cf03d4e2f05bd47af91af2d724d94adfaa4485c75a9aedf78a1c0b0ef6ab2e66

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rsignn.html
Size 16KB
Sample260809-pjfwraep2x
SHA256 cf03d4e2f05bd47af91af2d724d94adfaa4485c75a9aedf78a1c0b0ef6ab2e66
MD5 18e6a923657497cd0a5528decfa3b0a9
SHA1 c159a638e71270a3f004ca8967662ae8dda5227e
SHA512 69eef84df1f106391ba36b09ec6566e286ecb3ad620f5bf5139640f1c2224c9e60a6aaa5c51a9c6cb113a9fe3043035884192a9c3f185c42f4b6079b2b920077
SSDEEP 384:9OAc1YSWxrd30zIgi+iGMPizici+ib30KB0L:IAc/Wxrx0CPSWRP70W0L
TLSH
T123729216B8850A921933A3A9AF76870DFF66411B4600C7187DED76929F71F0AE523FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
95	api.ipify.org
96	api.ipify.org
97	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2476	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307516870832893"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{D0CC843F-9969-44A1-8023-D348B1D527E1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe
124	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 124 wrote to memory of 2028	124	msedge.exe	88
PID 124 wrote to memory of 2476	124	msedge.exe	90
PID 124 wrote to memory of 4140	124	msedge.exe	91
PID 124 wrote to memory of 3552	124	msedge.exe	92
PID 124 wrote to memory of 4140	124	msedge.exe	91
PID 124 wrote to memory of 4140	124	msedge.exe	91
PID 124 wrote to memory of 3552	124	msedge.exe	92
PID 124 wrote to memory of 4256	124	msedge.exe	93
PID 124 wrote to memory of 4256	124	msedge.exe	93
PID 124 wrote to memory of 4256	124	msedge.exe	93
PID 124 wrote to memory of 4196	124	msedge.exe	94
PID 124 wrote to memory of 4196	124	msedge.exe	94
PID 124 wrote to memory of 4196	124	msedge.exe	94
PID 124 wrote to memory of 2868	124	msedge.exe	96
PID 124 wrote to memory of 5748	124	msedge.exe	95
PID 124 wrote to memory of 2868	124	msedge.exe	96
PID 124 wrote to memory of 2868	124	msedge.exe	96
PID 124 wrote to memory of 5748	124	msedge.exe	95
PID 124 wrote to memory of 5748	124	msedge.exe	95
PID 124 wrote to memory of 2572	124	msedge.exe	98
PID 124 wrote to memory of 2076	124	msedge.exe	99
PID 124 wrote to memory of 2572	124	msedge.exe	98
PID 124 wrote to memory of 2076	124	msedge.exe	99
PID 124 wrote to memory of 1936	124	msedge.exe	101
PID 124 wrote to memory of 3928	124	msedge.exe	105
PID 124 wrote to memory of 5384	124	msedge.exe	106
PID 124 wrote to memory of 2544	124	msedge.exe	107
PID 124 wrote to memory of 1236	124	msedge.exe	108
PID 124 wrote to memory of 1236	124	msedge.exe	108
PID 124 wrote to memory of 4892	124	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\rsignn.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc2642c188,0x7ffc2642c194,0x7ffc2642c1a0
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,17807763376453308891,16502196630304430282,524288 --field-trial-handle=2776,i,967101352814456716,961010558017144027,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,11752488802865052957,7611597911491551243,262144 --field-trial-handle=2776,i,967101352814456716,961010558017144027,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:2
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,8868486605159410784,954791883680188111,524288 --field-trial-handle=2776,i,967101352814456716,961010558017144027,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:13
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,13735681069594749401,3903167104200725679,2097152 --field-trial-handle=2776,i,967101352814456716,961010558017144027,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,17210075621151181656,503709239556658391,2097152 --field-trial-handle=2776,i,967101352814456716,961010558017144027,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,15400930397712300854,4677213791696423244,2097152 --field-trial-handle=2776,i,967101352814456716,961010558017144027,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,16952244428599771342,6499413930257881519,2097152 --field-trial-handle=2776,i,967101352814456716,961010558017144027,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:9
