62f8a26f7610070f64051d5d09118f3d616b7c2e0ab87ac007f151db6f5478ad

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rsignn.html
Size 16KB
Sample260808-ah91wawbme
SHA256 62f8a26f7610070f64051d5d09118f3d616b7c2e0ab87ac007f151db6f5478ad
MD5 6d6ffb2dd175f5b78a668414f2656e6f
SHA1 c72ecc19f2b9abec994c7430ffeac243276a7aa2
SHA512 7a05594103d8c51abe6091edbee8bb26d54a1bf1afc2ec544f52f2bc8a443ff9877b25c29d50000f9ba29b08e226a5cd9e9ede042f13aa47e6a91db455ff478e
SSDEEP 384:OOAc1XbWxrB30zIgi+igPizici+ib30KB0C1:zAcxWxr10CP9WRP70W0C1
TLSH
T1FA729206B8850A961933A3A9AF76870DFF66411B4600C7187DEC76929F71F09E523FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
67	api.ipify.org
68	api.ipify.org
70	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5556	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306216519370869"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{C02F259E-CCB6-4815-A718-60BE9D273D00}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1080	4348	msedge.exe	89
PID 4348 wrote to memory of 5556	4348	msedge.exe	90
PID 4348 wrote to memory of 3212	4348	msedge.exe	91
PID 4348 wrote to memory of 3212	4348	msedge.exe	91
PID 4348 wrote to memory of 1324	4348	msedge.exe	92
PID 4348 wrote to memory of 3212	4348	msedge.exe	91
PID 4348 wrote to memory of 1324	4348	msedge.exe	92
PID 4348 wrote to memory of 2556	4348	msedge.exe	94
PID 4348 wrote to memory of 2556	4348	msedge.exe	94
PID 4348 wrote to memory of 692	4348	msedge.exe	95
PID 4348 wrote to memory of 2556	4348	msedge.exe	94
PID 4348 wrote to memory of 692	4348	msedge.exe	95
PID 4348 wrote to memory of 692	4348	msedge.exe	95
PID 4348 wrote to memory of 252	4348	msedge.exe	96
PID 4348 wrote to memory of 2512	4348	msedge.exe	97
PID 4348 wrote to memory of 252	4348	msedge.exe	96
PID 4348 wrote to memory of 252	4348	msedge.exe	96
PID 4348 wrote to memory of 2512	4348	msedge.exe	97
PID 4348 wrote to memory of 2512	4348	msedge.exe	97
PID 4348 wrote to memory of 2188	4348	msedge.exe	100
PID 4348 wrote to memory of 2188	4348	msedge.exe	100
PID 4348 wrote to memory of 2764	4348	msedge.exe	99
PID 4348 wrote to memory of 2764	4348	msedge.exe	99
PID 4348 wrote to memory of 5788	4348	msedge.exe	102
PID 4348 wrote to memory of 2628	4348	msedge.exe	106
PID 4348 wrote to memory of 4488	4348	msedge.exe	107
PID 4348 wrote to memory of 5112	4348	msedge.exe	108
PID 4348 wrote to memory of 4124	4348	msedge.exe	109
PID 4348 wrote to memory of 4124	4348	msedge.exe	109
PID 4348 wrote to memory of 3008	4348	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\rsignn.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d4,0x7ffe8a01c188,0x7ffe8a01c194,0x7ffe8a01c1a0
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,8413701012637166368,1665877494957598868,524288 --field-trial-handle=2444,i,6853534598971341318,6082036941255032080,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,11991799705061617041,9635556885012226411,262144 --field-trial-handle=2444,i,6853534598971341318,6082036941255032080,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,8105055491881960311,3946933360486311226,524288 --field-trial-handle=2444,i,6853534598971341318,6082036941255032080,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:13
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,7177445155207501783,11157896242351539794,2097152 --field-trial-handle=2444,i,6853534598971341318,6082036941255032080,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,10956918453366120002,8428659269158188991,2097152 --field-trial-handle=2444,i,6853534598971341318,6082036941255032080,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4436,i,13143423452783721658,11391768018185250520,2097152 --field-trial-handle=2444,i,6853534598971341318,6082036941255032080,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4456,i,12419609032466973724,4908659460800110160,2097152 --field-trial-handle=2444,i,6853534598971341318,6082036941255032080,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:9
