hxxp://cevalogistics[.]sgs-gestiona[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://cevalogistics.sgs-gestiona.com
Sample260810-lf48dsen2w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4688	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308277791014836"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{CECE0113-3CF6-4561-BB01-3CA606BE622D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
656	msedge.exe
656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 1772	3916	msedge.exe	85
PID 3916 wrote to memory of 4688	3916	msedge.exe	86
PID 3916 wrote to memory of 1828	3916	msedge.exe	87
PID 3916 wrote to memory of 1828	3916	msedge.exe	87
PID 3916 wrote to memory of 1828	3916	msedge.exe	87
PID 3916 wrote to memory of 4320	3916	msedge.exe	91
PID 3916 wrote to memory of 4320	3916	msedge.exe	91
PID 3916 wrote to memory of 4500	3916	msedge.exe	90
PID 3916 wrote to memory of 4320	3916	msedge.exe	91
PID 3916 wrote to memory of 4500	3916	msedge.exe	90
PID 3916 wrote to memory of 4500	3916	msedge.exe	90
PID 3916 wrote to memory of 4692	3916	msedge.exe	89
PID 3916 wrote to memory of 4692	3916	msedge.exe	89
PID 3916 wrote to memory of 2744	3916	msedge.exe	93
PID 3916 wrote to memory of 3832	3916	msedge.exe	92
PID 3916 wrote to memory of 2744	3916	msedge.exe	93
PID 3916 wrote to memory of 2744	3916	msedge.exe	93
PID 3916 wrote to memory of 3832	3916	msedge.exe	92
PID 3916 wrote to memory of 3832	3916	msedge.exe	92
PID 3916 wrote to memory of 4760	3916	msedge.exe	96
PID 3916 wrote to memory of 4760	3916	msedge.exe	96
PID 3916 wrote to memory of 4760	3916	msedge.exe	96
PID 3916 wrote to memory of 3572	3916	msedge.exe	99
PID 3916 wrote to memory of 3572	3916	msedge.exe	99
PID 3916 wrote to memory of 3328	3916	msedge.exe	100
PID 3916 wrote to memory of 3328	3916	msedge.exe	100
PID 3916 wrote to memory of 4612	3916	msedge.exe	102
PID 3916 wrote to memory of 4960	3916	msedge.exe	111
PID 3916 wrote to memory of 820	3916	msedge.exe	112
PID 3916 wrote to memory of 496	3916	msedge.exe	113
PID 3916 wrote to memory of 2612	3916	msedge.exe	115
PID 3916 wrote to memory of 2612	3916	msedge.exe	115
PID 3916 wrote to memory of 656	3916	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://cevalogistics.sgs-gestiona.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffbecdfc188,0x7ffbecdfc194,0x7ffbecdfc1a0
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,15698183771633614341,800628463503324942,524288 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,15497552158022421025,6606144258867310632,262144 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,6177071274657240843,9290592822789979264,524288 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3308,i,14075761843207902835,1413419068203085417,2097152 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3312,i,6059082917309189931,11419843581567872853,2097152 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,4894450071562514969,12208525599326521047,2097152 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,2252893133476607051,2764398007021720102,2097152 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:2
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5012,i,1616795657062875120,16391914857626806588,2097152 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,7883731134054671062,7908275632534181612,524288 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,9155106357437525624,2533281665115769956,524288 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,12656257705591670256,5334480488826052197,524288 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,12656257705591670256,5334480488826052197,524288 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,9840641403463354812,6267881446036305943,524288 