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,14374780894380078374,1275347049764413283,524288 --field-trial-handle=2776,i,967101352814456716,961010558017144027,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,15114616436280745646,13802961265327404011,524288 --field-trial-handle=2776,i,967101352814456716,961010558017144027,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,11769160309524497052,15310200657642413956,524288 --field-trial-handle=2776,i,967101352814456716,961010558017144027,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,11769160309524497052,15310200657642413956,524288 --field-trial-handle=2776,i,967101352814456716,961010558017144027,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,4641109640558722475,4672247457202230437,524288 --field-trial-handle=2776,i,967101352814456716,961010558017144027,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,7196486852867992421,17857657757100768713,524288 --field-trial-handle=2776,i,967101352814456716,961010558017144027,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,3952910613242907704,18043567069231470529,524288 --field-trial-handle=2776,i,967101352814456716,961010558017144027,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,15809117272359956269,6064522316886695649,524288 --field-trial-handle=2776,i,967101352814456716,961010558017144027,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2988,i,5962708746939560045,1878741081817474408,262144 --field-trial-handle=2776,i,967101352814456716,961010558017144027,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

9a85d3bf-b341-46c3-b510-9d87fc689ef5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a85d3bf-b341-46c3-b510-9d87fc689ef5.tmp
Size 23KB
SHA256 385202120e412a01864df507771bdfc35915477c5ea5170875227a4a5a58363f
MD5 3080217041c39822d76ea85fe3e3cc88
SHA1 f3242ce882224272d9699bfa56f1ad2f2eb03434
SHA512 cc0b4bdf70ba2bb791a0632bc56d713ff489901646b8a5924003bd5d303b5906419f67cd736740283f551599925f6f95bd11f8a6aa20da1f2f3066a6e91fd696
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRcdropDD:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0Vi
TLSH
T1CAB2DA2F600CCB7E5F800AADAD196FD76D9802C79B588D5047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 af11a1f8cbbd3d7b8c91960eb5e747f775e90173ccbd2ec87bb43e8dc04b4724
MD5 925f417375529e17a277d58780b35a34
SHA1 2ab808693943130e026be09bed0a6eb6e1be45d3
SHA512 d15df76c17fe6bb0531f257bcf03c9c55003a8ba1b193520ba4a614e55f4853cc4f9fbeaa114c16acb49d5fb9270f7c73f4a416d109bb0fb7cc66a7cbc9680ca
TLSH
T1AF41CC56B37395C1CF244F71E0E1D0A97FB58469CE03EEBC1A50A178C882334A0E1A34
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1d7c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1d7c.TMP
Size 2KB
SHA256 0ba09002ce8f519354ebf24ce7dff46c16b8fa5d3a1f50b7dc7080c681e3e439
MD5 20461d59d51564ba1ccef92b1815bd13
SHA1 7f73eb12d6f7154c3eade82292afd136eaa8f6f2
SHA512 77182c19f2421f2cdbac8f61f620b28a0ecab38ac6e1c855fa5b317411d5a26fda94548675156e49ad03ed0741681a3470fec3b59fb3319f7fff79ed05c31b35
TLSH
T15441A756B77395C1DF244E72E0E1D0A97FB58469CE03EEBC5A91A178C882734A0E1A34
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 583f9c7c730ab4513aa6ed7ad8a252863c5ece7e0086e5fcd45318f60f491544
MD5 1a233ed857ea5b0131734b71e3b838f0
SHA1 087e5e53c2d49b8ff774624456ad1a6770cf47c7
SHA512 cc2ef61bf27187c2567d25a875304bc167cbc883a52e3954820b8d628ad75932f9194f473834d7844f82d51d5ee680a739c3600bc30b6fc579745ffb46ef7ea8
TLSH
T14E81ACB783E887BE891552F49B256E1BCD1D051A422C3C6A89F4AF1B63F24B1E14129F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 63d57702842619fe1e0114f601b30bda92a85a804cefe5ae0fa2e201f0ba36ad
MD5 2f12cce5480ccd261bf7a3348bc72aa6
SHA1 0429d7504cccf32ddaa9e7f7dce239b063e0d13c
SHA512 e9f79ae11545f6d6c06e62cf8280b611317a113823cad98b3fd53359457c19e134b2c8822b270e4f1e49bb9fb7645d6851cf64895b4951954b558911747aa6fa
SSDEEP 192:sxRfR2bY/fosaMKCA94/szoA8p4D/g6+WNIYD9mi6S9GEvIgIJ:sxRf+Y/fosaMZ8Iu/5ILSHs
TLSH
T1A332D7156A28A97B9CCBE21DBB16BF53D6FD503261D01E18E6FC960C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b1ee8591dbc3dbcdd72c0b6d6cbb236496af2e6e092d24c3ead4955056db74c9
