8b56214ad4283764c7b903d1c554526754031bd788a06ba6a6e1927724065d75

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rsign.html
Size 16KB
Sample260808-ajlpnsaf89
SHA256 8b56214ad4283764c7b903d1c554526754031bd788a06ba6a6e1927724065d75
MD5 08c42ce00eb5451b8c1bff5343bb7deb
SHA1 c7219b1e51ff451d7370896323b7161df44d86ba
SHA512 da4b249cbc0dcf7a0b7705dbaf34feb7a4a38433ea82b6af0ec418ef885d98b289b6a9b38f8773077fcdd4bed9058694cc8dd58d4b335ea8b461735161b41e1a
SSDEEP 384:dOAc1UWxrd30zIgi+iYPizici+ib30KB0F:oAciWxrx0CPVWRP70W0F
TLSH
T19A729116B8850A921933A3A9AF76870DFF66411B4600C7187DED76929F71F09E533FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
71	api.ipify.org
72	api.ipify.org
145	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4444	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306216858438903"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{EA88000E-DC71-40AA-9467-37E7441F3357}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
64	msedge.exe
64	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 4516	2400	msedge.exe	84
PID 2400 wrote to memory of 4444	2400	msedge.exe	85
PID 2400 wrote to memory of 1428	2400	msedge.exe	86
PID 2400 wrote to memory of 1428	2400	msedge.exe	86
PID 2400 wrote to memory of 1428	2400	msedge.exe	86
PID 2400 wrote to memory of 880	2400	msedge.exe	87
PID 2400 wrote to memory of 880	2400	msedge.exe	87
PID 2400 wrote to memory of 4212	2400	msedge.exe	88
PID 2400 wrote to memory of 4212	2400	msedge.exe	88
PID 2400 wrote to memory of 4212	2400	msedge.exe	88
PID 2400 wrote to memory of 4184	2400	msedge.exe	89
PID 2400 wrote to memory of 4184	2400	msedge.exe	89
PID 2400 wrote to memory of 4184	2400	msedge.exe	89
PID 2400 wrote to memory of 2908	2400	msedge.exe	91
PID 2400 wrote to memory of 2908	2400	msedge.exe	91
PID 2400 wrote to memory of 2908	2400	msedge.exe	91
PID 2400 wrote to memory of 1940	2400	msedge.exe	92
PID 2400 wrote to memory of 1940	2400	msedge.exe	92
PID 2400 wrote to memory of 1940	2400	msedge.exe	92
PID 2400 wrote to memory of 612	2400	msedge.exe	96
PID 2400 wrote to memory of 532	2400	msedge.exe	97
PID 2400 wrote to memory of 612	2400	msedge.exe	96
PID 2400 wrote to memory of 532	2400	msedge.exe	97
PID 2400 wrote to memory of 4492	2400	msedge.exe	99
PID 2400 wrote to memory of 4924	2400	msedge.exe	110
PID 2400 wrote to memory of 1484	2400	msedge.exe	111
PID 2400 wrote to memory of 4748	2400	msedge.exe	112
PID 2400 wrote to memory of 516	2400	msedge.exe	121
PID 2400 wrote to memory of 516	2400	msedge.exe	121
PID 2400 wrote to memory of 3148	2400	msedge.exe	125
PID 2400 wrote to memory of 3148	2400	msedge.exe	125
PID 2400 wrote to memory of 64	2400	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\rsign.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff97482c188,0x7ff97482c194,0x7ff97482c1a0
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,15884566562021946699,14099259563165793033,524288 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,13997384080746719246,6771188332269972987,262144 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,253741182921762613,3116612355554823841,524288 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,8655263809800004901,9900903358202205232,2097152 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,13433404328051898725,16887717447656582051,2097152 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,10466630279734352705,9761420962891862517,2097152 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,18115290977552995201,4837740013433675740,2097152 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,4454383623564743647,17802847824170989483,524288 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,13770331490161547406,13195391544487842826,524288 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,1074039544032831271,16037446456048963114,524288 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,1074039544032831271,16037446456048963114,524288 