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,12550922686086159827,14608765849783876327,524288 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,6577250790143802466,6191235470768722754,524288 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,17036593658418570874,10236374207322794432,524288 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6268,i,1263786326328446298,13985662863854775434,262144 --field-trial-handle=2272,i,6190876364996015858,11683055149017572266,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4fbc0660f9f3056d5f36574b4004c58e5bf7b4539c8ad0bc0c3c5f5c791c776f
MD5 8410891e1250217cbd9dbe647ad5529f
SHA1 327802c1c5a4509900f7fe24316e0c502f8cbc38
SHA512 5034413d9345fbf305700f2a174f9c14d56e658cc489c615bb3e81afc0edbb449127f4aef51732eedfa1d11fb6ffa8cb919486fe9b500b19c34cebb226d0b956
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
TLSH
T1C6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8bdcb12ecd64467ede2c1127498dd3435e752857c6d26b6c6534b8bc9f14b6ca
MD5 5143af51b93f5ce5735a4ab7654eba49
SHA1 04799b7944241b671ad315284d4aa0c155982b6d
SHA512 49b0d1f1d1c007dd1ea7e0c904bf05d59749cd1a847caceff4876820047cfc7a4126fa054997f79a5278b344c96e473f71c4d0b24f8493877843aafb7c72fce2
TLSH
T1057193BB410287AFDB1DA2FD64CE71623C70A4D9F9335D965E504735391770142CE698
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584aef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584aef.TMP
Size 3KB
SHA256 cfce4fb800feff8f9a27e04a85523a8c3df726a28f11ff486557cbcd2e12ca47
MD5 5c32020fde12175903a2314ac30e6ccb
SHA1 7c38416c3523301ed97805b6043b687997416499
SHA512 7a0c65df57ef4e4b2cc71309462ae84e787dadb043ddc699d5428ecd43e1ea8804f8531b3673165583a4628c6bc1c81aa542d55715a998426933e31b5069d049
TLSH
T16071A2BB410287AFDB2DA2FD64DE71603C70B4D9F9335D569E5047363917B1142CE688
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9829225ff091935eb3e264251d436c09307afa5f4e08ceb9241c800160c293c6
MD5 cd3ae9b7c25d600ed6ed339d71a9a62b
SHA1 d019d580128ca54453b1c481ee4909e7807186a5
SHA512 f86d143dca7c6797979153351de6021d90733dc76dbe16660dc19c955ccf6e33a334d5fa8fc217b9b95321d462c30d6efed9701aff304201f71e87551d435407
TLSH
T1EA21C1B3C6E4866E895211F46B146E1BCD5E0908436C3C6ADEDAFF5B53E34B0D102A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 97a01f2734bfea3c34e1cd16015b0b0f367862719d76774062b486af42bc5ae7
MD5 a432ff079827cee7c2251e7bfafacf04
SHA1 85b77c02cc98c308af00a2b9c58fff4a29dca376
SHA512 03caa10cfd96d8cf6395af5ce7edba877c3b4cd39b107b90d46f8e348138a485b1385a9306fef9db0d4c3bb7f847b98a1a697a0ba8ec724f252ae5eae9070cc6
SSDEEP 192:sxZT/yM/jK1Ml8Mk7W/fHshiyxTpmIdpEMHW6+WN5bY/YIbxilBIgrJ:sxZT7M7W/fHshiyxTpHxHbu/yn9
TLSH
T1FA42E9126A34A97BCCDBD209F955BF53D6F91472A2900E4499FCDA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6d7f3763bc902fb4beed44c924d0145f49a4c76b820f9ea6d4eca270ce094c34
MD5 22fc3408cda2d529d734d467efc9fbc7
SHA1 539a919854c1539823b9b1940188bffab9fd555d
SHA512 71f15f9a3c55900b286818f072969cdb54d387ec7f580241e955a94bc91a67edb3e27001be26efee86ae767ea597fb8267d9346fd8777773177332703220368f
SSDEEP 192:sxZT/yM/jK1Ml8UQmk7W/fHs8iyxEpmIdpeMHW6+WN5bY/YIFoilBIg5EJ:sxZT7qN7W/fHs8iyxEpHHHbu/lnG
TLSH
T1CC52E8126A38697BCCDBD209F945BF53D6F8147292900E44A9FCDE1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6404f0965e874f7506b170520da78b78f89c81d31ec41e76393cbc15438d237d
MD5 b8fbae9d282903f9ccbd27cc99659370
SHA1 cfee6e0c4363756b4c4087bfd14d2814c23bf1ed
SHA512 dae4ca9a6015aae4162e0c9f7d003eb8678ba445a5d0c7c9c6022b4fe8e0260e748c6a25d56d19baac8954f19f888f1bf23465bdbe837b47cda26d8f53a7b58c
SSDEEP 768:p9sqxXlWvJD0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9GrocuA:p9sqxXlWvJD0Tu1ja54LAs99c3
TLSH