MD5 7b779e70a16808411ff0e400de5bb821
SHA1 90f2c6ec3ee8f50e1b567c116def545d12d10be4
SHA512 687113643bfc2335bbe955f7cdebcfba20c972cfdd1cc327fd4cbf0640d86bf08051f815d848cea08ac29c3ccd1a7508d7a15ab1df757a1295343b98f1618963
SSDEEP 192:sxRYR2bY/fosIFKCA94/szoA8p4D/g6+WNIYD9sI6S9GEvIgDdJ:sxRY+Y/fosIFZ8Iu/5ILSHL
TLSH
T1BD32E8166928AD7B9CCBE21DBB56BF53D6FC503261D01E18A7FC961C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8fc4c1f7fcba3efe3ae8564791b14365c1bb23e5a63fc199bd5df0b26ef5fded
MD5 85c5fd0a7627dab66fb52de3fe369309
SHA1 f707921f5a18020da7b655c043a3dd6d86b19a05
SHA512 65017b4b1959f99b66d05485120d29323dd311b7eb91c710c2e9f8dcb963ca4c22f0145df13ddcc996c892038877f6c0a196907c8c5283a67b7b38539ca0dadd
SSDEEP 192:sxRYR2bY/fosIMKCA94/szoA8p4D/g6+WNIYD9mi6S9GEvIgDLJ:sxRY+Y/fosIMZ8Iu/5ILSHh
TLSH
T14832E8156A28A97B8CCBE21DBB56BF53D6FD503261D01E18E6FC961C04EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7c7d3ece97d38f913c998f68f1db5775335ca644575d94461d0251a1ed437aa2
MD5 261ad550cf6c11991423cac82bafc5af
SHA1 fb8b4076ec8bdbd2e9027463b858f5c6d288d195
SHA512 15754960255b456b5e163c3a2acb37bf1de30a63a0f17dfb4a230009f51bf88c203fc732c2fd4f578f12d81cea849e9021874b3f7f501a203ddd4dae658b6d17
SSDEEP 768:vRrv+4UNbdk34Mi0ct3GrEnjN3Gac1FP2ewBKZOxWr:vRbsbG3txQnjMac2evZaC
TLSH
T12613BF35796C9DB38CE6E28AB447BA03BEB4464395C506B4CADD7A0C05DB5ED230BD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c8adb75b749cd485d6e2c875c6867a0914130f8c2e7274cfcf392e4f12af9901
MD5 5b17456312415c6bf12ab0a35c85b4a5
SHA1 415c43385afd99fd4a7062cfbb20a6515393b1d0
SHA512 6311f85a55c5fee2836b8fcaef4e4dad404aad90a7228ffb622576148759ce328a05327401cf07d70aeeb12f50ebcdc20ab50e4f416f4220e8b20c265e4920f6
SSDEEP 768:37X3pmMi0ct3krEnjN3Gac1FP2ewBKZOxWR:37X3BJQnjMac2evZaA
TLSH
T158F2BF757D685DB38CEAE38A79477703AEE48353D2D80AA486DDB60C11D76AC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8a0f0ff468c329c3ba8df3823d154fed4b746bbf89d61fe3540e5ad12a8528a9
MD5 57cdc49e76a0e8eeedafde2381e5acbf
SHA1 a64c0593b7247828b3538f9b745417679f4be7fd
SHA512 27d9137741467c2abecf9b1ff2ad4097f050227f2018e6cf1cb50aa1cadf29cdf08503f6faf55e5ec708ab7b1fe3e8579c29d2250234d8764a8c0ac8e35d3981
SSDEEP 768:vHf3pmMi0ct3GrEnjN3Gac1FP2ewBKZOxWR:vHf3BxQnjMac2evZaA
TLSH
T19DF2BF757D685DB38CEAE38AB9477703AEE48353D2D806A486DDB60C11D76AC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d0f70f007ad0a718ed3ee5990c4239c3ef26958325ee57df858ada422def4106
MD5 85fec96d053b776c4a90fb661861c77a
SHA1 a92d1dc366572c1e462e44fc03ad4741982bd706
SHA512 c1f8b1a38335eb8e4b63b9f8977a10f10199f3a72b88e6b442de623036297b8c7e1946942b536a02528599dcf47b03e190ff3e8176a74b75ce1bc77e1545264b
SSDEEP 768:aRrv+4UNbdk36Mi0ct3GrEnjN3Gac1FP2ewBKZOxWr:aRbsbG3rxQnjMac2evZaC
TLSH
T15813BE35796C9DB38CE6E28AB447BA037EB4465395C506B4CADE7A0C05DB5ED230BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1386c24e57fcc53d20ffb94c3bcb06cc4cc530fbc5ae44c33d17798069805302
MD5 12558c0e16a8df51636ff111ca86d09b
SHA1 ea4989960702871e542049aa72e9638f8191fd47
SHA512 e32ffb381d3b27e4f748a052231505dcb110a1a7d41aedf48ae873047f43bceb0f2fa2e3f480b364fac51c2fe83b60ebc4124f85f62aee9b9671997d4670e342
SSDEEP 768:Erv+4UNbdS3Yai0ct3KrEnjN3Gac1oPeVH1SCz:Ebsbg3/PQnjMaPEH1V
TLSH
T19803CF3169A89E739CE7E3867083BA037FB4525386C50BE0C9DD6A0D46DB5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fe4eb5254f02ed34f3185d994ccb4baec700af9432220b35b8007d75535e584a
MD5 8b43e8e8d31341b14736332d242b06ab
SHA1 c2a45c772caaac24bef8124fa1381d96871f737b
SHA512 fca2500c92c494cd72179d7e98bd44b8c8f7741901022bad4bffa0ab2bd50701526d23bad9cda9729a3ab5a76a47689c7fe87205c3387f0ff25e081fb14b4474
SSDEEP 768:rrv+4UNbdS3nmi0lrEnjN3Gac1ZJeVH1SCz:rbsbg30lQnjMaeEH1V
TLSH
T15903CF3269A89E738CEBE38571477A037EF4525386C40BA0C9DD2B0D46DB5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50a17edd-35f0-4b74-8593-a9b9eecec936.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\50a17edd-35f0-4b74-8593-a9b9eecec936.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download