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4652,i,14102784848791667838,11857636211490224072,524288 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,11150312573513590616,11385559394687892156,524288 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,13014638979646682347,11480112813253438801,524288 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,10362802300426350910,14808891866578259233,524288 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,9989614534764716119,646102071537074494,524288 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5516,i,7954327367567857189,6555468261597338886,262144 --field-trial-handle=2332,i,1710847786979008938,1703916573259884704,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:64

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9267ca39fb50d75e1644d2a3d696dd6ccb217e6bf9e7569d932cd90aa7ddc3c6
MD5 3053e2c309efab6af094759a328116e7
SHA1 5d7903424cad814547aab0b24c905523966a4e3e
SHA512 e50de13a7f8638a26ab1291ceb7deeec0ee240e218416f04728511d55351ed30af33ec0e5c0080501730ddff8c78a910c56192116e7e3b1043719f834e9a713c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7G:fwUQC5VwBIiElEd2K57P7G
TLSH
T1C9B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4f40dcd0bcb45a1754e8d446dbd9682409305bb4b5d4a57d2fa924cd68a87bb3
MD5 1595654711bfef9fd5b512a7046be45b
SHA1 d065acd18b91b358ebe6fb42b9d4d090c3b11502
SHA512 602a3fcc8f85b351b9590dd20c3f99bd2d713541f103dd3d8297269d665de5bd99b4ba63319644d39e7c2692cc2a61a0fe099dd5a0a4e01b988267911326cd39
TLSH
T1F461F93912CD359DEB603D33ECC31100787195D8FA33AEF966AC687D7A01B5546E9E50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589a95.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589a95.TMP
Size 3KB
SHA256 53ddd58bdd17279923d4bec5d70896c0a13b786e1186c8a63273cc8fc29512bb
MD5 af3a8b2ff2a48de2eb52012485fd2286
SHA1 62e6ca87ceb34d02eb1bf9b56ad467cdfd309550
SHA512 67a3cfdf9c1d366d6678af5170850d6590b61f78d4eda0e5ef2d242d7038b1eb94b9043f2840c11a40e81493f5df537197794a0b97868daa4ad70e96ee41be02
TLSH
T16161F93912CE355DEB603D33ECC31100787195D8FA33AEF966AC587D7A05B5546D8D50
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7807b1716e5e23bca97be9a7df71d9e18cd4f6ffe8b4ca6ef8bb4e3e16132923
MD5 5af2c6c5af54be7fc49e5a018ebf6be5
SHA1 063db4a56b4924c9e8dc2d140b327a1652ccc629
SHA512 204c144c355074d5667ad58b3162fedb9d2103a9f3ffd9bb7c1c7b3a198fde7467a1398ccb87d1dd8ad414d20f815a1dcb53a93a63f7377cc3a85a7fdbec0f08
TLSH
T1AE6199B6C3E887AE981152F09B256E1BCD2D011B426C3C668DF5BF1B63F24B1E10129F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

e5b713d1-b3f9-4595-b10a-8622b510bc2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e5b713d1-b3f9-4595-b10a-8622b510bc2a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cb6f5fec62f9f3506987f26585390285dce8beef9cff0a2dbc6fe9dad46cb4c0
MD5 8cca679616e5a219d5731515cc916438
SHA1 bb638f6b54ce93cf16dc58b7b0afa221e0ca3c50
SHA512 9e3aa0fda3082567c5611a20641aec7180cca24290bb0099b82d0cefe566181b242db7c68f9c32310164f956c4f88f0f9fb354b6adf996d1598ad3e500ef9c35
SSDEEP 192:sxZkROyM/jK1Ml8MkV/fds1sBEOTIdpdBHW6+WNGY9IKhxNIgrJ:sxZkkMV/fds1smnrHbGS9
TLSH
T1C342F7056B34A977CCCBD20DFA557F93D6F90532A2940E54A9FCDA1C04E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6b3e8f39db9294d49635db112cfbce2bc22ff073ace9fc7664df7b0fbba74a62
MD5 ad24c42dfe225e1f2ceecf10d32de86e
SHA1 63dcfea9fb9a0dee1e6b7419fe76f591cc48b60e
SHA512 9ead4dd26975121407fbccd797c56c2328bb5ddbc274c165ae89f84e223a540964de5a4150b0662f95237ddc4cceec7ae41eed1ca9ef2b2fa85b2465cae2a180
SSDEEP 192:sxZkROyM/jK1Ml8UQEkV/fdsSssEOTIdpHBHW6+WNGY9IstwcONIg5IJ:sxZkkqfV/fdsSsbnhHbGUte+
TLSH
T11E520805AA34A977CCDBD20DFA417F93D6F9057292900E44A9FCDA1C05E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 76226f91eeab9ce323b13e1a5a8a6d5ea3238aaba33b025b2ec6829bacbb8a14
MD5 e3b6d5aab8689988ceb08226bc078f80
SHA1 6d5893f099e3941b3deb260b8ef246023fa471f9
