ce8b58273588cbf111ed640924a2c3269c787f3fe363cfb6e71a3d8acddb281a

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rsignn.html
Size 16KB
Sample260819-pkg57sfa82
SHA256 ce8b58273588cbf111ed640924a2c3269c787f3fe363cfb6e71a3d8acddb281a
MD5 abe11ea3a6f8d971c7d5804945ba3500
SHA1 7976a6b0474744d72f8628303f046799c9d1c062
SHA512 a7849a2266c592cd704f27d5dcad22a617fe7522293b55f7c563f7d5dcfe0dc22dbddce95c0230d5b4a013fc800acd31382cffb56e172005de007322a43b9c15
SSDEEP 384:9OAc1YSWxrd30zIgi+i+fPizici+ib30KB0y:IAc/Wxrx0CP+CWRP70W0y
TLSH
T119729216B8850A921933A3A9AF76870DFF66411B4600C7187DED76929F71F0AE523FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
62	api.ipify.org
63	api.ipify.org
64	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3396	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316162821519479"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{2113297B-25DF-4885-8D5E-F541EEF3575F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 5980	2392	msedge.exe	88
PID 2392 wrote to memory of 4188	2392	msedge.exe	90
PID 2392 wrote to memory of 3396	2392	msedge.exe	91
PID 2392 wrote to memory of 4188	2392	msedge.exe	90
PID 2392 wrote to memory of 4188	2392	msedge.exe	90
PID 2392 wrote to memory of 4368	2392	msedge.exe	92
PID 2392 wrote to memory of 4368	2392	msedge.exe	92
PID 2392 wrote to memory of 4748	2392	msedge.exe	93
PID 2392 wrote to memory of 4748	2392	msedge.exe	93
PID 2392 wrote to memory of 4748	2392	msedge.exe	93
PID 2392 wrote to memory of 3496	2392	msedge.exe	94
PID 2392 wrote to memory of 3496	2392	msedge.exe	94
PID 2392 wrote to memory of 3496	2392	msedge.exe	94
PID 2392 wrote to memory of 4796	2392	msedge.exe	95
PID 2392 wrote to memory of 4796	2392	msedge.exe	95
PID 2392 wrote to memory of 4796	2392	msedge.exe	95
PID 2392 wrote to memory of 2312	2392	msedge.exe	96
PID 2392 wrote to memory of 2312	2392	msedge.exe	96
PID 2392 wrote to memory of 2312	2392	msedge.exe	96
PID 2392 wrote to memory of 4880	2392	msedge.exe	98
PID 2392 wrote to memory of 5400	2392	msedge.exe	99
PID 2392 wrote to memory of 4880	2392	msedge.exe	98
PID 2392 wrote to memory of 5400	2392	msedge.exe	99
PID 2392 wrote to memory of 2944	2392	msedge.exe	101
PID 2392 wrote to memory of 5512	2392	msedge.exe	105
PID 2392 wrote to memory of 4492	2392	msedge.exe	106
PID 2392 wrote to memory of 4748	2392	msedge.exe	107
PID 2392 wrote to memory of 6028	2392	msedge.exe	108
PID 2392 wrote to memory of 6028	2392	msedge.exe	108
PID 2392 wrote to memory of 1760	2392	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\rsignn.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffe9a3fc188,0x7ffe9a3fc194,0x7ffe9a3fc1a0
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2056,i,9837502003254348805,1563684291501688701,262144 --field-trial-handle=2888,i,4232999181399634663,10182505846092312029,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:2
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,17791474388885682186,10145930951830035022,524288 --field-trial-handle=2888,i,4232999181399634663,10182505846092312029,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,3137892023350272512,3292389354495438767,524288 --field-trial-handle=2888,i,4232999181399634663,10182505846092312029,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:13
