TLSH
T152D21C2B284CCB7E4F845E9CEC26AF966ED802CB97644D5447FA844C03C77EA511B8DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 1592cda1da9ccfdc49c8651ab0e94c7c7724df5701075f92e7d552e200dc9643
MD5 c36fe60bed42ea54b31850f0592a7c50
SHA1 039295d360e06f94bfc835436298635dbc9edd2e
SHA512 6428fe6027199a81ff2c7045fa551ff696a608e82ec49312c7dd12b2ebd7b8711ad159f2f2320c7c17aaa6d307a578b82ab6d136e530fb0a64d3d92de349ca98
SSDEEP 96:KUQwKl2CWFWKGgKqEQKxS++kKTaGuJ2K6konAVZXJE:yLVp/ijZ7nAVZXJE
TLSH
T18DE1E003703A06453CBE351CA2A296378E4271737118F6BF3BA900661E6BF654DBE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f70d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f70d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0c09e3d6f4895ad5feda8720a6ad94ec414bf396ff807b8751484e9108bcbdab
MD5 f6f8bc1d647a47eb0bc393e7d289dc22
SHA1 ceefddbcf3601cd6f6e62566ef27536c0c993385
SHA512 48267e07e8936f1763fa5d26c9fd66547a65d67819f816a58ed90ef46268789f0ae2df1955712f39f2585e4dcdf04fcf07d08f3e48faefd0280c918b0ca4d4ea
SSDEEP 384:SZcIhsNOkzwGG0dQ4sw2etFmJwXC+2gnjKDWNv+xQA2i2:ghLEpWJAClgnjKDa2xQAo
TLSH
T18E928D31ED786C6A1DB6A309F84736134EF4916397C8AF6492FD6B1C01DB2A8131E827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 17d3cf48153579a44d74a96b018fd93ccd934a1ce892ea2f1c03fbb472151b2d
MD5 a267ff173116e6f2f10ea8df152fcc88
SHA1 621303e00b7d7b6ca45407b849c02786d75abed5
SHA512 bb3b5b0d577839f306d61ba4cb0ff64572aa2776ae469a07015ed0b1739ced7094170c8d96e9bf6fb53c1f3c20e83207ea58d6a2c2230148d68f591c893242be
SSDEEP 384:0iFiZcI4zsNe8TUNTUlIlkYwGT0dQ4sw2etFmJwXC+2kzjKDWNv+xQA2i2:PFQE7wg9EpWJAClkzjKDa2xQAo
TLSH
T13AC24BF299E7983AD9AE9707A77E2D134EBCC063B5849B50B3D8550CCC9617FD30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e5fb6b106d19318d25a21ae2691ddf5a78332bbf1e95cd6c8eb51ecc9f9f9f1b
MD5 db77b4ef4625f42496625eafd01de06c
SHA1 974931793f558af9056bfe72e3fdfa7d29bd4326
SHA512 eb685b8b2aec66256a9a9553a7ea08feb511aabe55bd991bb58e07ffc7b8492d0e440ee74f944050eeaa258fe36a2ffe40ada3640e5937fc274eeb19bd49a7de
SSDEEP 192:lONe6JpdQmiUykigcQ4sw2eRjzooFmxsFHjVMLU6:lONe6jMgcQ4sw2etFmxkjWLU6
TLSH
T1E902D935A9797C7B8EF3AE45F5472B236FA4117BE6946B04DAE81A0C00DB24C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 40f50e7464859303dedb0f1a183665e2509a85455e2e74187c1a201f7beb31c6
MD5 26595d73ab09077f0318b313cba7bff4
SHA1 af87045a2fe2be3a6482a98431316c24538ae03a
SHA512 a8d869a65b8780c6fcfd0d45596a39e2447c34e2aabee16f69ac769072844eb0745bc11ae4daa3da32f8c0d1bedb8f7d9b232bfd21a4182ebbcbeec1b03bf7ec
SSDEEP 384:YZcIhsNOkYwGG0dQ4sw2etFmJwXC+2gnjKDWNv+xQA2i2:mhUEpWJAClgnjKDa2xQAo
TLSH
T188928D31ED786C6A1DB7A309F94736138EF4916397C8AF6492FD6B0C01DB298131E927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c6703974bf576a7b7e17a166a347143ca7870152caf4611b2dd7b8056b5485a0
MD5 d44cfc92cfe076ed1d130f094a56b9a0
SHA1 50a19c8341aecd0c4d951baf548718c58435a122
SHA512 000034530b52cf8b9ea76cb11814cb5d8bd64ed7c46afe0a45982b3e825b74ad4bb741b48b2f203bd2659e8c85647a8acbd1f4c3a01a9784d7fc302a892ba82b
SSDEEP 192:4ON/6Jp2QmiUyPiUcQ4sw2eRjzooFmJwXC+27shsjfqNU6:4ON/6q5UcQ4sw2etFmJwXC+277jKU6
TLSH
T1BA121B36D978BC7B1DE2A945F4873A239FA55127DB88AF50D6EC1E1C01DF25C130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8b69fc1cb113ff1c88e1524890df918f2cd8ae817183af36c3d4802294286621
MD5 57002d26068551d1ad35905c2ea44649
SHA1 37be6d83c1e7aa4ca002774ab858cf0eb654ab06
SHA512 a991ce305ddb332f0047e30d1f74af1796973336fa2bfd352e95089deac167b05a3fd51b7b4399013ef2a51580ec2ef3adcde1071df6ff609c529af1c96bec02
TLSH
T1AF413858BAEA0158B3B76F569BF6687E487A7D772E06C49E00110E4F4726B40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download