T1F6E20B3B694CC77E4F840E6DEC26AFD66ED801CB67988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e369bc3d8e5c21b3c0529ce9c92222e048ecaa776e3bb2c087bffff589ad2315
MD5 694abd4d77698122be83c734e36b28b2
SHA1 1aab6a6e4dbb541492a95dc6afa3a6a9a876d2f5
SHA512 3259f380e8abf9b1c0711ebcf75620368f34b48d529878e31ae381add827dbf1cb362e4419dd7f201ec412efe4d7a16d4df73455e833dfc9e2b7fcb92d42cfb0
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyZ+I/Kjiojy5EIfKdmsFI:KYbaKYIK6+EKji2qEAKdm2I
TLSH
T18E91265A363E0212383D2858B2AB96371F4239637018A46F3FB940E55F6AF125CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58e104.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58e104.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b2e107b60836c91969fcb5e801acb2b8d6656c182bc20d182a125f4787a3a56e
MD5 92f597d05507f87e0074c871e6bc89f3
SHA1 cc43567e64fa7bb4ce7f3c2760a20adcf7424c15
SHA512 cb17a5e33a9e29186518c308f816a39b80fc919612f3ff1c6e9580f873e97409be6888f2d03b82faa4f99c783cf364c4065e702fd78722a94cbaea7a25ab748a
SSDEEP 384:2ZcIhsNX0zwzQbOubVRN0OKq9716HlytEDq1st:kh0zSZH0OB971oy6Dq4
TLSH
T1B7929D3169346D776AFBA505F44B36139FF88027ABC86FC491EDAF1C01DA5A8130E926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a46e2a2938b20ad3ebe7c0be6450e10c8d3c9cd14d52766a35af668d099ebcaf
MD5 0bdc9f84058b2531f7d2108f9be4ab30
SHA1 ee605c1a26af7a7c4bfac47c73c97955e289790b
SHA512 24c659941f25b0227d1c101c4ac012b689746ca09d3bad8d39fb2e7b0fc49711e64e675641e376db431304856af6443d41ca92f36a827c778b537198e6eccec6
SSDEEP 384:QiFiZcIGzsNX88TUNTUlIl2wzQbOWbVRN0OKq9416HlytEDq1st:rFQ2ZwgtzCZH0OB941oy6Dq4
TLSH
T1CFD23AF248E7593AD9AE5703E77E2D138EBCC063B5845A90B3995A1CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 81c4dafe45ad777d2df1fa280ed237688dbc94a93e5034d4acf8dd26b532a4db
MD5 132d11c0e44a3f2f8febb319fbd10a38
SHA1 f6c267e9e5148f2a994b8ba0f243474d6720569c
SHA512 383f0988c2548a59ff5a1383a2b4fb923512e1913c5b0ff2161479ed3d7ef6f1c8530bd900e9fd32fd0f4b115309fed8bbd6204794ab50e2a84978ce249c0d17
SSDEEP 192:tONr6JkRtQmiUyTnW+RN0OmheR2h31R5U6:tONr6UrcW+RN0OKF9U6
TLSH
T12C02EA35BD386C7B9EF26E09B94727175FA8207BE9956F80DAD41F0C01D765C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a9c2b3e07eb90e5b5e4941515459240e0564689d5e4493edb4f8c180c9aea2aa
MD5 4651c41e0f5b31048d46ead35635c29a
SHA1 13dba25bce586c1d3e95b0b89d3e78aab210ecde
SHA512 245d1c5438908ed05b77b4b1261fc50ed5c95782f00968631749d57eaa4b09c5fbf7468c2c3b13fd98c0a8933e2988a09bca13d5812dd7a7668e054bd611690d
SSDEEP 384:0ZcIhsNX02wzQbOubVRN0OKq9716HlytEDq1st:yh3zSZH0OB971oy6Dq4
TLSH
T1C7929E3169346D375AFBB505F54B36139FFC8027ABC86F8491EDAF1C01DA598130E926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2b53e648067c4744dfd453ce478a6745ccc87fd42008416d58eba894e464d6ec
MD5 d8cf6cb8d48d4d065961fdb1101e8992
SHA1 b146e3b24f8394c6e40cf5b248678e55d756431e
SHA512 d53443b7b734c38562711501261625cd30657a92f58455fafdac3192aa022f1bf11df569a12270a9558e05bea3153e1e00c7b9c207cd3b6e4d45cc3fe37ba543
SSDEEP 192:WONzB6JkRKQmiUyCn5+RN0OmheRnX9cVcjqxoU6:WONzB6UGj5+RN0OKq971U6
TLSH
T1C2121A36A834AC7B5EE36945F58732135FA95137EA896F80D1DC2F0C01DF69C230E826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72372550-3cae-4a41-b8f6-ceddd70215cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\72372550-3cae-4a41-b8f6-ceddd70215cb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9521df1b811aed40c389335ea772b2497483f306abd4165b7564b1f86243c46f
MD5 5ef312e0a16c7830716b7e1a6344ea1a
SHA1 e9bef1b26aec75a62d4201d7843db2a190438eac
SHA512 ca7247ed56deca1556450404b91855426b71071b1fb1ea9ef92594ac0d6cc350bbae33d28fd3b12c64928171e6727b3de8d2f770f1b03271b41c3689c34f3401
TLSH
T10141179CB6F91148B3B76E56ABFA68AD447EB9772F07C45D10010E4F0A22B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download