62f8a26f7610070f64051d5d09118f3d616b7c2e0ab87ac007f151db6f5478ad

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rsignn.html
Size 16KB
Sample260820-phjk9adc33
SHA256 62f8a26f7610070f64051d5d09118f3d616b7c2e0ab87ac007f151db6f5478ad
MD5 6d6ffb2dd175f5b78a668414f2656e6f
SHA1 c72ecc19f2b9abec994c7430ffeac243276a7aa2
SHA512 7a05594103d8c51abe6091edbee8bb26d54a1bf1afc2ec544f52f2bc8a443ff9877b25c29d50000f9ba29b08e226a5cd9e9ede042f13aa47e6a91db455ff478e
SSDEEP 384:OOAc1XbWxrB30zIgi+igPizici+ib30KB0C1:zAcxWxr10CP9WRP70W0C1
TLSH
T1FA729206B8850A961933A3A9AF76870DFF66411B4600C7187DEC76929F71F09E523FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
58	api.ipify.org
60	api.ipify.org
57	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4972	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317021331866842"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{5CB772FB-5650-456C-8419-FC94FD567051}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1188	msedge.exe
1188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 3264	4348	msedge.exe	89
PID 4348 wrote to memory of 4860	4348	msedge.exe	90
PID 4348 wrote to memory of 4972	4348	msedge.exe	91
PID 4348 wrote to memory of 4860	4348	msedge.exe	90
PID 4348 wrote to memory of 4860	4348	msedge.exe	90
PID 4348 wrote to memory of 1036	4348	msedge.exe	92
PID 4348 wrote to memory of 1036	4348	msedge.exe	92
PID 4348 wrote to memory of 1140	4348	msedge.exe	95
PID 4348 wrote to memory of 4532	4348	msedge.exe	94
PID 4348 wrote to memory of 1140	4348	msedge.exe	95
PID 4348 wrote to memory of 1140	4348	msedge.exe	95
PID 4348 wrote to memory of 4532	4348	msedge.exe	94
PID 4348 wrote to memory of 4532	4348	msedge.exe	94
PID 4348 wrote to memory of 3396	4348	msedge.exe	96
PID 4348 wrote to memory of 5860	4348	msedge.exe	97
PID 4348 wrote to memory of 3396	4348	msedge.exe	96
PID 4348 wrote to memory of 3396	4348	msedge.exe	96
PID 4348 wrote to memory of 5860	4348	msedge.exe	97
PID 4348 wrote to memory of 5860	4348	msedge.exe	97
PID 4348 wrote to memory of 2376	4348	msedge.exe	99
PID 4348 wrote to memory of 4800	4348	msedge.exe	100
PID 4348 wrote to memory of 2376	4348	msedge.exe	99
PID 4348 wrote to memory of 4800	4348	msedge.exe	100
PID 4348 wrote to memory of 5864	4348	msedge.exe	102
PID 4348 wrote to memory of 3272	4348	msedge.exe	106
PID 4348 wrote to memory of 1032	4348	msedge.exe	107
PID 4348 wrote to memory of 4592	4348	msedge.exe	108
PID 4348 wrote to memory of 2512	4348	msedge.exe	109
PID 4348 wrote to memory of 2512	4348	msedge.exe	109
PID 4348 wrote to memory of 4332	4348	msedge.exe	110
PID 4348 wrote to memory of 4332	4348	msedge.exe	110
PID 4348 wrote to memory of 1188	4348	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\rsignn.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2a0,0x7ffebfc2c188,0x7ffebfc2c194,0x7ffebfc2c1a0
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,14947613184985433857,10941348617410608720,262144 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,2600642927106269136,3517497964923557235,524288 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,6367298874266680279,17748422164471153933,524288 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:13