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3368,i,8353483533082701518,447439669025852759,2097152 --field-trial-handle=2888,i,4232999181399634663,10182505846092312029,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3376,i,1251692557360133575,18028687571297118625,2097152 --field-trial-handle=2888,i,4232999181399634663,10182505846092312029,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,16895975079526208984,5979574032509753034,2097152 --field-trial-handle=2888,i,4232999181399634663,10182505846092312029,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,15704880666983115963,6026706931262916915,2097152 --field-trial-handle=2888,i,4232999181399634663,10182505846092312029,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,12253868426008180634,5605168277909940477,524288 --field-trial-handle=2888,i,4232999181399634663,10182505846092312029,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,6579019682538089349,13431212926643944260,524288 --field-trial-handle=2888,i,4232999181399634663,10182505846092312029,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,5404501984043324467,4240751160855240224,524288 --field-trial-handle=2888,i,4232999181399634663,10182505846092312029,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,5404501984043324467,4240751160855240224,524288 --field-trial-handle=2888,i,4232999181399634663,10182505846092312029,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,11033589098823926818,3476977115478606135,524288 --field-trial-handle=2888,i,4232999181399634663,10182505846092312029,262144 --variations-seed-version --mojo-platform-channel-handle=1244 /prefetch:14
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,5452422990143612602,8875028225230053147,524288 --field-trial-handle=2888,i,4232999181399634663,10182505846092312029,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,16357018521080898104,5335238212053884901,524288 --field-trial-handle=2888,i,4232999181399634663,10182505846092312029,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,3537624368599046997,3578419621536110317,524288 --field-trial-handle=2888,i,4232999181399634663,10182505846092312029,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6552,i,1790548473509690484,15837026097964568409,262144 --field-trial-handle=2888,i,4232999181399634663,10182505846092312029,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f30fb5f5494c523a19e39ebef4db64f53d21021b5e9a86d7f311d16d8545d1aa
MD5 ba50da98fb7ec7e722e93ff961a7b306
SHA1 a4bc7fce1f83042c6f077340ceb65bbf9e4fc43e
SHA512 eb26a298be6c1104b7b6fc80980b7c3e0aff9acc77b4fe3ccf09792a8abb721717af510853ecdc7368fcb5e56ae0be79e29ff23a39715d0e7ae3b93b5e37bc11
TLSH
T1066129604F140AD3D72342B2D1E3836B33F7B7AE420B1A235C60BD38880AF9094D29E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f061.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f061.TMP
Size 3KB
SHA256 073496c466ae670a54a53f58abf9a2de8a0349833b959f8a6207caae43aeb2fa
MD5 e7763f73f51ea9af1bb0781af4d7d60d