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,4846863192969022283,14042071184803304607,524288 --field-trial-handle=2444,i,6853534598971341318,6082036941255032080,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,10169783768418319175,6435028957904605203,524288 --field-trial-handle=2444,i,6853534598971341318,6082036941255032080,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,5743727166537643993,4444836031953851073,524288 --field-trial-handle=2444,i,6853534598971341318,6082036941255032080,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,5743727166537643993,4444836031953851073,524288 --field-trial-handle=2444,i,6853534598971341318,6082036941255032080,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,2300395332810506831,6368946476627427870,524288 --field-trial-handle=2444,i,6853534598971341318,6082036941255032080,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,4563089273630677022,16072275738776649449,524288 --field-trial-handle=2444,i,6853534598971341318,6082036941255032080,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,14268035016948703990,16609891645157193094,524288 --field-trial-handle=2444,i,6853534598971341318,6082036941255032080,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,1388994015849177151,10519089544455342701,524288 --field-trial-handle=2444,i,6853534598971341318,6082036941255032080,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2196,i,2632264741795156045,13428016623705028155,262144 --field-trial-handle=2444,i,6853534598971341318,6082036941255032080,262144 --variations-seed-version --mojo-platform-channel-handle=812 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 30a1a21a9b5f64a485ef2f9974348837cf7162053ab5ba23a1dc328aa13d2566
MD5 84996b967911f262323939db442e8c7b
SHA1 401cffe3af79523c9924c60a99a8714cb40efe5d
SHA512 9e3f32e8be5a91c713ae19ee9ab6ea3257e73ab8d0688d04ce962708fde7e33305f65e0d5b14e0d17430cc06b6f8e9a082dfcbfb95de6f78da963c2e53352bff
TLSH
T1655160899B3A1FF2E72288765DE6614835F186B5013F9ED4F3429E368A53F0852C3463
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5984b7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5984b7.TMP
Size 3KB
SHA256 690d8148df2394b0a7a970cec2d2b9ad2c30e5fab5fc569a5e97d0fb4019096b
MD5 d20bf113bbc27b17c35be36fc8fd545c
SHA1 53d6182e0d4688594c1e21d88fed300567f13819
SHA512 0fde45504f8935d0995467e94935f018737ce0b68cdc1d7296d5f27be9d1ddafdb3ab3be168088026bf4a59f1992d052aa178a74680c8971b9cff17e6c40d058
TLSH
T159516089AB3A1FF2E72284725DE2614835F186B5013F9ED5F3429E368A53F0856C3463
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b605ebd6dfca3363fe8f9d41f6369efbe1b335624aebfc228e6701cf4829c101
MD5 6ad5dd27bbb97c24f4fdf18e19f693b2
SHA1 fcd76e7cd2039bf5f246493d2e9896caa66748bc
SHA512 d7043fac79e025bf70b669fb0e38509869663d212770ed75e3d28ce8776d64e19cd7dc9294d074aecc2787310c7d85e9a2250a6dbd271110ea47c2b9ea58b5d9
SSDEEP 96:DsyO9hOro9UMzdiSjhneOVczm4BZmQZpK8GwQ:Dsx9hOro9UMzdiSjhneOVcq4BZmQZpf8
TLSH
T1B191ACF7C3E4877E891152F4AB256E1BCD1D051A422C3C6A89F4AF1B63F24B1E14169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cb0b1e9f6921502cb392d6defb46cab0f8ed56725e5b4ee8008dd071f1c01a72
MD5 042be2eac13303c1c05e29cf6345b6e3
SHA1 521ddd191ef99157123d123e331aa242dd816ca9
SHA512 f978c7e6daad2fda9e20a49dc08f4b83f457f54b339380ac7f5758eb701eb3de4b89a0d58a7944452975c0dcd0cee00dc09d80b29a32a621d274c2f5ea53d721
SSDEEP 192:sxRBRZbv/fGsgNCUe8bNK9zoA8p4y/g6+WNIYllhiOG6IgDIJ:sxRBrv/fGsmCl8Kwj/5ICIwY
TLSH
T16D32B7566D68A93B8CCBE20DBB257F93D2F8503260D01E58B7FC961C14E7ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a3236179b35f298e29c5429bb4b0a4ede91b21fa6f7e61304eab7b6b7b00ad14
MD5 1a469c135354b1534e79dc80020e8db8
SHA1 bb77caa21d0814a9cf1291c6b67e4982962a22ce
SHA512 98739af9e03542a71fff19d405123ec5e60275a0facdff9951abab00f8ce14d569a45f73bcc3cf3bee8629c8568a068e9b262966f1208986f524f6135f612425