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,5448800465420016038,13480457570838042442,2097152 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,14531728549538757562,4406721231968572144,2097152 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,73960785340412881,6522002853594494312,2097152 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,15615098778473027036,6398923532886030997,2097152 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,14164158358566607895,6060057904055931384,524288 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,8773103585994075465,11032982915634463750,524288 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,10807654382900720720,6890793094402672819,524288 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,10807654382900720720,6890793094402672819,524288 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,281442499027564518,10226530820896056095,524288 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,7467350159513258170,6531359066707747104,524288 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,10886610653341914309,9801954959307406026,524288 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,9415297572033879332,42348918667866517,524288 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:14
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,14348211116463722731,16091632169252615547,524288 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5500,i,18347818613995486171,4579932215781048131,262144 --field-trial-handle=2336,i,720638400989668331,17211206801822712995,262144 --variations-seed-version --mojo-platform-channel-handle=812 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 01c8d0fa4cd383e5612800fe9e959b49c7f1582781ba61cc26f775ceabbc6c19
MD5 73c0fb6d8f926a50efc459700cd0d7f9
SHA1 3f1c20046241d7ee502bc586b5307a5ce88d3af5
SHA512 5a2cd7ec05177e97eaf08ee2a5922fa969c87b8e360c53b5d47fe8b643f96d02ff61c10f68f5e69fcc9576d6d83933b791cf698454888cc7bc942c4e484e1246
TLSH
T1DBE07DC58CDCE36EEB40E54753EDA30C8680370BDBC8FD8E3F0488847081A80B6C6A94
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8a707f31f592d03eeee99124908ee86c2be1e597df3c8be257cf4fdbadf1ce68
MD5 8d9fcb675961229a450af20072a310ea
SHA1 1975fe6d08bb6784ad59512a3cb2e633bd5f726d
SHA512 77bf289983bd2f50c865ef3f10721ae1f559331e80fa3811536f874ba20102d5a6a10c401aefd54f0a9c397dec3c4597a828d1bd21ed3b501d268973148a324e
TLSH
T1885150BC13E928CAD762EDF324F64A98B2F0A65A210F3F41D9A81D79CDC5F1414D0057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59616f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59616f.TMP
Size 2KB
SHA256 283a447d16c2a0b68448da5ec64e95554ce066c4589c02ca11968b77e1033a6a
MD5 faad57e75e93e9d72ff964f7d95e9f85
SHA1 454a60bbd1d828f92c9c0fa30b12daa833d7897d
SHA512 ce1088f5bf27cb16ebeeaba557be26ab51f582551863d7059d0df920f95b9aeb290badad436e647cde1a0ef8bfb1fab6f459b39b16fc5c5884e806a77cc61b79
TLSH