SHA1 11522cff988eef2ca1f5f256e71c92d4c68ec6b9
SHA512 16f4b52b0b3bfb062d8bd9a6b4586387bf23cee91b1415e777df6b90bb04aa518957f79bf5c4f36bc021cbaa9d52aec4f92dce89cfdc7591d4ae4bbd88c9d491
TLSH
T1F46109615F141A93D72341B2D1E3836B37F6B7AE42071A235C60BD38980AF9494D25E3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1e5f4bb66a6e1a04141f1b43bcffb1fe747b1c1f68829d92e364f191444cf06e
MD5 d6717ca8ded03e95425c063cf92fa95c
SHA1 ea90ede7a162a384ee0be1549f8a42b61f52e63c
SHA512 5fa60a88e2185e2d81384f655a6cf86d434f30ba8a333a209219a1c278c5507627ad54a7329fa8bcbb5a0c581dd1759783d9ec87dc595dfb44327f5195c6da09
TLSH
T10B819DF783F5876E891192F09A256E1BCE2D0517422C7C668DF4AF1B63F28B1E10169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fd109a7d-b5d5-49c6-94b5-d77e80199890.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fd109a7d-b5d5-49c6-94b5-d77e80199890.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 531c9ba1039209267315b66439f56ca5b0fefdfc990fa706075869fa73c3ecbe
MD5 8aff3fc40ce4ac67694920ec5f41c45c
SHA1 5c1d546dc72f8d4cb5c6da347984781be3c6f00f
SHA512 d11241ac54de0b2a19ce36e9e6ba977cdba1633f35f5fbcf7f14c7f3096174a24add3b72944daa6503db448babba5b360cbd4cb85a060f03cd29ed9e1441a754
SSDEEP 192:sxRPRsbF/f8s0ipq1zntzoD8p4x/g6+WNIYGlbmkLGWIgIJ:sxRPwF/f8s0i4bJQ/5IDXs
TLSH
T1CF32D8156D68A93B9CCBE20DFA65BF53D2FD503260912E58A7FC860C04EBADE120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c4688cd5f2a4bd1494cf01c564a8afb24469eda640013c69ce8c9d43340d68e2
MD5 f0c6a4ae642300883d95f3b846394c21
SHA1 52e4d7c45cfc6979d4433600aa6cf5776c43ee42
SHA512 28c16f54b90eaa77c185690c8d67d1aebd433995ef93db4fcbfdc318fd3203d783caaf9ddf90f98aaa9c99ceca047a8ee21295ae8c38431586cfee89c663e968
SSDEEP 192:sxRcRsbF/f8s+ypq1zntzoD8p4x/g6+WNIYGd2kLGWIgDDJ:sxRcwF/f8s+y4bJQ/5IHXx
TLSH
T19542D8156D68A97B9CCBE20DFB55BF53D2F9503260912F48A7FC8A0C14EBADE120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 22e2daa03b7b7437129bdfd7d25c113649f62c3bb22cb61f98d093af13c07c57
MD5 c62499921ca24d5eabced588bf257b80
SHA1 c8d565b87785d8fe717faf7f7d69555a7b762c9d
SHA512 581cad905faa6351da1dbcca621ec2f10e80fee9ee2eadd5eb837f52bf1ef8ef93b54037b1645d88043d3614d30fe4aa8d57d8047253af3d5b1dc67a5d7afa9c
SSDEEP 192:sxRcRsbF/f8s+ipq1zntzoD8p4x/g6+WNIYGlbmkLGWIgDtJ:sxRcwF/f8s+i4bJQ/5IDXz
TLSH
T1EE32D8156D68A97B9CCBE20DFA55BF53D6FD503260912E58A7FC860C04EBADE120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 8425525892c444f22b8e584c0cfe3804b544a035254e9b453d7d5004162acad5
MD5 a0366e6276a79ca854b3ce3394b27ef2
SHA1 3d07a71f6c0fa90dfbd7d48b959a0404ac19f271
SHA512 a5f90f50273dea6184d5758f70cee32f4c7bfe0a68100bae5dc9b380660d43a939c31df5e9b017eab549e9c0291cad2f414074f950da72d38236612b7d7d1df6
SSDEEP 384:US5Yi0hfCtgvZFfxJKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVDT9NHRI+rowPF:UQYi0NWgv7fxJ8F1+UoAYDCx9Tuqh0VM
TLSH
T143B2FB3B604DCB7E9F800AADAC197FDB6D9802C796589D4047FE990C02C77FA911A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

707d5622-7b04-44dd-ae60-74b9d272980c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\707d5622-7b04-44dd-ae60-74b9d272980c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6d69912f2ec838cc46ae2d7c383338e1743f6e491f68693b7ca025c94a4b28ad