SSDEEP 192:sxRqRZbv/fGscNCJe8bNK9zoA8p4y/g6+WNIYlBiOG6IgIJ:sxRqrv/fGsaC48Kwj/5ITws
TLSH
T16032B7566E68A93B8CC7E20DBB257F93D6F9503260D01E58F6FC961C04E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c63cd548eeceeb3bed35ebf804c008997b4b8dcdb46326ba5ac9571cdc416fa2
MD5 f25def67d9f91ccc2fa1e492de2c0528
SHA1 b0a2568d5c2f35056eaf5389c5d48dc1d9edca7c
SHA512 9afd0663522c0fded83487f5b55e95c3eb9e2ead1bebf15f94d9b1c4fa83e3d2e2c48d7e1a91164add15e5d8993275066196771ff44e8e392104d4e61c4c2696
SSDEEP 192:sxRBRZbv/fGsgNCJe8bNK9zoA8p4y/g6+WNIYlBiOG6IgDSJ:sxRBrv/fGsmC48Kwj/5ITwa
TLSH
T14232B6566E68A93B8CC7E20DBB657F93D2F8503260901E58B6FC961C04EB6DD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 aecbdc82cbbf504fc9bccf0a46881a13b3e93b1f721235e3ad2afc8ab670ce54
MD5 6a1721b79f6621c0fda0d272c766266c
SHA1 ab08fca59c563966601d35f24e254ad1d39681d4
SHA512 7443f42da64c505caf06155bcf3b53d94fd2c85c991dc271412effdcccb216db2ab2f5c2c83364b1d9d2319b1a765322f728da43ad65db3b3049153b0a2b390a
SSDEEP 384:dpCfAo9fCtggCFfJJKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV//93VRRnroKMn:dofAoxWgg+fJJ8F1+UoAYDCx9Tuqh0Vj
TLSH
T111B2D93B600DCB7E8FC04A9DEC19AF976D9802C796948D4047FE994C03C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cb7fb30c39b50573b89339f38d79ff395953ad7820268b99cfdd73e549795413
MD5 06300bb3fde050019280cf324a5d0e0f
SHA1 15d3652fd06f0488fcabfa2dbc117af0e66e6900
SHA512 85fe14698de80a93acddf6a0d80411ed0f2c55862f62a6a29f6f1d374dd2ac270fcb3a0ca816e835e7ef570eb276c3b7f4651ce8b9914ac676d623346ab5f59e
SSDEEP 768:Rg3Pad6eDiJgTjDFSYxNHXmTWTbc+Hz2ewBKZO8L:Rg386+FDFSYneWn1T2evZpL
TLSH
T1CDF2B0B09CBA9E379DEA9688B5077787ADF81173D4C82958C9DDAF0D108768D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2fbe6688b0b717a8554d200814bb034258f347c2685134efbaca683ae278f0dc
MD5 202b844bff66d798550d7f7411a425e1
SHA1 5a8990bc79ab53192dfa6c81e8b9f220b28eff2d
SHA512 e1ebfc3cb2fe830cc63109c35a834892e132e0121a1e0971c48cce063767b381733d6ac2faa044041d012bb38dc720c0efc22652931ca27e2ea26ddcf01cc629
SSDEEP 768:drv+4UNbdH3CadV8DiJgTjDFSsxNHXmTWTbc+HzoNd:dbsbB3RVUFDFSsneWn1ToNd
TLSH
T11A03CF71ECE9DE379EF68688B1077A437EF811A384C40998C9D96F8D018B59E130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 89162c07d6a026ab0361b2c853d8856b40866f5b5ef39f6c5c3082c3585e98be
MD5 0cb3e8601c1c0dbeba090cf47ddd9710
SHA1 3ec62bffe42de778c3d0b7d2b75e558b542a0c46
SHA512 09bc90729864297127a2f50c7444537f4f3772ef6e70ff60e9e925777e95ecab338168b49619f11a9ecc1f7f13e405b4d1fe037fa5d20cc6cd6a27464445d810
SSDEEP 768:zg3Cad6eDiJgTjDFSYxNHXmTWTbc+Hz2ewBKZO8L:zg3R6+FDFSYneWn1T2evZpL
TLSH
T195F2B0B09CBA9E379EE99688A5077787ADF81173D4C82958C9DDAF0D108754D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a472f1748adedcd3024d537f63fc2dc71140c4ce33ba55c82656b176e54b6297
MD5 91b6178cda4ec3d00e539a1338b6bdb3
SHA1 6a09c1f6fb9072bd9e4d90883bf4ed5eaefb36ac
SHA512 05c99a96279e3eb023c0f141cc00d3f5f14df75f618aa5b2d1b9861b81ec11047266903a052a44db1526b377fa7f29ac9b2e98bf650cd19b49cd4e447dbc4ea1
SSDEEP 768:4q3Pad6eDiJgTjDFSwtNHXmTWTbc+Hz2ewBKZO8L:4q386+FDFSwbeWn1T2evZpL
TLSH
T12EF2BFB09CBA9E379DEA9688B5077787ADF81273D4C82958C9DDAF0D108764D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ba935a3f7687273c806d280718a8c6853b7f47b259e149c605694c5d63a8bc0f
MD5 1ee1582355e3a42ebbb9c435c930d75e
SHA1 7a213fba34d9e50b380c7d27236d6bc57115113b
SHA512 ba14d07a28b27ab2d2df1015e18472cf872652d93f47daaef13ac60f2a2e4eef562f3116bab6c7b640a36f3ab1d2a87ec1309e4566c3f9ca4c7e3de587ee2fd1
SSDEEP 768:arv+4UNbdM3Ju3iJgTjxNHXmTWTbc+/21eVH1SvyZ:absb+34FneWn1mEH1dZ
TLSH
T1B903CF319CF98F37ADE69B88754BB6573EF8116385C40A84C8D96F4E428B58D130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af07e54a-0953-4e4f-949c-195b82a5d7c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\af07e54a-0953-4e4f-949c-195b82a5d7c3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download