T19C514FBC13E928CAD762EDF324F24A98B2F0A65A210F3F41D9A81D79CDC5F1414D0057
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 dc0c7bdbdf73ada928d8cd55c143c07c8da1a7a415fa212dd929fb79486134d0
MD5 4220642df1143cdd4692dda05349fd6c
SHA1 203e82375939490babd30e24bfb8d1ae7cf0e8d8
SHA512 8173581d358d2e8e18a96d7d3656978fca923c22f5703c8d652af7994979898b420cb26d3621994d074cd6f9dacebf90ac9a07888680085f38ee42bdc4ab74a6
TLSH
T1F681BDF783E4877E891152F0AA256E2BCE1D151A432C3C6689F4AF1B63F24B1E10179F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fff88f1d059387f08da83ccdbfae4b5896639e2a778904c263800933278d17a0
MD5 6bef59921bf984c3eb6c1d66a3c13e37
SHA1 713c5d873f64e4e988ce6da763c9ea7adc3c3c0b
SHA512 6e3c09e653784fdd30026d07dc4794307999dc8390a61623948e0d0b89603d9da47e7e9e7ab86be3994d10c4fca171f46a3a23553409b3128048ca8f27ecd5e1
SSDEEP 192:sxRtR7Abc/fIsSVDde5lSI7zoD8p4u/g6+WNIYCRguOB+GkIgDqJ:sxRtRuc/fIsSVc5lvjj/5IIBGq
TLSH
T14A42C816AA28AD7B8CC7E34DFB55BF53D2F95032A1911E48ABFC861C04E76DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 38e7e952100dbf5d51ae7494ff9c0d9116497a08e5faeac2e9efe34873be6315
MD5 de51fb42c67271482933978ffe64bb60
SHA1 3e7fc62f5e36ece0947d7ab2b3e321261932148d
SHA512 5676ab2df62b5ce5df75bd16a0c8c96181207227420fe802ff20e2e8148afed10736451b540fbfa45386d34da02205f46711032cf397a9e4afe9ec47aa3948c4
SSDEEP 192:sxR2R7Abc/fIsU3Dde5lSI7zoD8p4u/g6+WNIYCNYuOB+GkIgIJ:sxR2Ruc/fIsU3c5lvjj/5I0BGs
TLSH
T1AF32B6166A28A97B8CC7E35DFB55BF53D2F95032A1905E48EBFC861C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 02fd07657b7d298754b555b9f26e67fc2a8282059af753059cf514a8a54e556b
MD5 cce5a50c9dbcf89143945b8189e49d07
SHA1 85ce4c0fee05d32db1305f2c919c40a185bb5c38
SHA512 8a2218a404f483e727d5c282bd29da69e1f762a4e6cb872d668c838c3e7aaee0364284c83972fe670ba35a161ff49b72fe82afd76c762099ec95db33a1c660d4
SSDEEP 192:sxRtR7Abc/fIsS3Dde5lSI7zoD8p4u/g6+WNIYCNYuOB+GkIgDYJ:sxRtRuc/fIsS3c5lvjj/5I0BGg
TLSH
T13832C7166E28A97B8CC7E30DFB55BF53D2F95032A1901E48ABFC861C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 215dfec4108fc25ad2bdf96a51f41796d2abebb8f4226ad304ec93bc7777824b
MD5 36b738ec2c278296d6bae30ff25a397c
SHA1 8a7292002f96a2bff255da61baf0ffaba45533b6
SHA512 1e2ee382215facaaaf1f3602f553123060b1d33927d2325dd94ba721953ba2e96ba1da3dd347422151eca608eef4c9f7f5fce3747e2e613e75239c023129791f
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvdroZSZ:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0VE
TLSH
T190B2EA2B600DCB7F4F800AADAC197FD76DA802CB97589D5047FED94C02C77EA92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7a20324e621b26900820fb605083b42d6db56396bb7a20806cb0c352e6111e72
MD5 a7b7a688388038de6417e42efa291ab3
SHA1 176fd064d8ad2ef604d18f5029f46f71c07b4ded
SHA512 60284eb12cd17c3ba4c8cc20897db133bd7d9856dced4708edaafda936ba748b3f7cb09b2c575c01ca3e7facc45a84098f3e3cf1dd5726cce703970abf4ba599
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHPY95PNtBW4bmKEw2216KOEV:CbEBVj5JAdSp9/EgTK7j6dJOHPY95PNJ
TLSH
T16D918451B2BE03803D3F651C80A8C83AD68270A7315DA96B3FA805661B67E017EFDDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6e302b548608ffa9175e950bbb294f8c731d6b46e8111590037632785ac56beb