MD5 602efca467c9a1279d5aa0540718d7b1
SHA1 4fa3af2cd579eb5feb0ce07c1d71233c4e36b26d
SHA512 0d8efab902689d29af059c181c38f3d2bacd3882c39ed70406890181c617bf8039981945e9023ae8febb05f1353f3ecdf54cef6d50bb77c56719b7bcab3216f3
SSDEEP 768:Prv+4UNbdS3H2lYyr0H7Hucys6BRvi82oP4/z6himofa2bwn+h:Pbsbw3VG3imOz6ImoS0w+
TLSH
T1AB03BF35E4149A73DDF78188B44ABA537FF9436345C95AC0D9DE6B0E028B96E130BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 820274185c0aed9239d8c80a2996cfbc811b553edd73ec1158807e31d7342319
MD5 c129778cb26b375fa4025038c65a6ec1
SHA1 4fa5381a5d1a2faa5699e5fc865be939feb8d10a
SHA512 36783923a46efa762d9a19f733bcc825d270923c682544d4850fb511c91534a9ad1f909ef7a107099912acec9f1e5df43fb80bd97a6dce53df1b39d604f78535
SSDEEP 768:rr3VslYyr0h7Hucys6BRvi82oP4/z6himo6afF:rr3BA3imOz6ImoNfF
TLSH
T18EF2AF34EC509D739CEBC2D9F5463B52BFF5422352CC5E8499DEAB1D168BA6D030B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c819b1bbe280b8141dd233624894dcdd84a4c5f3a4df0265ecdaa1f4509b3c0f
MD5 8d4e6b54e150430171a6f74a57c4852b
SHA1 64efbe2407c98ecd61c01a55998153b06814e02e
SHA512 9f10ad0dde8ccd1d067762e86cbef44f4e720f491ef2872b3bb6b04c7373f12871006e424892bbd6acc1e33282671ac96b51545fcf63d6208eb3e29e4c2c1980
SSDEEP 768:Prv+4UNbds3dslYyr0w7Hucys6BRvi82oP4/z6himo6afL:PbsbK3Jl3imOz6ImoNfL
TLSH
T11B03BE35F8549E739DE7C2C8B04B7A537FF4026345CC1E90D9DAAB1D428B9AE130B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 73edf4a22ff5b786b872fea997ba9801f5515cc3608eb9521ec180ccf596d367
MD5 651f89613dcb85a3e80b3600de922f04
SHA1 dd5bb769e016df8bd7580eab711fea79212a8046
SHA512 36ecab6b36c410a57df0ede9d40c42c9660ab502a307f076618d2a785e5f906650de133811151abc950a6c3cc878cf9b21866ce7b86b355c659a3f3548ed870c
SSDEEP 768:lr36slYyr0h7Hucys6BRvi82oP4/z6himo6afF:lr3qA3imOz6ImoNfF
TLSH
T118F2BF34EC509D739CEBC2D9F5463B52BFF5422352CC5E8499DEAB1D168BA6D030B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d68d78e8846d2540eb3d7161a6a87753ad53e316e83a426a173cef4d8a707dc3
MD5 ddf672c4a20159cbf96b236b80986c21
SHA1 1da2a96ec1951d12a36d4174296f0f828e663ec5
SHA512 90ef69194d34a55ebefc848ce046ba0935559ee6b900f1a306eb41f68c8b9161fbbed6925cfc9a4fe2103bab80c51ea61756c63dbc3340156671274888965297
SSDEEP 768:xGrv+4UNbdS3CXplYyrq7Hucys6BRvi82oP4/z6himo+L2bwn+h:xGbsbw3CJ3imOz6Imoo0w+
TLSH
T14A03CF36E4589D73ECEBC188B44ABA537FF4526345C95AC0D6DE6B0E028B95E130BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 a1f41ddb82d2790396005597ca1532052ee58a9d41bd8f0f0355de3b02994b5c
MD5 b16e41bbb7d7e07b91f625efca3296d1
SHA1 d7b94da108b81625325c1f20aa94c1e0aed65023
SHA512 1e2d043006705f4716a7ec20060fb69df9c3039e25c0f729bc4429aa0fe11ae1cf7cec5a6ad7b9abe95b3fa05fd1b2d940407c7379df790c871a75abc9ce7c6c
SSDEEP 768:IFQ138wg0slYyr0z7Hucys6BRvi82oP4/z6himo6afF:r13r63imOz6ImoNfF
TLSH
T163F2AE369C40C977EDAAC6C8F54A3652AFF1426385CCAD94EADEAF1D118759D030BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f44245f7-7fc5-4ec3-b3b3-c1aecfb1658a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f44245f7-7fc5-4ec3-b3b3-c1aecfb1658a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download