SHA512 6d2f7e478c519547820d650c8b25ecd36c99ed13043d505f59fb0b05a3e5b0f219251dc3ce744220e796fec1b02a02aa01c6509557458d1822d86ef833fa47ea
SSDEEP 768:/4cv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNgroxg64:/4cv21wWvu+Z+u1jaeFLeRNrxI
TLSH
T195D20B2B280CCB7E4F841E9CED2AAF866DD801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 2949c6830ac63ce37c9d13cf2e5d989c179ae70f0fc15e13a680f9e050bdc86a
MD5 5a31280ac32c7fda42781bb68ef38151
SHA1 d73c42e8afbbe61422a4919f21f6eb0d0dca3dda
SHA512 132f894590d3c6570446817918bf98235fc1099d3c1d9d158133a5fbe4edac648743ddb7f77b775c1999c5badf90210f5db40707772b90104edac3fb29df23da
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDyeAKTi2+IQZC2QSyhjWD8B+hKZIBQh1YAd:mTnDyBXc
TLSH
T142D14402313B02423CBE7948A266CA768E4231673814E97F7FB911A25E67E111EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 62885720e1ea3ebdb9e3b65c56f1ab8e2010133dd164de631ddec4c53a025688
MD5 1443d57615e87169e2e4baf4dbd80946
SHA1 ab66f69075da2dbc5fd378022495b7f1000f29b2
SHA512 d710f15a44f6ae0f564cb14212fb38e2174bac166acdb67acf6cb49f73ab209c2f74d26bb8a2a45f415d33cce3fce6dd6595f1309516b100183003d4391fd38e
SSDEEP 384:9ZcIhsNuvcW5zie8F7Me+C9O3+roS+2KGkZ6nTKwBODNZOCU30U:lh95/27nFO3CLlKGkZ6newBKZOz30U
TLSH
T102928D71AD385C774EE2A245F44B36138EF89173E6C53BA4D1EC7F1C01DA698130AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 202a0ebb823962b9365a3d2ee7d8e534b7c5c9f774bd65d9ea5b5d58be906438
MD5 53f1985a412c243ab8ecbabd2965e158
SHA1 c05a17ef3c81d20fd5cc146f56c7b7fcc368e363
SHA512 cd405bd0ca0339e1e2310bb18da150cda2306be87f308d7d6de476182bf731c360b74a65ce6c443cf09a0f6be011b91575a8b2ed719b33d65563b63e8e3a5ffe
SSDEEP 384:lZcIhsNuqcW5zie8F7Me+C9O3+roS+2KGkZ6nTKwBODNZOCU30U:dhs5/27nFO3CLlKGkZ6newBKZOz30U
TLSH
T159928D71AD385C774EE2A245F44B36178EF89173E6C53BA4D1EC7F1C05DA698230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 b4ffdc38c3239609b54554ff8e8d12d3e499006bd2d267857058edb9a320fa5a
MD5 491d1f42bc404c8c20ccc1fa6d210b25
SHA1 ba6ec89302bfaad1cb1f48e6d6dc12f005fb7cbb
SHA512 e190f21435f3e9bb6f58fccf3edaea74caf939686dabfea696aa27a04382ed6803586e2835e75200a63df56bd8c0dab86a1d3767d39bfffc801e035abfcca571
SSDEEP 384:LFiZcIezsN+8TUNTUlIlqcW5zie8F7Me+C9O3+roS+2KGzN6nTKwBODNZOCU30U:LFQ+jwgY5/27nFO3CLlKGzN6newBKZOR
TLSH
T176A27C729D688C7B9EF6AB44F94B32138EF850B3E5D57AA0E2DC6E1C019719C134BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 19be5c1d9e7b78f587d09dfaa2e8d07d6a89cf8fb78ab1d2b4aeafb866a3d31b
MD5 77a0320baf2d77cdd5154e22711668d5
SHA1 face68d56d0db45f9e7f7902782a54994ac53cc5
SHA512 cc79d1249b7ea0fa2c050f0036a933da5063a33ea057453dd2ef14fed29b47957abb5bb4327dceebd54c44e68273b78f32694e763f7b78fb8377cb4d21f60489
SSDEEP 192:JONX6v+YLNQmiUyG/Zh+CGEOcs+tVusSr0uU6:JONX6vz/jZh+C9O3+z+U6
TLSH
T1FD02E835BD281C7B9EE26E45F58B3B275FE8217BE9912F90D9D82F0C01D764C2342826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7b507a5e4c770068a54f5fdc95bd374827eee86b8afd323705961f6b3ab3a9bf
MD5 1d26c35d56bba774fffddb32cfb5fafb
SHA1 ac86d941b139425e07bf8f35a5fd0d610dd57e4b
SHA512 51fa95d5c6af353696b4d5f83957c89d65e683d0bef6d9e16b68427b0cdfbe7e192994d2a0536f006d4c54b96ac9a22a7246ccbcd7646c2164bf22a1bcca09fc
SSDEEP 192:eONv6v+YLbQmiUynj/ch+CGEOcs+t1sFS+2KGgCHSuq5DU6:eONv6vzRGbch+C9O3+roS+2KGB6U6
TLSH
T167121932BC685C3B5EE2A554F48736139EA95137EA867FD0D0DC2E1C06DF69C234A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b54a121a-a5ed-4c4a-8d0a-fc8b78beda67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b54a121a-a5ed-4c4a-8d0a-fc8b78beda67.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ce811fd5884231340dbb67a9d63f9b2372f1c52e3541fd435af014dc23abbb7d
MD5 9c02347a9fc129ddff7d47103b64142d
SHA1 6f0ca0e114c80f5ae1ca8347ab2fde675c1a851a
SHA512 08095ad9e549da3b246014c29e55655be984c19346d609be8960f6ea39a799bcc317ac8f4c2b014de08a106e716b9a5ef686c5dbe96a52fe3cff897ab7055e9b
TLSH
T131411858B6E91108B3B76F56ABF6B96E487EBD772F06D45E10010E4E0A22B41CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download