MD5 b63f30ffda1a840f747b5f991ad61027
SHA1 3e0b7ea0cff06db3e6351574be9c34a16a4125d0
SHA512 a95409dcf67d93ec8f15626623fcfa5106abef14027e1835d17db3ba72230e80a6cb11b6d01f53c58e200c6f78fda30ba2364395b7d1a377935d10c059459a74
SSDEEP 768:wrv+4UNbdD3HZN53Np8+p3bd66j+4BRv86aLITt2bwCl1:wbsbp3HVL8+p3Z6n4yc0ww
TLSH
T1A103BE73E46899339DE6C684B1867A437FF8929396C10AD4D8CD2B4E419B19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 94b5e5fa43c1fbb2f317b3a61ec24463f307b82049626cfcf45414d62fffd619
MD5 422188115c473586e3a96dd4be621eac
SHA1 3775a3da79aa2251cd2dc7935913d07ee16cf35e
SHA512 5c795c7583734de49afb1df6b1a2356686e4b4dbda6d314423b885291630c5225a46fe70a344a606f422dac6fa31d0310bc73ba5dfef3af956c51eb9d2d44413
SSDEEP 768:3rv+4UNbd83jvDz53Yp8+p3bd66j+4BRv86aLIWtfCM:3bsbi3jvlm8+p3Z6n4yHf3
TLSH
T16B03BE72E8A9D9338CF6C684B2873A43BFB8515386C11DA4D8CD6B5D059B1AE130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 2e1c45428b8e1477ca86f7d317772026269a67f39296735940e9229b28849f8d
MD5 aa82fd2f6433a926e2f7b2074ea56b6e
SHA1 fba203302727ea3e8b207cdb1fc62d9e48de00ac
SHA512 d343e778a8c00b65941a321cbfc6c746a895022a06ac461906cd217b715cd5a24d0f41d85b4afbf9de5cdbb263fdbb4499904a4a664ffa7e07e29329e45d9249
SSDEEP 768:ar3+6z53Fp8+p3bd66j+4BRv86aLIWtfCVC:ar3+yT8+p3Z6n4yHfAC
TLSH
T1C4F2BEB2E8A59D774CF5C784B2863A03AFF4816396C45D9498DC6B1E059B2AE130BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ea98c7fbd7040f6eea83f190f918631ea068385b0980423178b34382bd230ab9
MD5 06b703a4483b29e7706eb49e44091344
SHA1 1de5bbd232bfd447fc56d28a8c4bdbda6ee8f104
SHA512 946b72ba97dbbf75d58ccee3df1fd19c5dc33d443fd265af98afd112cf6a4d8b793e36de9a8a8f53f0082d5e6d7d1a764a70e2738f233bfef99fd32ab872e0a0
SSDEEP 768:Nr3j6z53Fp8+p3bd66j+4BRv86aLIWtfCVC:Nr3jyT8+p3Z6n4yHfAC
TLSH
T1CDF2BEB2E8A99D774CF5C784B2863B03AFF4416396C45D9498CC6B1E059B2AE130BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 8061ffdfae750251b1b56bf17b8b7a55cbcc6c6f29425b2d6dac5dacdd9c4ca3
MD5 8175245adf8da53c5a6545f0381805fe
SHA1 db338497bb9d0acd02d80fc7690d11052dd82601
SHA512 1b9007291337a3e625dbea325d72bc16d3b41f6d02bce64bf746c0586a4409a2f7803c44fdecc82a7cce57a879e9533240fc4e099aadc3a2f75c9ba121cbe3b0
SSDEEP 768:+FQb3gwgx6z5mp8+p3bd66j+4BRv86aLIWtfCVC:Vb3sB8+p3Z6n4yHfAC
TLSH
T128F29EB3D895C9779CF6CB84F64A3603AFF441A3C5C4A9A4E9CCAA1D11971AD130BC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c847c1a8c8a54a639aef4ae36aaac254b46ff10479ceac8193b763271e60878b
MD5 a3e586a746fbb3fbba9c7b42af2c68f5
SHA1 70fdda62392608a6ee747bb4c71e94986163147b
SHA512 aa61f0ed9f8f4acac13ff5e0b828a160fe3efd9216a8946cea89cb87d0bf0ee22d3d961f4f193ba005acd6e04bf553c058176f53e8ab49f9f12960ebf99c87b9
SSDEEP 768:Irv+4UNbdD3fcVNp8+p3bd66j+4BRv86aLIiF2bwCl1:Ibsbp38L8+p3Z6n4yn0ww
TLSH
T1C903BE73E9A899339CF6C644B2467B437FF851A396C10AC4D9CD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9f4c6c6-38e4-44df-b4a0-6929c6a08ba9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c9f4c6c6-38e4-44df-b4a0-6929c6a08ba9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download